Jetpack visitor analytics use four cookies to track readers for years

Jetpack’s built-in visitor analytics quietly records every page view, referring site, search term, and outbound link click on sites that use it. The tracking runs on four cookies. Their lifespans stretch from a single page load to five years, according to Jetpack’s own documentation on automattic.com.

The Cookie That Holds a Five-Year Memory

The longest-lived of these, tk_aip, stores a list of anonymous visitor IDs so they can be merged into one identity once a visitor is recognized. It persists for up to five years.

Tracking Beyond the Site’s Own Dashboard

The same shared visitor-tracking library also powers Jetpack Instant Search and WooCommerce Analytics, meaning the tracking reaches beyond a site’s own stats dashboard.

Three Cookies Handle the Plumbing

tk_ai stores a randomly generated anonymous visitor ID so the Tracks analytics library can link events to the same visitor; it lasts for the session in wp-admin but up to five years on the frontend. tk_qs queues analytics events so none are lost if the page closes before they can be sent, and it expires after 30 minutes. tk_tc is used once per page load to determine which cookie domain the Tracks library should use, then deleted immediately after it is read back.

Years of Follow-Up Without a Login

For site owners, the practical consequence is that a single reader can be followed across visits for years without ever logging in, as long as the browser keeps the cookie. The documentation does not state what happens when the anonymous IDs are merged into a recognized identity, or what notice visitors receive, leaving those questions open on the record.

Worth a look