Amazon Ads has switched on a new cookie inside the Amazon Ad Tag, the JavaScript tag advertisers place on their own websites to report visits, sign-ups and purchases back to Amazon. According to a release note dated November 16, 2026, the tag "now sets a first-party cookie, aatSession" on advertiser websites in North America. The cookie holds a session identifier that links the events a visitor triggers, and it expires 30 days after that visitor's last page view. Advertisers do not have to do anything to receive it. Those who do not want it have to add a line of code to every page.

In Short

Amazon's website tag now drops its own cookie on North American advertiser sites, so Amazon can connect one visitor's page views, sign-ups and purchases for up to 30 days after the last visit. It matters to anyone running the Amazon Ad Tag, because the change is on by default, it depends on consent signals, and it reaches into measurement and attribution reports. If you want it off, Amazon's documented route is one command added to the tag's base code on every page, before the first event fires.

What the release note says

The note sits at the top of the Amazon Ads API release notes in Amazon's Advanced tools center, under the heading "Amazon Ad Tag adds a first-party session identifier cookie." It carries the date November 16, 2026, although it was already showing on the release notes page on November 14. It runs to three short paragraphs.

The first sets out the purpose. The cookie holds a session identifier "that links the events a visitor triggers on your website, so Amazon Ads can measure and attribute those events more reliably as third-party cookies are phased out," according to the note. The second deals with consent and the off switch: "AAT sets, reads, and sends the session identifier only when the visitor's consent signals allow it, including TCF, GPP, and the Amazon Consent Signal (ACS). No setup is required." The third sends readers to a section called "Session identifier" in the Amazon Ad Tag guide.

That guide section, part of a page titled "Validate and share," adds detail the note leaves out. It describes the cookie's availability as "North America only." It says AAT creates and reads the identifier automatically and "sends the session identifier with each event it captures." It lists no countries, and nowhere does the section say whether Canada and Mexico are covered alongside the United States.

How the session identifier works

According to Amazon's guide, the mechanism has six parts.

  1. The cookie is set on the advertiser's own domain, which makes it a first-party cookie rather than one belonging to an Amazon domain. Its name is aatSession.
  2. AAT creates and reads the session identifier without any configuration. The guide states that advertisers do not need to add code or change the tag's settings.
  3. Every event the tag captures from the website, such as a page view or a purchase, carries the session identifier back to Amazon.
  4. The cookie expires 30 days after the visitor's last page view on the website, so each new page view pushes the expiry date forward.
  5. AAT sets, reads and sends the identifier only when the visitor's consent signals allow it, with TCF, GPP and ACS named as the accepted signal types.
  6. Advertisers can turn the cookie off with a single command, placed in the base code before the first event.

The guide prints the off switch inside an example of the tag's base code:

<script>
  // ...your Amazon Ad Tag base code...
  amzn("disableAATSessionCookie", true);
  amzn("addTag", "YOUR_TAG_ID");
  amzn("trackEvent", "PageView");
</script>

"When this line runs," the guide says, AAT "Deletes any existing aatSession cookie" on the domain, "Does not set a new aatSession cookie," and "Marks each event to show you turned the cookie off." That last point means Amazon can tell which events arrived from sites that disabled the feature.

The guide also limits the command's reach. "The setting applies to the current page only," it reads, and Amazon suggests placing it in a shared site header or a tag manager so that it runs everywhere AAT runs. Reversing the decision is not symmetrical either. "Passing false does not turn the cookie back on for a page where it was already turned off," the documentation states; the cookie returns only when the line is removed. Turning the identifier off does not stop the tag. "Other AAT features, such as events and hashed identity signals, keep working," according to the guide.

Two Amazon cookies on the same site

The aatSession cookie is not the first first-party cookie Amazon's tag writes. The same "Validate and share" page documents a second one, amznAref, which supports click attribution. When a shopper clicks an Amazon ad, the destination URL carries an aref parameter. AAT detects it on page load and stores the token in amznAref, which the guide says "persists for 30 days." The token "does not contain or transmit personal data" and "works independently of third-party cookies," according to Amazon. For it to work, AAT must be installed on the landing page and must fire at least one event there.

amznAref aatSession
Purpose Stores the click measurement token passed in the aref URL parameter Holds a session identifier that links one visitor's events on the site
How it is set AAT detects the aref parameter on page load AAT creates it automatically, subject to consent
Duration "The cookie persists for 30 days." 30 days after the visitor's last page view
Region stated in the guide None stated North America only
Consent wording in the guide No consent sentence in the section Set, read and sent only when TCF, GPP or ACS signals allow it
Off switch documented None in the section amzn("disableAATSessionCookie", true); on every page, before the first event

The two serve different jobs. The aref token ties a visit to a specific ad click. The session identifier ties the visit to everything else the same browser does on the site afterwards, which is the gap that third-party cookies used to fill for ad platforms.

Amazon has been building its consent plumbing for two years. On October 18, 2024, according to the release notes, Amazon Ads introduced the Amazon Consent Signal as a way for advertisers and partners that do not use the IAB Transparency and Consent Framework to pass users' choices along with a country code. The same note described a command called setAmazonConsent for "regular AAT" that "takes all of the consent fields as a JSON object." From November 6, 2024, Amazon Marketing Cloud accepted TCF, GPP and ACS signals.

The rules hardened on December 1, 2025. That release note states that anyone sending personal information to Amazon Ads "must provide the country code for all data uploads globally," and that data with a UK or EEA country code must also carry "a valid consent signal." Advertisers can use TCF, which passes choices as a TC string, or GPP, or ACS. "Please do not send multiple signals. If multiple are provided, Amazon Ads will use TCF and ignore ACS," the note adds.

Enforcement followed. As PPC Land reported in May, Amazon set June 30, 2026 as the deadline for consent signals across the Amazon Ad Tag, the Conversions API and the Events API, after which unconsented data from UK and EEA users would not be processed. That article noted that AAT requires a consent management platform integration for this purpose.

The new cookie, though, is limited to North America, where the regulatory picture differs. TCF is a European framework. GPP, the IAB Tech Lab's Global Privacy Platform, packages signals for several jurisdictions, including US state privacy laws. Not every North American website runs a consent management platform, which leaves the key question open: does AAT set the cookie when a visitor arrives with no signal of any kind? The release note and the guide both say the identifier is set "only when the visitor's consent signals allow it," but neither describes the default when there is nothing to read. Amazon's Google Tag Manager template for the tag, version 4.0 on Amazon's GitHub account, states that its consent library defaults all signals to denied until they are set, and that the tag does not fire when Google's ad_storage or ad_user_data consent is denied. That behaviour covers the template, not the base code, and the template's documentation does not mention aatSession.

The stakes in consent gating are not abstract. Google's tighter enforcement of Consent Mode V2 was blamed in April for one advertiser's Google Ads conversions dropping 90% overnight, a single account rather than a broad dataset. A session identifier that only appears with consent will be present on some visits and absent on others, and reports built on it will reflect that split.

Third-party cookies that did not disappear

Amazon's justification, that third-party cookies "are phased out," fits some browsers better than others. Apple's Safari has blocked all third-party cookies by default since March 2020. Google's Chrome, the largest browser, went the other way. Google said on April 22, 2025 that it would keep third-party cookies in Chrome and would not roll out a standalone prompt asking users to choose. On October 17, 2025, it retired most Privacy Sandbox technologies, the replacements it had built for a cookie-free Chrome.

Amazon's own release notes carry the earlier expectation. On February 28, 2024, Amazon told developers it would shut off the legacy Pixel APIs in Amazon DSP by August 1, 2024, writing: "As we approach Chrome third-party cookie deprecation in the second half of 2024, we plan to shut off legacy Pixel APIs in Amazon DSP." The note recommended that advertisers "migrate to Amazon Ad Tag at the earliest." A July 11, 2024 note on Sponsored Display described modeled conversions as a response to conversions "not directly measured due to the phasing out of third-party cookies and changing regulations."

Chrome's cookies stayed, yet the reasons for first-party measurement did not go away. Safari's block, ad blockers and consent rules all cut the signals a third-party cookie can carry. Amazon has continued to lean on modeling: in January, PPC Land reported that Amazon moved view-based attribution to a shopping-signal model for campaigns across 28 markets, and a November 2, 2026 release note says Amazon Marketing Cloud's new-to-brand columns now include modeled conversions, which count purchases that "can't be linked directly to an individual ad interaction, for example because of signal loss or privacy regulations."

Safari's seven-day question

There is a technical wrinkle the guide does not address. Under Safari's Intelligent Tracking Prevention, cookies written by JavaScript are capped at seven days of Safari use, well short of the 30-day window Amazon describes. AAT is a JavaScript tag. If aatSession is written by the script in the browser, as a client-side tag would normally do, a PPC Land reading is that Safari visitors returning after more than seven days could arrive with a fresh identifier rather than the old one. Amazon's documentation does not say how the cookie is written, does not mention Safari, and does not say whether the 30-day expiry holds in every browser. The guide mentions server-side AAT through a Google Tag Manager server container in its click-attribution section, but says nothing about how aatSession behaves in that setup.

From pixels to tags to servers

The aatSession cookie is the latest step in a migration that Amazon's release notes trace back to 2023. On May 29, 2023, Amazon DSP introduced the Amazon Advertising tag and the Conversions API as "durable alternatives to Simple Pixel," which was "to be deprecated by the end of 2023." On January 5, 2024, signals from the tag, the Conversions API and mobile measurement partners became available in Amazon Marketing Cloud, with data from October 20, 2023 onwards.

The server route has grown since. Amazon opened the Events API in beta on September 26, 2025, presenting it as "a complementary method to Amazon Ad Tag (AAT) for sending website events as the browser-based tracking is susceptible to ad blockers, browser privacy settings, and cookie limitations." On September 28, 2026, the Events API gained an AREF_TOKEN match key for click-based attribution, a plain-text IP address field and the raw user-agent string. It reached general availability on October 15, 2026 through the endpoint POST /adsApi/v1/create/events.

Seen against that sequence, the session identifier strengthens the browser side of Amazon's measurement. Server integrations avoid ad blockers and browser limits but depend on the advertiser's own systems. A first-party cookie inside the tag gives Amazon a way to group a browser's events without asking the advertiser to build anything.

Why it matters for marketers

Amazon's advertising business is large enough that changes to its measurement reach many advertisers at once. Amazon reported third-quarter 2026 advertising revenue of $19.64 billion, up 11%. Amazon DSP campaigns and Amazon Marketing Cloud analyses that count off-Amazon conversions depend on AAT, the Conversions API or the Events API to receive them at all. Amazon's pitch to advertisers has increasingly rested on identity. In May, PPC Land examined its authenticated graph, which Amazon says deterministically reaches 90% of US households through sign-ins and devices. Visitors to an advertiser's website are not signed in to Amazon there, which is where a session identifier on the advertiser's own domain fills a gap.

The default-on design follows a pattern seen elsewhere this autumn. Meta switched on a Pixel setting that measures conversions on customers' devices from November 12 for advertisers who take no action. Amazon's change works the same way: the cookie arrives unless the advertiser opts out, and the opt-out has to be repeated on every page. For agencies and in-house teams, that has practical consequences. A new cookie name on the domain means cookie inventories in privacy notices and consent tools no longer match what the site sets until they are updated. Measurement teams comparing Amazon-reported conversions before and after November may see differences that stem from how events are grouped, not from changes in campaigns. And Amazon now marks events from sites that disabled the cookie, which means the choice itself is visible to Amazon.

What the documentation leaves out

Neither the release note nor the guide says what the identifier contains, whether it is written by JavaScript or by a server, which countries "North America" covers, how the cookie behaves when no consent signal is present, or how the 30-day window holds up in Safari. They also give no figures on how much measurement or attribution is expected to change.

Key facts

Item Detail
Product Amazon Ad Tag (AAT)
Feature Session identifier
Cookie name aatSession
Cookie type First-party, set on the advertiser's website
Availability "North America only," according to the guide
Expiry 30 days after the visitor's last page view on the website
What it does Links the events a visitor triggers on the website; sent with each event AAT captures
Consent Set, read and sent only when consent signals allow it, including TCF, GPP and the Amazon Consent Signal (ACS)
Setup None required
Off switch amzn("disableAATSessionCookie", true); in the base code on every page, before the first event
Effect of off switch Deletes any existing aatSession cookie, sets no new one, marks each event as cookie-disabled; events and hashed identity signals continue
Re-enabling Remove the line; passing false does not turn the cookie back on
Related cookie amznAref, click measurement token from the aref URL parameter, 30 days
Release note "Amazon Ad Tag adds a first-party session identifier cookie," dated November 16, 2026, Amazon Ads API release notes: https://advertising.amazon.com/API/docs/en-us/release-notes/index#amazon-ad-tag-adds-a-first-party-session-identifier-cookie
Documentation "Validate and share," Amazon Ad Tag guide, section "Session identifier," no update date shown: https://advertising.amazon.com/API/docs/en-us/guides/ads-data-manager/data-sources/amazon-ad-tag/validate-and-share#session-identifier
Server-side alternative Events API, generally available since October 15, 2026, endpoint POST /adsApi/v1/create/events

Timeline

  • March 2020 - Safari blocks all third-party cookies by default
  • May 29, 2023 - Amazon DSP introduces the Amazon Advertising tag and the Conversions API as durable alternatives to Simple Pixel, which was to be deprecated by the end of 2023
  • January 5, 2024 - Amazon Ad Tag, Conversions API and mobile measurement partner signals become available in Amazon Marketing Cloud, with data from October 20, 2023
  • February 28, 2024 - Amazon says it will shut off legacy Amazon DSP Pixel APIs by August 1, 2024, citing Chrome's planned third-party cookie deprecation, and points advertisers to the Amazon Ad Tag
  • July 11, 2024 - Amazon reports modeled conversions for Sponsored Display, citing the phasing out of third-party cookies
  • October 18, 2024 - Amazon Ads introduces the Amazon Consent Signal and the setAmazonConsent command for AAT, with country codes and consent strings accepted from November 1, 2024
  • November 6, 2024 - Amazon Marketing Cloud starts accepting TCF, GPP and ACS consent signals
  • April 22, 2025 - Google says it will keep third-party cookies in Chrome with no standalone prompt
  • September 26, 2025 - Amazon opens the Events API in beta as a complement to the Amazon Ad Tag
  • October 17, 2025 - Google retires most Privacy Sandbox technologies
  • December 1, 2025 - Amazon requires a country code on all personal data and a valid consent signal for UK and EEA data, accepting TCF, GPP or ACS
  • January 1, 2026 - Amazon moves view-based attribution to a shopping-signal model across 28 markets
  • April 2026 - One advertiser's Google Ads conversions drop 90% overnight after tighter Consent Mode V2 enforcement
  • May 14, 2026 - PPC Land reports Amazon's authenticated graph pitch and the June 30 consent deadline
  • June 30, 2026 - Enforcement deadline for consent signals across AAT, the Conversions API and the Events API for UK and EEA data
  • September 28, 2026 - The Events API adds AREF_TOKEN, plain-text IP address and user-agent support
  • October 15, 2026 - The Events API reaches general availability
  • October 16, 2026 - PPC Land details Safari's seven-day cookie caps
  • October 27, 2026 - Meta's on-device conversion measurement setting is on by default from November 12
  • October 29, 2026 - Amazon reports third-quarter advertising revenue of $19.64 billion
  • November 2, 2026 - Amazon Marketing Cloud's new-to-brand metric columns start including modeled conversions
  • November 16, 2026 - Date on Amazon's release note announcing the aatSession first-party cookie in North America

Summary

Who: Amazon Ads, and advertisers in North America that run the Amazon Ad Tag on their websites, along with the agencies and measurement teams that manage those tags.

What: The Amazon Ad Tag sets a first-party cookie, aatSession, that holds a session identifier linking a visitor's events on the advertiser's website. It expires 30 days after the visitor's last page view, is sent with each event, and is set only when TCF, GPP or Amazon Consent Signal permissions allow it. No setup is required, and turning it off takes amzn("disableAATSessionCookie", true); on every page before the first event.

When: The release note is dated November 16, 2026. It follows Amazon's consent signal requirements of December 1, 2025, the June 30, 2026 consent enforcement deadline for UK and EEA data, and the Events API's general availability on October 15, 2026.

Where: North America only, according to Amazon's guide, which does not list the countries covered. The cookie lives on advertisers' own domains, not on Amazon's.

Why: Amazon says the identifier lets it measure and attribute website events more reliably as third-party cookies are phased out. Chrome has kept those cookies, but Safari's blocking, ad blockers and consent rules still limit what third-party tracking can see, and Amazon's off-Amazon conversion reporting depends on tags and server feeds that survive those limits.