What Are Flash Cookies? Understanding Local Shared Objects and Website Tracking

Flash cookies, also known as Local Shared Objects (LSOs), were a type of storage technology used by websites through Adobe Flash Player. They allowed Flash-based content to save data on a visitor’s device, often for things like preferences, video playback settings, or saved progress.

Unlike traditional browser cookies, Flash cookies were stored outside the browser’s normal cookie system. That meant they could sometimes remain on a device even after a user deleted standard browser cookies, which led to significant privacy concerns.

Although Flash cookies are now largely obsolete because Adobe Flash was discontinued in 2020, they remain an important part of the history of online tracking. Understanding how they worked helps explain why modern privacy testing and website auditing need to look beyond standard cookies alone.

What Is a Flash Cookie?

A Flash cookie is a small data file created by Adobe Flash Player when Flash content runs inside a browser or application. These files were used to store information on a user’s device so that Flash-based websites and media players could remember settings or maintain state between visits.

The technical name for Flash cookies is Local Shared Objects (LSOs).

They were commonly used for:

• storing video player preferences
• remembering game progress
• saving website settings
• supporting persistent identifiers across sessions in some implementations

Flash cookies could usually store more data than normal browser cookies, and they were managed by Flash Player rather than the web browser itself.

Flash Cookies vs Regular Browser Cookies

Although both technologies store data on a user’s device, Flash cookies worked differently from standard browser cookies.

Because Flash cookies were stored separately from browser cookie storage, many users were unaware they existed at all.

Why Flash Cookies Raised Privacy Concerns

Flash cookies became controversial because, in some cases, they could be used to help restore deleted browser identifiers.

This practice became known as cookie respawning.

A typical pattern looked like this:

1. A website or embedded service stored an identifier in a Flash cookie.
2. The user deleted their regular browser cookies.
3. The site or service read the Flash-stored identifier and recreated the deleted browser cookie.

This allowed certain tracking systems to persist even after users tried to remove them, which triggered privacy concerns and regulatory scrutiny.

It is important to note that not every Flash cookie was used for tracking. Many were used for legitimate functions such as saved preferences or media settings. The privacy problem came from the way the technology could be used outside normal browser controls.

Are Flash Cookies Still Used Today?

In most cases, no.

Adobe officially ended Flash Player support in 2020, and modern browsers disabled or removed practical support for Flash content. Because of this:

• Flash cookies are now rarely encountered
• websites no longer rely on Flash for mainstream storage
• most tracking technologies have moved to newer browser-based systems

Modern tracking methods are more likely to involve:

• HTTP cookies
• localStorage and other Web Storage APIs
• IndexedDB
• fingerprinting techniques
• analytics and advertising scripts

For privacy and compliance audits, it is still useful to understand Flash cookies because they helped shape the broader conversation around persistent tracking and user consent.

Where Flash Cookies Were Stored

Flash cookies were typically stored as .sol files on a user’s device.

Common locations included:

Windows

AppData\Roaming\Macromedia\Flash Player\#SharedObjects

macOS

~/Library/Preferences/Macromedia/Flash Player/#SharedObjects

These files were usually placed inside additional randomly named subfolders created by Flash Player, and the exact path could vary depending on the operating system and Flash version.

How to Detect Tracking Technologies on a Website

While Flash cookies are now mostly obsolete, websites still use many other forms of storage and tracking.

A website privacy scan can help identify:

• HTTP cookies
• analytics cookies
• advertising and marketing trackers
• session cookies
• consent systems
• local storage usage
• third-party scripts and services

Tools such as Privacy Probe allow you to scan a website and see what tracking technologies are present, including cookies, scripts, consent layers, and third-party services.

This kind of testing is useful for:

• privacy audits
• GDPR compliance checks
• security reviews
• understanding third-party tracking behaviour

Flash Cookies and Modern Privacy Testing

Even though Flash cookies are no longer widely used, they represent an important stage in the evolution of online tracking.

They showed that data storage and tracking could happen outside the controls users normally expected, which pushed browsers, developers, and regulators toward better transparency and stronger privacy protections.

Modern privacy testing tools now focus on technologies that replaced Flash-based storage, including:

• JavaScript tracking scripts
• analytics platforms
• advertising networks
• browser storage systems
• consent and tagging frameworks

By scanning websites regularly, organisations can better understand what data is being stored, which third parties are involved, and whether those practices align with privacy requirements.

Summary

Flash cookies were a storage technology used by Adobe Flash Player to save data on a user’s device. Unlike traditional browser cookies, they existed outside normal browser cookie management and could sometimes survive standard cookie deletion.

In some cases, this made them useful for persistent tracking techniques such as cookie respawning, which led to major privacy concerns.

Although Flash cookies are now largely obsolete, they remain important in the history of website tracking. Today, privacy testing tools such as Privacy Probe help identify the modern technologies that replaced them, giving website owners and privacy professionals better visibility into how data is stored and used across the web.

FAQ

What is a Flash cookie?

A Flash cookie is a data file created by Adobe Flash Player to store information such as preferences, saved settings, or other application data. They are also known as Local Shared Objects (LSOs).

Are Flash cookies still used?

Flash cookies are rarely used today because Adobe Flash Player was discontinued in 2020 and modern browsers no longer support Flash in normal use.

Are Flash cookies the same as browser cookies?

No. Flash cookies were managed by Flash Player rather than the browser, which meant they could be stored separately from standard browser cookies.

Were Flash cookies always used for tracking?

No. Many Flash cookies supported legitimate features such as media settings or saved progress. Privacy concerns came from the fact that they could also be used for persistent identifiers and tracking-related behaviour.

How can you detect cookies and tracking on a website?

You can inspect storage and cookies through browser developer tools, or use privacy scanning tools such as Privacy Probe to identify cookies, scripts, consent systems, and other tracking technologies.