If you allow cookies so set cookieless="false" the sessionID will be stored in the cookie and it'll be accessible throughout the length of the session (which by default is 20 minutes.)
If you allow cookies and the user will have cookies disabled in the browser, sessionID will not be stored anywhere, and every times user creates a new request (by going to another page) he will get new sessionID, thus no data can be kept.
You can use cookieless="true" which will encrypt and append sessionID to the url, so that the user will be able to keep the session even though his cookies are enabled.
There is also a cookieless="AutoDetect" which will determine if the user has cookies disabled or enabled and based on that will either create a cookie with sessionID or throw it to the URL. The downside of this, is that each request to your page is resulting in 3 requests, one request determines if the user has cookies enabled, appends a query string with the result from first request, and third takes the user to appropriate URL.
There is also a setting that will turn cookieless off and on based on data about the browser. So if someone is browsing your page with 10 years old mobile phone it'll probably append cookies to URL as there is no option to allow cookies on that device.
I hope this helps. I personally would message the user to enable cookies and don't even worry about other cases but some people (like my boss, for example) doesn't like the idea and wants everyone supported.