The problem cookies solve
The web was designed so that each request for a page is independent. A server receives a request, sends a response and, by default, keeps no memory of who asked. That is awkward for a shopping site that needs to remember what is in your cart or a webmail service that needs to know you are already signed in. Cookies were created to fill the gap.
What a cookie is
A cookie is a small piece of text that a website asks your browser to store. The next time your browser contacts that site, it sends the text back automatically. A typical cookie holds a name, a value and some settings, including an expiry time and the sites it may be sent to.
Most cookies store an identifier, not your personal details. For example, when you sign in, the site might give your browser a random session identifier and remember on its own servers that this identifier belongs to your account. Each later request carries the identifier, so the site recognizes you. Session cookies usually disappear when you close the browser, while persistent cookies stay until they expire or you delete them.
Cookies are not programs and cannot run code on their own. Their privacy impact comes from what the identifiers allow websites and other companies to link together.
First-party and third-party cookies
A first-party cookie is set by the site you are visiting. These usually support things like logins, language preferences and shopping carts.
A third-party cookie is set by a different domain whose content is embedded in the page, such as an advertising network, an analytics provider, a video player or a social media button. Because the same third party can be embedded on thousands of unrelated sites, its cookie can recognize your browser on each of them. That lets the company build a record of pages you visited across the web, usually tied to a random identifier rather than your name, although it can sometimes be connected to a real identity if you sign in somewhere.
This is the mechanism behind the familiar experience of looking at a product and then seeing ads for it elsewhere. It is a central part of how digital marketing and advertising are measured and targeted.
Other tracking methods
Cookies are only one tool.
Tracking scripts and pixels. Sites often include small pieces of code or one-pixel images loaded from another company. When your browser loads them, it sends details such as the page address, the time and your IP address, and may send or set cookies.
Local storage and similar browser features. Browsers offer other places to store data, which some trackers have used as an alternative to cookies.
Browser fingerprinting. A site can collect many small details about your browser and device, such as screen size, fonts, language, time zone and graphics settings. Combined, these can be distinctive enough to recognize a browser without storing anything on it. Fingerprinting is harder to see and to block than cookies.
Link and email tracking. Some links carry identifiers in their addresses, and some emails include images that signal when the message was opened.
Logged-in tracking. When you are signed in to a large service, activity on that service can be linked directly to your account.
What the data is used for
Trackers support a mix of purposes. Some are everyday and low-risk, such as counting visitors, finding broken pages or keeping you signed in. Others involve building interest profiles, measuring whether an ad led to a purchase or deciding which ads to show. Not all tracking is malicious, but the combined effect can be a detailed profile that you never explicitly created and that is hard to inspect.
Cookie banners and consent
In the European Union and some other places, rules require sites to obtain consent before setting non-essential cookies and to explain what they do. That is why many sites show banners. The choices in a banner typically cover categories such as strictly necessary, preferences, analytics and advertising. Strictly necessary cookies, like those keeping a cart working, generally do not need consent.
Banners vary in quality. Some make declining as easy as accepting, while others bury the option. If you see a “manage preferences” or “reject all” button, it normally gives you more control than a simple accept button.
Controls you have
- Browser settings. Most web browsers let you block third-party cookies, delete cookies on exit or clear them manually. Several browsers now block some trackers by default, though behavior differs and changes over time.
- Private browsing. This usually prevents the browser from keeping history and cookies after the window closes. It does not hide your activity from the sites you visit, your employer, or your internet provider.
- Extensions and built-in tracking protection. Content blockers can stop requests to known tracking domains. They may occasionally break a site’s features.
- Account and ad settings. Large services often provide pages to limit ad personalization or delete activity history.
- Opt-out signals. Some browsers can send a signal requesting that sites not sell or share data. Whether it is honored depends on the site and local law.
Blocking everything can make some sites unusable, so many people choose a middle path: block third-party tracking, clear cookies occasionally and leave first-party cookies for sites they use regularly.
A note on limits
Even without cookies, your IP address and basic request details reach every site you visit. Cookies are therefore one piece of a larger picture, and the choices you make about accounts, devices and the phone apps you use matter as well.