A first-party cookie is set by the site in the address bar. A third-party cookie is set by another domain whose content loads on that page, such as an ad network or a social widget. Both are ordinary cookies. The difference is context, and it decides how browsers treat them: Safari and Firefox block third-party cookies by default, Chrome still allows them. The law treats them alike, so non-essential cookies of either kind need consent in the EU.
What makes a cookie first-party or third-party
The distinction is not about the cookie itself. A first-party cookie and a third-party cookie are technically identical: both are small pieces of data a browser stores, set through the Set-Cookie HTTP header or by a script. The difference lies entirely in which domain they belong to compared with the page the visitor is on.
A first-party cookie belongs to the domain the visitor is browsing. If someone visits example.com, any cookie stored under example.com is first-party, even when a third-party script wrote it. Common examples include session identifiers such as PHPSESSID, language preferences such as Polylang's pll_language on WordPress sites, sign-in tokens, and analytics cookies such as Google Analytics' _ga, which gtag.js stores under the site's own domain.
A third-party cookie belongs to a domain other than the one in the address bar. When example.com loads the Meta Pixel, the script stores _fbp on example.com, so _fbp is first-party, while the request to facebook.com can carry Meta's own fr cookie, which is third-party. Google's advertising cookie IDE on doubleclick.net is another third-party example.
This means the same company can set both kinds on one page, and a cookie that is first-party on its owner's site is third-party when that site's content is embedded elsewhere.
| Aspect | First-party cookie | Third-party cookie |
|---|---|---|
| Belongs to | The site in the address bar | Another domain loaded on the page |
| Typical examples | PHPSESSID, _ga, _fbp | fr (facebook.com), IDE (doubleclick.net) |
| Can track across sites | Not on its own | Yes, wherever the domain is embedded |
| Safari and Firefox | Allowed, with limits on script-set cookies in Safari | Blocked by default (Firefox: known trackers) |
| Chrome | Allowed | Allowed unless the user blocks them |
| Consent in the EU | Needed unless strictly necessary | Needed unless strictly necessary |
One page load, two kinds of cookie
Why third-party cookies exist
Third-party cookies were originally used for cross-site functions: embedded videos, federated sign-in and content served from other domains. Over time, advertising networks found they could use them to follow people across millions of websites, building browsing profiles without visitors realising it.
A single advertising cookie such as IDE from doubleclick.net can follow a visitor from a news site to a shopping site to a travel blog, stitching together a behavioural profile used for targeted advertising. That capability made third-party cookies the backbone of programmatic advertising for two decades.
That era is ending in Safari and Firefox, not in Chrome.
How browsers restrict third-party cookies
Safari moved first. Apple introduced Intelligent Tracking Prevention (ITP) in 2017, and since Safari 13.1 in March 2020 it has blocked third-party cookies by default. ITP also deletes cookies created by JavaScript, and the rest of a site's script-writable storage, after seven days of Safari use without interaction with that site. A separate 30-day rule removes the data of domains ITP classifies as trackers.
Firefox followed a similar path, turning on Enhanced Tracking Protection by default in 2019. It blocks known tracking cookies from third-party domains while allowing functional third-party cookies, such as those used by payment providers.
Chrome took a different route. After years of promising to phase out third-party cookies, Google said in April 2025 that it would not add a separate prompt and would leave the choice in Chrome's existing settings. On 17 October 2025 it announced that it is retiring most of its Privacy Sandbox technologies, such as Topics and Protected Audience, while keeping a small set that includes CHIPS (Cookies Having Independent Partitioned State) and Federated Credential Management. As of October 2026, Chrome allows third-party cookies by default. The Privacy Sandbox article covers what was retired.
| Browser | Third-party cookies | First-party limits |
|---|---|---|
| Safari (ITP) | Blocked by default since 2020 | Script-set cookies deleted after 7 days without interaction |
| Firefox (ETP) | Known trackers blocked by default | No blanket cap |
| Chrome | Allowed, the user can block them in settings | No cap |
| Brave | Blocked by default | No blanket cap |
| Edge | Balanced mode blocks known trackers | No blanket cap |
How much of your traffic runs without third-party cookies depends on your visitors' browser mix. Check your own analytics before relying on any industry average.
The SameSite attribute and partitioned cookies
The SameSite cookie attribute lets developers control cross-site cookie behaviour. Since 2020, Chrome treats cookies without the attribute as SameSite=Lax, so they are not sent in most cross-site requests unless the developer sets SameSite=None; Secure.
CHIPS goes further. It lets a third-party cookie exist but partitions it by top-level site: a payment provider's cookie set on shop-a.com is invisible when the same provider runs on shop-b.com. That keeps embedded functions working while blocking cross-site tracking.
For developers, this means reviewing every cookie your site relies on and deciding whether it needs cross-site access or can work in a partitioned context.
The law treats both kinds the same
Article 5(3) of the ePrivacy Directive does not distinguish between first-party and third-party cookies. Any storage of information on a visitor's device requires consent unless it is strictly necessary for the service the visitor asked for. A first-party analytics cookie such as _ga needs valid consent under EU law, just as a third-party advertising cookie does.
The GDPR adds a second layer. If a cookie processes personal data, you need a lawful basis under Article 6, and for marketing cookies regulators expect opt-in consent everywhere in the EU and the UK. Analytics usually needs consent too, with narrow exemptions. The CNIL exempts strictly limited audience measurement, and since 5 February 2026 UK PECR Schedule A1 lets analytics used only to improve a site run without consent if visitors get clear information and a free way to object.
Under the CCPA, third-party cookies used for cross-context behavioural advertising can count as a "sale" or "sharing" of personal information, which triggers opt-out requirements, including honouring Global Privacy Control. First-party cookies used only for your own analytics generally fall outside that definition.
Practical impact on your website
Tools that rely on third-party cookies for attribution, remarketing and audience building are already losing signal on Safari and Firefox visitors. That pushes measurement towards first-party setups.
Server-side tagging routes tracking requests through your own domain, so cookies are set as first-party by your server. Google Tag Manager's server-side container, for example, can set _ga from your server rather than through JavaScript, which avoids ITP's seven-day limit on script-set cookies. Since Safari 16.4, though, cookies set by a server whose IP address differs from the site's are also capped at seven days, so a tagging server on another network gains little in Safari.
Google Consent Mode v2 uses modelling to estimate conversions when visitors decline cookies. It fills some gaps but needs enough consented data to build its models.
First-party data, such as email lists, signed-in behaviour and CRM records, becomes more valuable as third-party signals fade. Websites with direct relationships with their visitors keep the most reliable data.
What this means for cookie consent
Your cookie banner has to cover both kinds. Visitors need clear information about each category of cookie, what it does and who receives the data, including the third parties behind first-party cookies like _fbp.
Proper categorisation is the foundation. Group cookies by purpose (strictly necessary, functional, analytics, marketing) and identify which involve sharing data with third parties. A cookie audit with an automated scanner can reveal cookies you did not know your site sets, particularly from embedded widgets, fonts and social media buttons.
The European Commission's Digital Omnibus proposal of November 2025 acknowledges consent fatigue and would move the cookie rules into the GDPR, with a role for browser signals. As of October 2026 it is still a proposal before the European Parliament's committees, so per-site consent remains the requirement across the EU.
Short answers on first-party and third-party cookies
Do first-party cookies need consent under the GDPR?
Yes, if they are not strictly necessary. Article 5(3) of the ePrivacy Directive requires consent for non-essential cookies whether they are first-party or third-party. A first-party analytics cookie needs the same consent as a third-party advertising cookie in most of the EU.
Does Safari block all third-party cookies?
Yes, by default since Safari 13.1 in 2020. Safari also deletes cookies created by JavaScript and other script-writable storage after seven days of use without interaction with the site.
Will Chrome ever remove third-party cookies?
Not on current plans. Google dropped its phase-out, said in April 2025 that it would not add a separate prompt, and in October 2025 retired most Privacy Sandbox technologies, keeping CHIPS and Federated Credential Management. Users can still block third-party cookies in Chrome's settings.
Is _ga a first-party or third-party cookie?
First-party. Google Analytics' gtag.js stores _ga under your own domain, so it appears in developer tools as your site's cookie, even though Google's script sets it and the data goes to Google.
Can server-side tagging turn third-party cookies into first-party ones?
Yes. Server-side tagging routes tracking requests through your own domain, so cookies are set as first-party. That avoids many browser restrictions, but consent is still required for non-essential tracking.
Are third-party cookies a sale of data under the CCPA?
They can be. Third-party cookies used for cross-context behavioural advertising can count as a "sale" or "sharing" of personal information under the CCPA, which triggers opt-out requirements, including support for Global Privacy Control signals.
See which of your cookies are first-party and which are not
Kukie.io's cookie scanner loads your pages like a visitor, lists every cookie it finds with its domain and category, so you can see which come from third parties and your banner can name the companies that receive the data.
