A cookie, often called a browser cookie or HTTP cookie, is a small piece of text that a web server sends to your browser when you load a page. Your browser stores it and attaches it to later requests back to the same site. That exchange (the server sends a Set-Cookie header, the browser returns the cookie in a Cookie header) is the entire mechanism. No executable code, no hidden payload: a short string of data travelling back and forth over HTTP.
The concept dates back to 1994, when Netscape engineer Lou Montulli adapted an older computing idea called a "magic cookie" to solve a practical problem: HTTP is stateless. Without cookies, every page request looks identical to the server. It cannot tell whether you just signed in, which items sit in your cart, or whether you prefer English or German.
How cookies work under the hood
When you visit a website for the first time, the server's HTTP response can include one or more Set-Cookie headers. Each header contains a name-value pair and a set of attributes: Domain, Path, Expires or Max-Age, Secure, HttpOnly and SameSite. MDN's guide to HTTP cookies describes each one.
Your browser saves the cookie in its own cookie store. On every later request to the same domain, it checks which cookies match the domain, path and security flags, then sends the matching ones in the request header. The server reads them, recognises the visitor and responds accordingly.
The cookie round trip
A session cookie has no Expires or Max-Age attribute, so the browser deletes it when the session ends. A persistent cookie carries an explicit expiry and survives browser restarts until that date passes or you clear it.
Why websites rely on cookies
Cookies solve three broad problems that every website faces.
Authentication and sessions. When you sign in, the server creates a session and sends a session ID as a cookie (often called PHPSESSID or JSESSIONID). Without that cookie, you would need to enter your password again on every page.
Personalisation. Language selectors, dark-mode switches and currency preferences are all stored in functional cookies. They make the site feel like it remembers you.
Measurement and advertising. Analytics cookies such as _ga and _ga_[id] help measure page views, engagement and traffic sources. Marketing cookies like Meta's _fbp or Google's _gcl_au help ad platforms recognise you across sites and build an advertising profile. This is where most of the privacy debate centres.
The main types of cookies
Cookies can be classified by who sets them, how long they last and what they are for. The table below maps the most common types of internet cookies.
| Classification | Type | Example | Typical purpose |
|---|---|---|---|
| By origin | First-party | _ga set on your domain | Analytics, preferences, sessions |
| By origin | Third-party | fr set by facebook.com | Cross-site tracking, retargeting |
| By lifespan | Session | PHPSESSID | Login state during a single visit |
| By lifespan | Persistent | pll_language | Remembers language across visits |
| By purpose | Strictly necessary | csrftoken | Security, form protection |
| By purpose | Functional | wp-settings-1 | Interface preferences |
| By purpose | Analytics | _ga_[id] | Counts visitors, measures engagement |
| By purpose | Marketing | _gcl_au | Ad conversion tracking, retargeting |
To find out what a name like PHPSESSID or _gcl_au does, look it up in the cookie database. Each cookie category also has its own consent rules, covered below.
First-party and third-party cookies differ in reach
The distinction matters because it decides both the privacy impact and the legal treatment. A first-party cookie is set by the domain in your address bar and can only be read by that domain. A third-party cookie is set by a different domain (an ad server, a social plugin, an embedded video player) and can follow your activity across every site that loads resources from that domain.
Third-party cookies make it possible for an ad for running shoes to follow you from a sports blog to a news site to a recipe page. Meta's _fbp is a good example of the difference: the Meta Pixel writes it to each website's own domain, so it is first-party, while Meta's fr cookie on facebook.com is the third-party one. That cross-site reach is why browsers have been restricting third-party cookies.
How browsers handle cookies differently
Not all browsers treat cookies the same way, and the differences have real consequences for website owners running analytics or advertising.
Safari is the strictest. WebKit's tracking prevention blocks all third-party cookies and deletes cookies created in JavaScript, along with other script-writable storage, after seven days of Safari use without interaction on the site. Cookies created in JavaScript on a page reached through a link with a click ID are capped at 24 hours, and cookies set in an HTTP response from a server behind third-party IP address cloaking are capped at seven days.
Firefox's Enhanced Tracking Protection blocks social media trackers and cross-site tracking cookies from a list of known trackers in its default Standard mode. Its Total Cookie Protection, on by default, confines every cookie to the website where it was created, so it cannot follow you across sites.
Chrome still permits third-party cookies by default. Google announced in 2020 that it would phase them out, delayed the plan several times and dropped it in July 2024, and in April 2025 it said it would not introduce a separate user-choice prompt either. In October 2025 Google retired most of the Privacy Sandbox APIs it had built as replacements, including Topics, Protected Audience and Attribution Reporting, citing low adoption. CHIPS and FedCM stay.
What the law says about cookies
The legal framework for cookies in the EU rests on the ePrivacy Directive (2002/58/EC) and the GDPR. Article 5(3) of the ePrivacy Directive requires informed consent before any information is stored on or read from a user's device, unless it is strictly necessary for a service the user explicitly requested. The GDPR defines valid consent: freely given, specific, informed and unambiguous, through a clear affirmative action.
A cookie banner has to appear before non-essential cookies are set. It must explain what each category does and offer a genuine choice. Pre-ticked boxes do not count. In September 2025, the CNIL, France's data protection authority, fined Google 325 million euros, in part because consent to advertising cookies at Google account creation was not valid: refusing them was harder than accepting them. The same month, the CNIL fined SHEIN 150 million euros for placing cookies before visitors made any choice.
Outside Europe, rules differ. The CCPA in California, as amended by the CPRA, follows an opt-out model: businesses can set cookies by default but must honour "Do Not Sell or Share" requests. Brazil's LGPD requires a legal basis for processing personal data, with consent the usual one for non-essential cookies. Canada's PIPEDA requires meaningful consent for the collection of personal information, including data gathered through cookies.
Cookie attributes that affect security
Every cookie carries flags that control how browsers handle it. The Secure flag means the cookie is only sent over HTTPS. HttpOnly prevents JavaScript from reading the cookie, which protects session tokens from cross-site scripting attacks. The SameSite attribute controls cross-site behaviour: Strict withholds the cookie on all cross-site requests, Lax (the default when no value is set) sends it on top-level navigations, and None sends it in all contexts but requires the Secure flag.
A well-configured session cookie looks like this:
Set-Cookie: session_id=abc123; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=86400How to check which cookies a website sets
Open Chrome DevTools (F12), go to the Application tab and expand the Cookies section. You will see every cookie listed by domain with its name, value, expiry, size and flags. Firefox has an equivalent panel in its Storage Inspector.
For a broader check, a cookie scanner crawls your whole site and lists every cookie, including those set by embedded third-party scripts. It is a sensible starting point if you are writing a cookie policy or setting up a consent management platform.
Cookies: quick answers
Are cookies dangerous or harmful to my computer?
Cookies are plain text, not programs. They cannot install malware, access your hard drive or run code. The privacy risk comes from how third parties use cookie data to build profiles of your browsing, not from the cookies themselves.
What happens if I block all cookies in my browser?
Blocking every cookie will break most sign-in systems, empty your shopping cart on each page load and reset your language or theme preferences every visit. A more practical approach is to block third-party cookies while allowing first-party ones.
Do all cookies require consent under the GDPR?
No. Strictly necessary cookies, those required for a service the user explicitly requested such as a login session or a shopping cart, are exempt from the consent requirement under Article 5(3) of the ePrivacy Directive. Other cookies, including most analytics and all marketing cookies, need informed, prior consent.
How long do cookies stay on my device?
Session cookies are deleted when the browser session ends. Persistent cookies last until their expiry date, which can range from minutes to years. Safari deletes cookies set by JavaScript after seven days of Safari use without interaction on the site, whatever expiry the site intended.
What is the difference between first-party and third-party cookies?
A first-party cookie is set by the domain you are visiting. A third-party cookie is set by a different domain, typically an ad network or analytics provider embedded on the page. Safari blocks third-party cookies by default and Firefox confines each one to the site where it was set, while Chrome still allows them as of October 2026.
Can I see which cookies a website has set in my browser?
Yes. In Chrome, open DevTools (F12), go to the Application tab and select Cookies in the left panel. Firefox and Safari have similar panels. You will see each cookie's name, value, domain, expiry and flags such as Secure and HttpOnly.
See which cookies your own site sets
If you run a website and are not sure which cookies it sets, or whether they are set before consent, start with a scan. Kukie.io finds first-party and third-party cookies, sorts them into categories and blocks known trackers until visitors make a choice.
