A Practical Guide to Understanding Browser Cookies

Login sessions, carts, language preferences, analytics and ad tracking all rest on one small piece of text, which is where any browser cookies beginners guide has to start.

A browser cookie is a small piece of text that a website asks your browser to store, capped at 4096 bytes of name and value. On later requests, the browser can send that cookie back to the relevant domain. That simple mechanism makes login sessions, shopping carts, language preferences, analytics, and advertising tracking possible.

Cookies are not automatically bad. A secure session cookie can keep you signed in. A preference cookie can remember dark mode. The privacy problem begins when cookies become persistent identifiers used to observe people across time, pages, devices, or websites.

First-Party vs Third-Party Cookies

A first-party cookie is set by the site you are visiting. If you visit example.com and example.com sets a cookie, that is first-party. First-party cookies are commonly used for sessions, preferences, fraud prevention, and analytics.

A third-party cookie is set by a different domain embedded on the page, such as an advertising network, social widget, or third-party analytics provider. Third-party cookies historically enabled cross-site tracking because the same external domain could recognize the browser across many websites.

Browser behavior has changed. Safari's WebKit tracking prevention explains that third-party cookie access is heavily restricted and that some script-writable storage can be capped, including a 7-day cap in certain ITP contexts. Firefox's Total Cookie Protection isolates cookies by site and is enabled in standard Enhanced Tracking Protection for many users, according to Mozilla's Firefox documentation. Chrome changed course in 2025 and said it would maintain its current third-party cookie choice approach rather than roll out a new standalone prompt, according to Google's Privacy Sandbox update.

The practical point: third-party cookies are no longer a stable foundation for measurement, and first-party cookies are under more scrutiny when used for tracking.

How Browsers Handle Third-Party Cookies

Safari (WebKit)Tracking prevention restricts third-party cookie access, with a 7-day cap in certain ITP contexts

FirefoxTotal Cookie Protection isolates cookies by site, enabled by default in standard Enhanced Tracking Protection

ChromeIn 2025, kept its current third-party cookie choice approach instead of rolling out a new standalone prompt

Session, Persistent, and Secure Cookies

Session cookies expire when the browser session ends. They are used for login state or temporary workflow state.

Persistent cookies remain until their expiration date or until the user deletes them. They can last minutes, days, months, or years. Long-lived persistent cookies are more privacy-sensitive because they make returning browsers easier to recognize.

Secure cookies are only sent over HTTPS. HttpOnly cookies cannot be read by JavaScript, which helps protect session cookies from certain attacks. SameSite controls whether cookies are sent in cross-site contexts. These attributes are security controls, not a privacy permission slip.

Essential vs Non-Essential Cookies

The legal question is usually purpose. In Europe, Article 5(3) of the ePrivacy Directive requires consent before storing or accessing information on a user's device unless the storage is strictly necessary for a service requested by the user. Regulators such as the UK's ICO summarize this as: non-strictly necessary cookies need an appropriate means of consent, while strictly necessary cookies do not. See the ICO's public guidance on cookies.

Typical strictly necessary cookies:

• Login session cookies.
• Shopping cart cookies.
• Security cookies for fraud prevention.
• Load balancing cookies.
• User preference cookies that support a requested setting.

Typical non-essential cookies:

• Analytics cookies.
• Advertising cookies.
• A/B testing cookies for business optimization.
• Social media tracking cookies.
• Cross-site personalization cookies.

Some countries allow narrow consent exemptions for audience measurement when strict conditions are met. CNIL, for example, describes consent-exempt audience measurement as limited to statistics for the publisher, without cross-site tracking or reuse for other purposes, in its guidance on audience measurement solutions. That is not the same as saying all analytics cookies are essential.

Cookies and Personal Data

A cookie value can be random and still personal data if it singles out a browser or can be linked to other information. Under GDPR, online identifiers can be personal data when they relate to an identified or identifiable person. That is why unique analytics IDs, advertising IDs, and pseudonymous user IDs deserve careful treatment.

Do not put names, emails, phone numbers, account IDs, health details, or form answers into cookies unless you have a very specific reason and security design. Even then, avoid it whenever possible.

Cookies in Web Analytics

Traditional web analytics uses cookies to distinguish users and sessions. Google says GA4 JavaScript tags use first-party cookies such as _ga to distinguish users and sessions in its GA4 cookie documentation. That design can support familiar reports, but it also brings consent, retention, vendor, and cross-product questions.

Cookieless analytics takes a different path: count page views, referrers, campaigns, countries, devices, and events without storing a browser identifier. The tradeoff is less user-level journey detail, but the benefit is simpler compliance, fewer consent-banner gaps, and less risk of turning basic measurement into surveillance.

Cookie-Based Analytics vs Cookieless Analytics

Cookie-based (e.g. GA4)

• Uses first-party cookies such as _ga to distinguish users and sessions
• Supports familiar user-level journey reports
• Raises consent, retention, and vendor questions

Cookieless

• Counts page views, referrers, campaigns, countries, devices, and events
• Stores no browser identifier
• Means simpler compliance and fewer consent-banner gaps

A Simple Cookie Audit

For each cookie, record:

Field	What to capture
Name	The cookie name as shown in browser dev tools
Domain	First-party or third-party domain
Purpose	Session, preference, analytics, ads, security
Duration	Session-only or exact expiry
Data type	Random ID, preference value, token, campaign data
Vendor	Internal system or third-party provider
Consent category	Strictly necessary, preferences, analytics, marketing

Then remove what you do not need. Shorten retention where possible. Block non-essential cookies until consent where required. If the only reason for your banner is analytics, consider replacing cookie-based analytics with a privacy-first setup.

Beginner Questions Teams Often Miss

A cookie banner is not the same as a privacy policy. The banner collects a choice before optional storage happens; the policy explains the broader processing. You may need both.

A cookie-free script is not automatically consent-free. If it reads browser storage, creates a fingerprint, or sends a unique identifier from the device, it can still fall under ePrivacy rules.

Deleting cookies does not delete server-side records already created. If an analytics tool received events before deletion, those events may remain in the vendor system until retention or deletion rules apply.

Cookie Audit Checklist

Audit each page before any consent choice and again after rejection. Inspect network calls, cookies, local and session storage, pixels, tag-manager triggers, and server-side events. If optional analytics or advertising still fires before a valid choice, the banner is cosmetic. If a tool claims an analytics exemption, document the exact configuration and make sure the setup is limited, publisher-focused, and free from advertising reuse.

Frequently Asked Questions

What is the difference between a first-party and a third-party cookie?

A first-party cookie is set by the site you're currently on, the kind used for sessions, preferences, fraud prevention, and analytics. A third-party cookie comes from a different domain embedded in the page, such as an ad network or social widget, and historically let that outside domain recognize your browser across many sites.

Why are third-party cookies less useful for tracking now?

Safari's WebKit tracking prevention restricts third-party cookie access and caps some script-writable storage at 7 days in certain ITP contexts. Firefox's Total Cookie Protection isolates cookies by site and runs by default in standard Enhanced Tracking Protection. Chrome said in 2025 it would keep its current third-party cookie choice approach rather than add a new standalone prompt, so third-party cookies no longer offer a stable base for measurement.

What is the difference between a session cookie and a persistent cookie?

A session cookie expires when the browser session ends and is typically used for login state or temporary workflow data. A persistent cookie stays until its expiration date or until deleted, lasting anywhere from minutes to years, and long-lived ones make returning browsers easier to recognize.

Do secure and HttpOnly cookie attributes count as consent?

Secure limits a cookie to HTTPS, HttpOnly blocks JavaScript from reading it, and SameSite controls cross-site sending, but these are security controls, not a privacy permission slip. A cookie can meet every one of these settings and still need consent under ePrivacy rules.

Which cookies count as strictly necessary under the ePrivacy Directive?

Article 5(3) of the ePrivacy Directive allows storage without consent when it's strictly necessary for a service the user requested. The post lists login session cookies, shopping cart cookies, security cookies for fraud prevention, load balancing cookies, and preference cookies that support a requested setting as typical examples.

Are analytics cookies always exempt from consent?

Analytics cookies sit on the non-essential list in most cases and need consent under Article 5(3) and ICO guidance. CNIL describes a narrow exemption for audience measurement, limited to publisher-only statistics with no cross-site tracking or reuse, but only when strict conditions are met. That exemption applies to a specific configuration, not to analytics cookies as a category.

Can a random cookie value count as personal data under GDPR?

Yes, if it singles out a browser or can be linked to other information, a random cookie value can qualify as personal data under GDPR. That's why unique analytics IDs, advertising IDs, and pseudonymous user IDs need careful treatment even without a name attached.

What should never be stored inside a cookie?

The post advises against putting names, emails, phone numbers, account IDs, health details, or form answers into cookies. Store any of them only with a specific reason and a security design behind it, and avoid it even then whenever possible.

What is the tradeoff between cookie-based and cookieless analytics?

Cookie-based analytics, like GA4's use of first-party cookies such as _ga, distinguishes users and sessions and supports familiar reports, but it brings consent, retention, vendor, and cross-product questions. Cookieless analytics counts page views, referrers, campaigns, countries, devices, and events without a browser identifier, trading user-level journey detail for simpler compliance and fewer consent-banner gaps.

Does deleting a cookie remove data already sent to an analytics vendor?

No, deleting a cookie doesn't erase server-side records already created from it. If an analytics tool logged events before deletion, those events can stay in the vendor's system until retention or deletion rules apply.