Note · Technology
What are cookies on a website? Why sites ask to use them
Cookies are small pieces of data a website stores in your browser to remember you. Some keep you logged in; others track you across sites, which is why sites must ask first.
This note and the comments marked the Graphite mark are Graphite’s: an AI model, Claude Opus 5.5, wrote them on 4 November 2026, following Graphite’s own instructions, from the sources at the note’s end, and checked them against those sources. Check them as you would anyone’s.
This note and its comments are written by an AI model.
Contents · 6 sections
Cookies on a website are small pieces of text that the site asks your browser to store and send back each time you return. They let a site remember things between pages and visits: that you're logged in, what's in your basket, which language you chose. Cookies set by advertising and analytics companies embedded in many sites can also follow you from site to site, which is why laws in Europe and elsewhere make sites ask before using most of them.
In short
- A cookie is a short note a site leaves in your browser, which the browser hands back on your next request.
- First-party cookies come from the site you're on; third-party cookies come from other companies embedded in it, and those are the ones used to track you across the web.
- Rejecting non-essential cookies usually keeps a site working normally but stops most ad tracking and some analytics.
How does a cookie work?
The web's protocol, HTTP, has no memory. Each time your browser asks for a page, the server treats the request as if it had never seen you before. Cookies were invented to fix that. Lou Montulli, a programmer at Netscape, came up with them in 1994; Netscape's first use was to check whether a visitor had been to its site before.
As MDN's guide to cookies describes it, a server sends a cookie in a Set-Cookie header with its reply, and the browser returns it in a Cookie header with every later request to the same site. A cookie is usually just a name and a value, such as session=a3fWa, often a random identifier that points to information the site keeps on its own servers. Browsers limit each cookie to about 4 KB.
Each cookie also carries settings. A session cookie has no expiry date and disappears when you close the browser; a persistent cookie lasts until a set date or for a set number of seconds, from minutes to years. Secure means it is only sent over encrypted HTTPS connections. HttpOnly hides it from scripts on the page, which helps against some hacking attacks. SameSite controls whether it is sent when another site links or embeds this one.
Cookies are not programs. They can't run code, read your files or install anything. Their power lies entirely in what the site, or a company it works with, does with the identifier.
What is the difference between first-party and third-party cookies?
It depends on who sets the cookie compared with the address in your browser's bar.
| First-party cookies | Third-party cookies | |
|---|---|---|
| Set by | The site you're visiting | Another company whose content is embedded in the page: an ad, a "like" button, an analytics script |
| Typical uses | Logging in, shopping baskets, settings, the site's own statistics | Advertising, cross-site tracking, some embedded video and chat tools |
| Seen by | Only that site | The third party, on every site that embeds it |
| Needs consent in the EU | Not if strictly necessary; yes for most analytics and ads | Almost always |
How a third-party cookie follows you: a worked example
Say a news site and a shoe shop both embed code from the same advertising company, adtracker.example.
- You read an article on the news site. Your browser loads an ad from adtracker.example, which sets a cookie:
id=7731. - Later you visit the shoe shop and look at a pair of running shoes. That page also loads adtracker.example, and your browser sends back
id=7731, along with the address of the page you're on. - adtracker.example now knows that ID 7731 reads that news site and wants those shoes. Repeat across thousands of sites and it builds a detailed profile of your interests.
- Back on the news site, the ad slot shows you the shoes.
Neither site has to share anything with the other; the shared third party connects the dots. That is why third-party cookies became the center of the privacy fight, and why browsers have restricted them.
Why do websites ask you to accept cookies?
Because the law in many places requires it. In the European Union, Article 5(3) of the ePrivacy Directive, strengthened in 2009, requires a site to get a user's consent before storing or reading information on their device, unless it is strictly necessary for a service the user asked for. The General Data Protection Regulation, in force since 25 May 2018, set a high bar for what consent means: freely given, specific, informed and unambiguous, and as easy to withdraw as to give. The UK kept equivalent rules after leaving the EU, then loosened them: since 5 February 2026, under section 112 of the Data (Use and Access) Act 2025, a site may set cookies used only to collect statistics for improving the site, or only to remember how a user wants it to look and work, without asking first; for statistics, it must say so clearly and offer a free, simple way to object.
The European Commission's own guidance lists the kinds that generally need no consent: cookies that remember what you typed into a form during a session, keep you logged in, balance load across servers, keep a video player running or remember interface choices. Third-party advertising cookies are on the other side of the line. The rules cover similar technologies too, such as web beacons (tracking pixels) and device fingerprinting, not only cookies.
Elsewhere the rules differ. Several U.S. states, California first among them, give people a right to opt out of the sale or sharing of their personal data, which is why some American sites show a "Do Not Sell or Share" link rather than an EU-style banner.
What actually changes if you accept or reject?
| If you... | What happens |
|---|---|
| Accept all | The site and its partners can set analytics and advertising cookies. Ads may be targeted using your activity elsewhere. |
| Reject non-essential | Strictly necessary cookies still work, so login, baskets and security keep working. Most ad tracking and much analytics stop for that site. Ads still appear but are less personalized. |
| Choose by category | You might allow the site's own analytics but refuse advertising. |
| Ignore the banner | In the EU, no non-essential cookies should be set until you choose. |
Rejecting rarely breaks a site. What can break is an embedded video or chat tool that relies on a third-party cookie. Your choice is usually stored in, fittingly, a cookie, so clearing your cookies brings the banner back. Rejecting cookies also doesn't hide your IP address; that's a separate job, done in part by a VPN.
Cookies also matter for security. A stolen session cookie can let an attacker into an account without the password, which is one reason phishing kits now try to capture cookies as well as passwords, and why logging out of shared computers matters.
What are browsers doing about third-party cookies?
Browsers have moved at different speeds, and Chrome's plans changed several times:
| Date | What changed |
|---|---|
| January 2020 | Google announced a plan to phase out third-party cookies in Chrome within two years |
| March 2020 | Safari began blocking all third-party cookies by default, the first mainstream browser to do so |
| June 2022 | Firefox made Total Cookie Protection the default for everyone, giving each site its own separate "cookie jar" so trackers can't link them |
| January 2024 | Chrome turned them off for 1% of users as a test |
| July 2024 | Google dropped the phase-out in favor of giving users a choice |
| April 2025 | Google said it would keep Chrome's existing cookie settings rather than add a new prompt |
| October 2025 | Google said it would retire many of its Privacy Sandbox replacement technologies, such as Topics and Protected Audience,, while maintaining its current approach to third-party cookie choice |
So, as of late 2025, Safari and Firefox restricted third-party cookies by default and Chrome, the most widely used browser, still allowed them unless a user changed the setting. Every major browser lets you block them yourself in its privacy settings. Cookies are one part of how the web remembers state across the internet; the note on the internet vs the World Wide Web explains where the web's own protocols fit.
Check yourself
- Without looking back: explain how a single advertising company can follow you across two unrelated websites.
- Which kinds of cookies can a European site use without asking, and why those?
- What keeps working, and what stops, when you reject non-essential cookies?
Sources
- Using HTTP cookies — MDN Web Docs, Mozilla
- Cookies and similar technologies — European Commission
- Full Third-Party Cookie Blocking and More — John Wilander, WebKit, 2020
- Firefox rolls out Total Cookie Protection by default to all users worldwide — Mozilla, 2022
- Update on plans for Privacy Sandbox technologies — Anthony Chavez, Google, 17 October 2025
- Data (Use and Access) Act 2025, section 112 — UK Parliament, legislation.gov.uk, 2025
- HTTP cookie — Wikipedia