Understanding cookies and web tracking
Cookies are a small piece of technology with an outsized role in how the web is funded and used.
Few pieces of web technology are as widely discussed and as commonly misunderstood as the cookie. It sounds almost trivial, a small text file, yet cookies underpin how you stay logged in to websites, how your shopping cart remembers its contents, and how much of the online advertising industry tracks behaviour across the web. Understanding the basics clears up a surprising amount of confusion about online privacy.
What a cookie actually is
A cookie is a small piece of data that a website asks your browser to store, then sends back to that same website on future visits. It typically contains an identifier rather than personal information directly, which the website uses to recognise your browser as one it has seen before. This mechanism exists because the underlying protocol the web runs on does not, by itself, remember anything between page loads. Cookies were invented to solve that basic problem.
First-party cookies: the useful kind
A first-party cookie is set by the website you are actually visiting, and used only by that website. These are generally uncontroversial and genuinely useful: they keep you logged in, remember your language preference, and hold the contents of a shopping cart between pages. Without them, most modern websites would be considerably less convenient to use.
Third-party cookies: where tracking comes in
A third-party cookie is set not by the site you are visiting, but by a different domain whose code is embedded in that page, commonly an advertising or analytics script. Because the same third-party script often appears on many unrelated websites, it can recognise the same cookie across all of them, building a picture of your browsing activity across sites that have no direct relationship with each other. This is the mechanism behind much of the targeted advertising you encounter online.
Other tracking methods beyond cookies
As browsers have restricted third-party cookies, other tracking techniques have grown more common. These include:
- Fingerprinting, which identifies a browser based on a combination of settings and characteristics rather than a stored file
- Local storage, a browser feature similar to cookies but with different technical properties and limits
- Pixel tags, tiny invisible images that report back when a page or email is opened
- Account-based tracking, where a company links activity across its own products using your logged-in identity
These methods matter because blocking cookies alone does not eliminate tracking entirely; some techniques do not rely on cookies at all.
Why consent banners exist
The consent banners that appear on many websites exist because of regulations requiring websites to disclose and, in many cases, obtain permission for non-essential cookies, particularly those used for tracking and advertising. The experience of these banners varies enormously between sites, from a simple notice to a wall of granular toggles, largely because the underlying regulations set requirements without mandating a single standard interface.
A brief comparison
| Type | Set by | Typical purpose |
|---|---|---|
| First-party cookie | The site you are visiting | Login sessions, preferences, shopping carts |
| Third-party cookie | An embedded external domain | Cross-site advertising and analytics |
| Fingerprinting | Any script, without storing a file | Identifying a browser without cookies |
What you can do about it
Browser settings, covered in more detail in our piece on how privacy features evolved, allow varying degrees of control over cookies and tracking. Clearing cookies periodically, using private browsing for sensitive searches, and reviewing consent banners rather than clicking accept automatically are all small, practical steps that add up over time.
Why the distinction still matters
Cookies are not inherently a privacy problem; the useful first-party kind make the web function properly. The concern has always been specifically about cross-site tracking through third-party mechanisms, and understanding that distinction makes it much easier to evaluate genuinely which parts of this technology are worth being cautious about.
Sources
About the author
Mara Devlin edits the publication and writes about the internet's infrastructure and incentives. She spent a decade as a technology reporter and editor before founding this masthead, and still does most of her reporting by reading documentation nobody else wants to read.
