A cookie is a small piece of data that a website asks your browser to remember. It can keep you signed in, preserve a language choice, or remember what is in a shopping cart. Those uses are often helpful. The privacy questions become more complicated when the cookie comes from a company other than the site you intentionally opened.
These are third-party cookies. For years, they helped advertising and analytics companies recognize the same browser across unrelated websites. Browsers are now placing tighter boundaries around them, but the underlying idea remains worth understanding because cross-site tracking can use more than one technique.
First-party and third-party depend on context
Suppose you visit a news website. A cookie created by that news site is first-party in that context. If the page also loads an advertising frame, social widget, measurement script, or embedded video from another company, that outside service may try to set or read its own cookie. From the news site’s perspective, that is a third party.
The labels describe the relationship between the site in the address bar and the resource interacting with the browser. The same company could be first-party on its own website and third-party when embedded elsewhere.
MDN’s guide to third-party cookies explains how these cookies work across embedded content and why browser restrictions can affect both tracking and legitimate services.
How recognition happens across websites
A third-party service may appear on thousands of websites. If the browser sends that service the same identifier each time, the company can connect those visits to one browser. It may learn that the browser viewed a travel article in the morning, compared laptops later, and visited a particular online shop at night.
The cookie does not need to contain a complete profile. It may contain only a random identifier. The detailed record can live on the company’s servers, where each new interaction is added to the identifier’s history.
This is why a tiny browser token can have an outsized privacy effect. The important information is not necessarily inside the cookie; it is in the connections the identifier allows a company to make.
Why websites used third-party cookies
Cross-site cookies became popular because they supported several business and product functions:
- Advertising measurement: estimating whether an ad led to a later visit or purchase.
- Audience targeting: choosing ads based on inferred interests or previous browsing.
- Frequency controls: limiting how often the same advertisement appears.
- Embedded services: maintaining state inside videos, payment tools, maps, chat widgets, and sign-in components.
- Fraud prevention: recognizing suspicious patterns across participating sites.
Not every third-party cookie exists for behavioral advertising. A blanket restriction can break an embedded login or payment flow if it was designed around older assumptions. That is why browsers often include narrowly scoped compatibility mechanisms rather than simply treating every cross-site interaction as identical.
Browser protections are becoming more contextual
One approach is to partition storage. Instead of allowing one third party to use the same cookie everywhere, the browser gives it a separate storage space for each top-level site. The embedded service can still remember state where needed, but it becomes harder to connect activity across unrelated sites.
Mozilla describes this model in its documentation for Total Cookie Protection, which places cookies into separate “jars” based on the site being visited. Other browsers use their own combinations of blocking, partitioning, exceptions, and user controls.
This direction reflects a useful principle: data needed for one relationship should not automatically become a passport across the wider web.
Blocking cookies does not end tracking
Cookie restrictions reduce an important tracking channel, but they do not make a browser anonymous. Companies can use account logins, link decoration, IP addresses, server-side sharing, local storage, or statistical matching. They may also attempt browser fingerprinting, which combines device and software signals into a recognizable pattern.
Trackers can also be scripts or network requests that never rely on a traditional third-party cookie. A broader protection system may need to recognize and stop known tracking resources, as we explain in how tracker blocking works across the web.
The practical lesson is not that cookie protection is pointless. It is that privacy has layers. Closing one well-known door matters, while other doors still need attention.
What happens when you clear cookies
Clearing cookies can sign you out, reset preferences, empty some carts, and remove identifiers stored in those cookies. It can be useful when troubleshooting a site or reducing accumulated state. Yet it cannot delete information already held by a company’s servers, and signing back into the same account can reconnect new activity to your profile.
Private browsing usually starts with a temporary storage area and removes that local state when the private session closes. It does not hide activity from websites or networks. Our guide to what private browsing does with your data covers that boundary in more detail.
Cookie consent banners are only part of the story
A consent banner reflects legal requirements, regional choices, and the site’s implementation. Accepting “necessary” cookies does not always reveal every network request the page makes, while rejecting optional cookies may not stop tracking techniques that are not cookies. The wording and categories also vary widely.
When a banner offers a genuine choice, selecting only necessary functions can reduce optional data collection. Browser-level protections add another boundary that does not depend entirely on every website implementing consent perfectly.
A useful way to think about cookies
Cookies are memory. First-party memory often supports the direct relationship you chose: staying signed in to a service or keeping a setting. Third-party memory can support embedded features, but historically it also allowed one outside company to recognize a browser across many places.
Good privacy design asks whether that memory is necessary, how narrowly it can be scoped, and how long it should remain. For users, the most reliable approach is layered: restrict cross-site storage, block known trackers, review site permissions, and remember that no single setting erases every trace of online activity.
Browse with more intention
Noorani brings prayer times, Qibla, tracker blocking, and privacy into one calm desktop browser built for how Muslims live online.