What a cookie is
A cookie is a small piece of text that a website asks your browser to store. On later visits, the browser sends it back to the site. This simple mechanism solves a basic problem: web pages are delivered one request at a time, and the server has no built-in memory of who you are. Cookies provide that memory.
Cookies are not programs, and they cannot run code or scan your computer. They are labels. What matters is what the label is used for and who can read it.
First-party cookies
A first-party cookie is set by the site you are visiting and read only by that site. Many are useful:
- Keeping you signed in as you move between pages.
- Remembering items in a shopping basket.
- Storing language, region or display preferences.
- Helping the site count visitors and spot errors on its own pages.
These are generally what people expect. Blocking all of them often makes sites awkward, since you may be logged out on every page.
Third-party cookies
A third-party cookie is set by a different domain from the one in your address bar. This happens because most pages load content from other companies: adverts, social media buttons, embedded videos, analytics scripts and payment widgets. Each of those requests can carry its own cookie.
Here is why that enables tracking. Suppose an advertising company’s code appears on a news site, a shop and a recipe blog. When you visit each one, your browser contacts the advertising company, which can read the same cookie each time. It learns that the same browser visited all three and can start building a list of interests. That list can drive targeted advertising, which is explained in a separate article.
Because of this, many browsers now block third-party cookies by default or offer a setting for it. The change in approach is gradual and differs between browsers, and the details shift over time.
Beyond cookies
Blocking cookies does not end tracking, because trackers have other tools.
Tracking pixels. A tiny, usually invisible image loaded from a tracker’s server. Loading it tells the company that a page or email was viewed, along with your IP address and browser details. Pixels in emails can report that a message was opened, and some mail apps now block them by default.
Scripts and software kits. Analytics and advertising code that runs in the page and records clicks, scrolling and form activity.
Browser fingerprinting. Combining details such as screen size, fonts, language, time zone and graphics settings to build an identifier that does not rely on stored files. It is harder to clear because there is nothing to delete, though some browsers add protection against it.
Login-based tracking. When you sign in to a service, it can link activity across devices to your account, whatever your cookie settings are.
Link decoration. Identifiers added to the end of web addresses so that a click can be tied to a campaign or an individual. Some browsers strip known tracking parameters.
Device identifiers in apps. Phones also have advertising identifiers that apps can use, and the operating system usually offers a way to reset or limit them. Mobile controls are covered in the guide to app permissions.
Session and persistent cookies
Cookies also differ in how long they last. A session cookie disappears when you close the browser. A persistent cookie has an expiry date that might be days, months or longer. Longer lifetimes mean a profile can build up over more visits, which is why clearing cookies now and then has some effect.
Cookie banners and consent
Many sites show a banner asking you to accept or manage cookies. In several regions the law requires a request for consent before non-essential cookies are set, though how it is applied differs. Practical points:
- “Essential” or “strictly necessary” cookies are usually permitted without consent, since the site needs them to work.
- Reject or “manage preferences” may take more clicks than accept. Choose the reject or minimal option if you prefer fewer trackers.
- Choices are themselves stored in a cookie, so clearing cookies can make the banner return.
- Banners do not cover every kind of tracking, and some sites are less careful than others.
Reducing tracking
- Block third-party cookies in your browser. The article on browser privacy lists where to find this and other options.
- Turn on tracking protection if your browser offers it, which blocks known tracking domains.
- Clear cookies periodically, or set the browser to clear them on exit, accepting that you will need to sign in more often.
- Limit ad personalisation in the settings of your major accounts.
- Use a browser extension from a source you trust that blocks trackers, but be selective since extensions can read page content themselves.
- Be aware of what private windows do. They discard cookies at the end of a session, but do not prevent tracking while the window is open, as the article on private browsing explains.
- Reset or limit your mobile advertising ID in your phone’s privacy settings.
Putting it in perspective
Cookies themselves are a neutral technology, and most sites use them for ordinary reasons. The privacy concern arises when many unrelated sites share the same third-party code. Controls help, but no setting removes tracking entirely, and some blocking can break features on certain pages. The aim is to cut down the long-term profile that builds up, not to eliminate every trace.