What are cookies?

Cookies are small pieces of data that a website asks your browser to store. HTTP, the set of rules browsers use to load web pages, doesn’t remember earlier exchanges on its own. So a site hands your browser a small tag to keep, and when you come back, your browser shows that tag. That’s how the site knows you’re the same person continuing from before.

Cookies make handy things like sign-in and shopping carts work, but they can also be used to follow people across websites. That’s why browsers set detailed rules for them, and why some countries regulate how they’re used. If you run a website, knowing how cookies work also helps you understand consent banners, privacy policies, and your analytics numbers.

How do cookies work?

Cookies are exchanged in these steps:

1. Your browser opens a page on a site
2. The server includes a Set-Cookie header (a label on its response) with a name and a value. For a language setting, it might be lang=en
3. The browser stores the cookie, kept separate for each site
4. The next time the browser talks to the same site, it automatically sends the stored values back in a Cookie header

A page’s JavaScript can also create cookies. Each cookie is small, usually up to about 4 KB, so cookies aren’t meant for storing lots of data.

The key point is that the browser sends a cookie only to the site that set it. One site can’t simply read another site’s cookies. For the technical details, see Using HTTP cookies on MDN.

What are cookie attributes?

Besides a name and a value, a cookie can carry attributes that control how it’s handled. The main ones are:

Attribute	What it does
Expires, Max-Age	How long to keep the cookie (a date or a number of seconds)
Domain, Path	Which domains and paths the cookie is sent to
Secure	Send it only over encrypted HTTPS connections
HttpOnly	Keep the page’s JavaScript from reading it
SameSite	Whether to send it with requests that start on other sites: Strict (no), Lax (yes when someone follows a link to the site, and in similar cases), or None (yes; requires Secure)

Important cookies, such as the one that keeps you signed in, should have HttpOnly and Secure set to make them harder to steal, and should use SameSite to limit where they’re sent.

What are cookies used for?

Cookie uses fall into three broad groups.

Use	Examples
Sign-in and continuing what you were doing	You don’t have to sign in again on every page of an online course. Your cart keeps the materials you picked
Preferences	Display language, text size, light or dark theme
Measurement and ads	Web analytics recognizing a returning visitor. Measuring ad results, or showing ads based on interests

The first two are for the visitor’s benefit. The third is for the site owner or an ad company, and it’s where most of the privacy concerns are. To see how analytics uses cookies, read “What is web analytics?”

How are first-party and third-party cookies different?

Cookies fall into two groups depending on whether they belong to the site you’re looking at.

Type	Set by	Example
First-party cookie	The site shown in the address bar	While you’re on a class website at example.com, a cookie for example.com
Third-party cookie	Another site whose content is embedded in the page	A cookie from the company serving an ad or an embedded widget on that page

A third-party cookie can be read on every site that shows the same company’s ads or widgets. That makes it possible to link together which sites one person visited, which is why third-party cookies have long been a privacy concern.

What decides the type is the domain the cookie is stored on. Even if you use a tag (a measurement script) from another company, a cookie that the tag stores on your own site’s domain is a first-party cookie.

Session cookies and persistent cookies

Cookies can also be grouped by how long they last.

• Session cookies: cookies with neither Expires nor Max-Age. They’re deleted when the session ends, for example when you close the browser (though they can survive if the browser restores your previous tabs)
• Persistent cookies: cookies with an expiry. They stay until they expire or the user deletes them. They’re used to keep you signed in, or to remember your settings for next time

How do browsers handle third-party cookies?

Browsers handle third-party cookies differently. Here’s what each vendor’s official documentation said when we checked in October 2026.

Browser	How it handles them
Safari	Blocks all third-party cookies by default. It also deletes cookies created by JavaScript after 7 days of Safari use without interaction on that site
Firefox	Total Cookie Protection keeps each site’s cookies in a separate jar, so they can’t be used to connect your activity across sites. On by default in the desktop version
Chrome	Users choose in settings whether to allow or block third-party cookies. Incognito mode blocks them by default

For Chrome, Google said in July 2024 that instead of deprecating third-party cookies, it would take a different approach. In April 2025, it announced that it would keep the current approach of letting users choose in Chrome’s settings, and would not roll out a new standalone prompt.

Browser behavior can keep changing. Assume that measurement relying on third-party cookies won’t work in some browsers. Even first-party cookies can be cut short, as in Safari, so you may not be able to follow the same visitor over many days.

What should sites that use cookies keep in mind?

The starting point is to tell visitors what information you handle and why.

In Japan, the external transmission rules under the Telecommunications Business Act took effect on June 16, 2023. They cover tags and similar code that make a visitor’s browser send information elsewhere. They apply to telecommunications business services, such as social networks, search, and news sites. Japan’s Ministry of Internal Affairs and Communications explains that a company’s own online store, a corporate website, or a personal blog is not a telecommunications business, so those aren’t covered. Services that are covered must either notify or publish, get consent, or offer an opt-out, for three things: what information is sent, the name of whoever handles it, and the purpose.

Even if these rules don’t cover your site, writing the same things in your privacy policy lets visitors know what’s going on.

In the EU, the ePrivacy Directive requires sites to give clear information about the purpose and get consent before storing or reading information on a visitor’s device, such as in the browser. The exception is what’s strictly necessary to provide a service the visitor asked for, such as sign-in or a cart. That’s why cookie consent banners are so common.

If you run a site, keep these points in mind:

• Keep a list of the cookies you use and what each is for
• Treat essential cookies separately from measurement and advertising cookies
• If you ask for consent, make it just as clear how to say no

Summary

• Cookies are small pieces of data a site stores in the browser, used for sign-in, carts, remembering settings, measurement, and ads
• Cookies for the site you’re on are first-party; cookies from other sites embedded in the page are third-party
• Safari and Firefox restrict third-party cookies by default, while Chrome lets users choose in settings
• Tell visitors what you handle and why, and check the rules in each region where you have visitors