What a cookie is
A cookie is a small piece of text that a website asks your browser to store. When you return to the site, or load another page on it, the browser sends the text back. That simple exchange solves a basic problem: web connections are otherwise forgetful, so a site has no built-in way to know that two requests came from the same visitor.
Cookies make many ordinary features possible. They keep you signed in, remember what is in a shopping basket, store language or display preferences and help sites protect against certain kinds of fraud. Not every cookie is about tracking, which is a point that often gets lost in the debate.
First-party and third-party cookies
The distinction that matters most is who sets the cookie.
- First-party cookies are set by the site you are visiting. They are commonly used for login sessions, preferences and basic analytics about how the site is used.
- Third-party cookies are set by a different domain whose content is embedded in the page, such as an advertising service, a social media button or an analytics provider. Because the same third party can appear on many sites, it can recognize the same browser across all of them and build a picture of browsing habits.
Cookies can also be session cookies, which disappear when the browser closes, or persistent cookies, which last until an expiry date, anywhere from minutes to years.
Other tracking methods
Cookies are the best-known approach, but they are not the only one.
- Tracking pixels. A tiny, often invisible image loaded from a third party. When the page or an email loads it, the request reveals details such as the time and the device, and can confirm that a message was opened.
- Local storage and similar browser features. Websites can store data in the browser outside of ordinary cookies, so clearing cookies alone may not remove everything.
- Device or browser fingerprinting. A script gathers many small characteristics, such as browser version, screen size, installed fonts and language settings. Individually these are not identifying, but together they can be distinctive enough to recognize a device without storing anything on it. Because there is nothing to delete, fingerprinting is harder for users to control.
- IP addresses. The network address your connection uses gives rough location information and can help link visits, though addresses can change and are shared by many users in some settings.
- Account-based tracking. When you sign in, a service can link your activity across sessions and devices directly to your account, with no cookie tricks required.
- Mobile identifiers and software kits. Apps can include code from third parties that collects usage data, and phones have had advertising identifiers that apps could read, which operating systems now let users limit or reset to varying degrees.
- Server-side and first-party collection. Some organizations send data from their own servers to partners, which can be harder for browser tools to detect.
Why organizations track
Reasons include:
- Measuring performance. Understanding which pages people visit helps site owners improve content and fix problems, a basic use of data analytics.
- Advertising. Targeted ads rely on guessing interests from behavior, and measurement tools check whether an ad led to a purchase. Advertising revenue supports many free sites and services.
- Personalization. Recommendations and tailored content use past behavior, which is the same idea behind recommendation algorithms.
- Security and fraud prevention. Recognizing a familiar device can help flag suspicious sign-ins.
The privacy concerns
Critics raise several points:
- Profiling at scale. Combined data across many sites can reveal interests, habits and circumstances, possibly including sensitive ones such as health or finances, even if no one set out to collect them.
- Lack of transparency. Most people do not know which companies receive data when they load a page, and the chain of recipients can be long.
- Weak meaningful choice. Consent prompts are often confusing or tiring, as discussed in the article on digital consent.
- Security and misuse risk. The more data that is gathered and shared, the more that can be lost in a breach or used in ways people did not expect.
- Differential effects. Profiles can be used to treat people differently, for instance in the ads or prices they see, which raises fairness questions.
The other side of the debate
Supporters of tracking-based advertising and analytics make arguments too:
- Targeted advertising can be more relevant and can fund content without subscriptions.
- Smaller publishers and businesses may rely on measurement and targeting to compete.
- Many tracking tools are used only in aggregate, to count visits rather than to profile individuals.
- Some argue that blocking everything harms the services people like, and that better rules, not bans, are the right response.
There are also disagreements about alternatives. Approaches that process data on the device or group users into broad interest categories are sometimes presented as more private, while critics say they still enable profiling and may concentrate power among large companies. These questions are unsettled.
How rules approach cookies and tracking
Regulators generally treat identifiers that can single out a person or device as personal data in many situations. In the European Union, rules on electronic communications have long required that storing or reading information on a user’s device usually needs consent, with exceptions for what is strictly necessary to provide a requested service. That requirement is why many sites show cookie banners. Other places take different routes, such as giving people an opt-out for the sale or sharing of their data or requiring honoring certain browser signals. The details vary and change, and organizations should rely on qualified professionals for their specific duties.
What people can do
None of these steps is perfect, but several help reduce tracking:
- Browser settings. Many browsers block third-party cookies or known trackers by default or allow you to turn that on.
- Clearing data. Periodically deleting cookies and site data limits how long identifiers last, although it also signs you out of sites.
- Privacy-focused extensions and settings. Content blockers can stop many trackers from loading. A virtual private network hides your IP address from sites but does not stop cookies or account-based tracking on its own.
- Using cookie banners carefully. Choosing “reject” or “manage” where offered, and reviewing the privacy settings on accounts you use.
- Mobile permissions. Reviewing which apps can track activity or access location, and limiting advertising identifiers in device settings.
- Being aware of your digital footprint. Information you share directly, such as in profiles, is also part of what can be linked together.
The bottom line
Cookies are a basic web technology with legitimate uses, and tracking is the broader practice of recognizing and following people across sites and apps. The central debate is not whether any recognition should exist, but how much, for what purposes, with what transparency, and who decides. Technology, business models and rules in this area keep shifting, so details that are accurate today may change.