What Is a Web Cookie? A Note the Browser Hands Back Every Time

When a server responds to a request it can include an instruction to set a cookie, which is a name and value plus some attributes. The browser stores it and, on every later request to a matching address, sends it back automatically. That is the whole technical idea, and the attributes are what make it behave usefully or dangerously:

• •An expiry, since a session cookie disappears when the browser closes while a persistent one lasts until a stated date
• •A domain and path, controlling which addresses the cookie is returned to
• •The secure flag, which prevents the cookie being sent over an unencrypted connection
• •The HttpOnly flag, which stops scripts on the page reading it, closing a major route for stealing session tokens
• •The SameSite attribute, which controls whether the cookie is sent when the request originates from a different site, and which is the main defence against a class of attack that tricks a logged-in browser into performing actions
• •A size limit of around four kilobytes, which is why cookies normally hold an identifier rather than actual data, with the data kept on the server and looked up by that identifier

The distinction that matters for privacy is not technical but contextual. A first-party cookie is set by the site whose address is in the bar, and is what keeps a person logged in, remembers a shopping basket, stores a language preference and holds a security token. A third-party cookie is set by a different domain whose content is embedded in the page, typically an advertisement, an analytics script or a social media widget. Because the same third party is embedded across many unrelated sites, it sees the same browser again and again in different contexts, and can therefore build a profile of browsing across the web without any individual site sharing data deliberately. That is the mechanism behind behavioural advertising and behind the experience of being followed by a product across the internet. Nothing in the original design anticipated this, and the entire regulatory and technical argument about web privacy over the past decade is essentially an argument about that one side effect.

European rules, principally the ePrivacy Directive and later the General Data Protection Regulation, require consent before storing or reading information on a user's device for non-essential purposes, and that requirement produced the consent banner that now interrupts almost every first visit. The implementation has been widely criticised on the regulators' own terms, since valid consent must be freely given, specific and as easy to withdraw as to give, and a great many banners make refusal slower, more confusing or visually harder than acceptance, patterns regulators have ruled unlawful and fined companies over. The broader criticism is that the outcome has been consent fatigue, in which people click accept reflexively, which is worse than either meaningful consent or no consent at all, and which has not obviously reduced tracking. Essential cookies, including those keeping a user logged in or remembering items in a basket, do not require consent, which is why a site can be perfectly functional without any banner.

Browsers have moved against third-party cookies independently of regulation, with several blocking them by default for years and the largest phasing them out after repeated delays. The tracking has not stopped, because the demand did not, and the replacements are in several respects harder to control. Fingerprinting identifies a browser from the combination of its characteristics, including fonts, screen size, graphics rendering and time zone, which together are frequently unique and which the user cannot delete because there is nothing stored. First-party data collection moves tracking to the site the user actually visited, which then shares it server to server rather than through the browser. Identity graphs link a hashed email address across services. Proposals to replace third-party cookies with browser-computed interest groups have been criticised from both directions, as insufficiently private and as entrenching the browser vendor's position in advertising. The technical lesson is that removing one mechanism does not remove the incentive that produced it.

A cookie is a small piece of text a server asks a browser to store and return with later requests, which is what makes staying logged in possible on a protocol that otherwise remembers nothing. First-party cookies run sessions and preferences, and third-party cookies, set by content embedded across many sites, allowed browsing to be tracked across the web. Consent banners followed from European law and are widely implemented in ways regulators consider invalid. Blocking cookies pushed tracking into fingerprinting and server-side sharing.