What Are Browser Cookies and How Do They Work?

TL;DR

• A cookie is a small piece of data a website sends to your browser, which the browser stores and sends back on later requests to that site [1].
• First-party cookies come from the site you are visiting. Third-party cookies come from other companies whose content is embedded in the page, often ads or analytics [1].
• Cookies keep you logged in and remember settings, but third-party cookies can also be used to track you across sites [1][3].
• You can delete cookies or block third-party ones in your browser settings [2].

How cookies work #

Web requests are stateless by default: the server does not remember you between page loads. Cookies fix that. The server includes a Set-Cookie instruction in its response, the browser stores the cookie, and the browser then sends it back in a Cookie header with later requests to the same server [1]. Cookies can be temporary, lasting only until the browser session ends, or they can carry an expiry date so they last longer [1].

Think of a cloakroom ticket: the site hands you a numbered ticket, and shows it back each time so it knows which coat is yours. Good sites store only a random ID in the cookie and keep your details on their server [1].

First-party vs third-party cookies #

Third-party cookies have some legitimate uses, such as shared accounts across related sites or counting ad views, but they enable cross-site tracking. Browsers increasingly block them by default [1].

What cookies are used for #

• Session management: staying signed in, keeping items in a cart.
• Personalisation: language, theme and other preferences.
• Tracking: recording and analysing behaviour [1].

Cookies are not the only tracking method. Sites and apps also use pixels, device fingerprinting and advertising identifiers [3]. Cookies are also limited in size, roughly 4 KB each, so they are poor for storing lots of data [1].

How to manage cookies #

• Delete them: In Chrome, open the browser menu, choose Delete browsing data, tick "Cookies and other site data" and pick a time range. You may be signed out of sites [2].
• Block third-party cookies: In Chrome, go to Settings, Privacy and security, Third-party cookies, then choose to block them. Some sites may stop working properly [2]. Other browsers have similar settings under privacy.
• Make exceptions: You can allow third-party cookies for one site you trust [2].
• Use cookie notices: When a site asks, pick the level of tracking you are comfortable with [3].
• Remember the limits: Private browsing ends your history on your device but does not stop websites seeing your activity [3].

Laws such as the EU's GDPR and ePrivacy rules and California's privacy law can require sites to tell visitors about cookies and let them opt out [1].

FAQ #

Are cookies dangerous? #

Cookies are not programs and cannot install malware by themselves. The main concerns are privacy, through tracking, and account security if a login cookie is stolen, which is why sites use protections such as the Secure and HttpOnly attributes [1].

Should I accept or reject cookie banners? #

Essential cookies are usually needed for the site to work. For the rest, choose the level you are comfortable with, and decline non-essential tracking if unsure [3].

Do cookies track me across the whole web? #

Only third-party tracking can follow you across many sites. First-party cookies stay with one site [3].

What happens if I delete all cookies? #

You will probably be signed out of sites and lose some saved preferences, but nothing else is harmed [2].

Sources #