What Are Cookies?
Cookies are small pieces of text data that a website stores in your browser. They were invented in 1994 by an engineer at Netscape and have served as a foundational web technology ever since.
The original purpose of cookies is to give "memory" to HTTP, a protocol that is stateless by design. They play an essential role in the conveniences we take for granted on the web: keeping you signed in, preserving the contents of a shopping cart, and remembering your language preference. Storing and managing cookies is the job of the browser, so the way cookies are handled differs depending on which browser you use and how it is configured.
First-Party Cookies vs. Third-Party Cookies
First-Party Cookies
These are cookies set by the website you are visiting. They are used to keep you signed in, save your preferences, and manage shopping carts. They are generally useful, and blocking them can stop websites from working properly.
Third-Party Cookies
These are cookies set by a domain other than the site you are visiting. They are used mainly by advertising networks and analytics services to track user behavior across multiple websites. From a privacy standpoint, third-party cookies are the most contentious of the two.
How Ad Tracking Works
Ad tracking generally unfolds like this:
- You visit Website A, and a script from the ad network embedded in the page sets a third-party cookie
- You then visit Website B, and a script from the same ad network reads that cookie
- The ad network now knows that you visited both Site A and Site B
- As this information accumulates, a user profile based on your interests takes shape
- Personalized ads are delivered on the basis of that profile
This process runs in parallel across a great many ad networks without the user ever noticing. The result is the familiar experience of seeing the same ads no matter which site you open.
Tracking Techniques Other Than Cookies
Even if you block cookies, other techniques can still be used to follow you.
Browser Fingerprinting
This technique identifies users by combining configuration details from the browser and the device. Unlike cookies, it stores no data on the device, which makes it hard to delete or block. For details, see our article on browser fingerprinting.
Local Storage and IndexedDB
These technologies can hold far more data in the browser than cookies can. Even after you delete your cookies, a tracking ID may remain behind in one of these storage areas.
ETag and Cache Tracking
This method abuses the HTTP caching mechanism to identify users. The server returns a unique ETag and then reads that ETag back on your next visit to follow you.
Pixel Tracking
A transparent 1×1 pixel image is embedded in a web page or an email, and the request that loads it is used to track the reader's behavior.
How to Manage Cookies
Block Third-Party Cookies in Your Browser Settings
Every major browser offers a setting for blocking third-party cookies. Safari moved to blocking them outright in March 2020, and Brave blocks them by default as well. Firefox has had Total Cookie Protection enabled by default since 2022; instead of rejecting cookies across the board, it gives each site you visit its own separate storage so that other sites cannot read it. The plan to phase out third-party cookies in Chrome was withdrawn in 2024, and keeping them was confirmed in April 2025, so Chrome allows them by default, although you can enable blocking from its settings.
Set Cookies to Delete Automatically
Configuring your browser to delete cookies automatically when it closes prevents long-term tracking. The trade-off against convenience is unavoidable, though, since you have to sign in again every time.
Make Use of Privacy Extensions
- uBlock Origin: blocks ads and trackers comprehensively. Because Chrome's extension platform moved to Manifest V3, a scaled-back build called uBlock Origin Lite is offered separately for Chrome
- Privacy Badger: blocks tracking on the basis of the tracker list published by the EFF. The feature that learned on the device while you browsed was disabled by default in October 2020, out of concern that the learned results themselves could serve as identifying material
- Cookie AutoDelete: deletes cookies automatically when you close a tab
For the wider picture of protecting your privacy online, including cookie countermeasures, our practical guide to protecting your privacy is worth reading as well.
Make Use of Private Browsing Mode
In private browsing (incognito) mode, cookies are deleted automatically once you close the browser. It does not encrypt your traffic or hide your IP address, however, so it gives you no real anonymity. Using HTTPS/TLS encryption alongside it protects the contents of your traffic, but Do Not Track is a request that the receiving side is under no obligation to honor, and many ad networks ignore it, so it is not something to rely on for stopping tracking.
Check Your Cookie Status with IP Check-san
The homepage of IP Check-san shows your cookie information and your security score. A large number of cookies is reflected in the security score, so make a habit of checking and clearing them out regularly.
Related Glossary Terms
Frequently Asked Questions
Is it OK to reject all cookies?
If you reject first-party cookies, you cannot stay logged in or keep items in your shopping cart, and many sites stop working properly. Blocking only third-party cookies is the practical approach.
What is the difference between cookies and cache?
Cookies are small pieces of data that a site stores in your browser to remember things like login state and preferences. The cache temporarily stores files such as images and CSS to speed up page loading.