Key takeaways
- A cookie is a small piece of data a site stores in your browser and gets back on later visits.
- First-party cookies belong to the site you are visiting. Third-party cookies belong to another domain, often an ad or analytics company.
- Blocking all cookies can log you out of sites. Blocking third-party cookies is a common middle ground, and browsers have been tightening that by default.
- Cookie banners are a legal and product response to tracking, not proof that a site is “safe.”
When a website says it “uses cookies,” it is not talking about a virus. A cookie is a name-value pair the site asks your browser to store. On a later request to that same site (and under rules the browser enforces), the browser sends the cookie back. That is how a site can remember that you logged in, what is in a shopping cart, or which language you picked.
First-party versus third-party
If you visit dailyscope.example and the cookie is set for dailyscope.example, that is a first-party cookie. Login sessions and “dark mode” preferences often work this way.
If the page also loads a script or image from ads.other-company.example, that other company can try to set a cookie for its domain. As you browse many sites that load the same company, it can recognize the same browser. That is the classic third-party tracking cookie. It is useful for advertisers who want to know whether an ad on site A led to a purchase on site B. It is also the reason privacy advocates spent a decade arguing about cross-site tracking.
What “personalized ads” means here
Ad networks combine cookie IDs with other signals (IP address, coarse location, the page topic) to guess what you might click. Google and others also offer non-personalized ads in some regions, which still use some technical data but not a full advertising profile. The details are in each company’s ad settings, not in a site’s banner text.
Safari and Firefox have restricted third-party cookies for years. Chrome has been changing how it treats them as well. The industry has been shifting toward first-party data, contextual ads (the page is about hiking, show a hiking ad), and newer browser APIs. The names change faster than the basic idea: someone wants to know if the same device showed up on two sites.
Settings that actually do something
In most browsers you can: delete cookies, block third-party cookies, or use a site-by-site exception. Logging out and clearing cookies will often sign you out everywhere — that is the session cookie doing its job.
A cookie banner that must be clicked to “accept all” is not a security scan. It is a consent or notice flow. Read the reject or “necessary only” control if you want fewer advertising cookies. Necessary cookies for a news site might include load balancing or a login. They should not include a full ad graph.
What cookies are not
They are not a complete identity. Sharing a browser, using private mode, or switching devices breaks the chain. They also are not the only tracking method. Fingerprinting and logged-in identifiers on large platforms can fill the gap when cookies are blocked.
If you want a practical habit: use a current browser, block third-party cookies if the option is there, and do not treat “I accepted cookies” as an endorsement of a business model. It is often just the price of admission the site chose to charge.