A cookie is a small piece of text that a website asks your browser to save and then send back on later visits. It is how a site remembers that you are logged in, what is in your basket, or that you picked French instead of English. Without cookies, every click would look like a brand new stranger to the server.
How a cookie travels between server and browser
When a server answers a request, it can include a Set-Cookie header with a name, a value and some rules. The browser stores it and, on every later request to the same domain, attaches it in a Cookie header. The value is usually a random session ID rather than your actual details; the server looks that ID up to find who you are.
The rules matter. Expires or Max-Age decide whether the cookie dies when the browser closes or lasts for months. Secure means it is only sent over HTTPS. HttpOnly hides it from JavaScript, which protects login sessions from script injection. SameSite controls whether it is sent when another site links or posts to yours. Browsers cap each cookie at about 4 KB, which is why larger data goes into localStorage or the server instead.
First-party and third-party cookies
A first-party cookie belongs to the site in the address bar: your shop's cart cookie, for instance. A third-party cookie is set by a different domain loaded inside the page, such as an ad network, and lets that company recognise the same person across many sites. Safari and Firefox block most third-party cookies by default, and Chrome restricts them in various ways, so cross-site tracking that relied on them has become far less dependable.
The cookies behind a bakery's order page
A bakery's online order page lets visitors add a cake, then wander off to read the menu. A first-party cookie holding a cart ID keeps the cake in the basket. Meanwhile, the Meta Pixel and Google Analytics scripts on the page set their own cookies to measure visits and ad results. The cart cookie is essential for the site to work; the analytics and advertising ones are not, and that distinction drives consent rules.
When cookies matter for your site
If you have visitors in the EU or UK, the ePrivacy rules plus GDPR mean non-essential cookies (analytics, ads, most embeds) generally need opt-in consent before they are set. Strictly necessary cookies, like a login or cart, do not. Your privacy policy should list what you set and why. A simple brochure site with no tracking may set no cookies at all.
Cookie mistakes worth avoiding
- Loading trackers before consent. A banner that appears while the analytics cookie is already set does not meet EU rules.
- Session cookies without HttpOnly and Secure. This makes stolen logins much easier.
- Storing personal data in the cookie value. Keep an opaque ID in the cookie and the details on the server.
- Forgetting third-party embeds. YouTube videos, maps and chat widgets often set their own cookies.
Related terms
- localStorage: browser storage that never travels to the server.
- Pixel tracking: the ad measurement that often relies on cookies.
- GDPR: the EU law behind most cookie banners.
- Privacy policy: where you disclose the cookies you use.