HTTP cookie
Also known as: cookie, web cookie, browser cookie, internet cookie, cookies
An HTTP cookie is a small piece of data a website saves in your browser so it can remember information about you between visits, such as keeping you logged in, saving your shopping cart, or remembering language settings.
First-party cookies come from the site you visit, while third-party cookies come from other companies, often advertisers, and can track you across websites. While cookies are essential for many website features, tracking cookies raise privacy concerns, leading to consent banners and browser restrictions.
HTTP cookie, explained at three levels
At home
A cookie is like a coat check ticket. The website gives your browser a ticket, and when you come back, it shows the ticket so the site remembers you.
At work
Cookies keep staff logged in to web apps, but stolen session cookies can let attackers into accounts.
At home
When a cookie banner appears, you can usually reject non-essential cookies, which limits tracking without breaking the website.
At work
Cookies can be secured with flags such as Secure, HttpOnly, and SameSite. Session cookies vanish when the browser closes, while persistent cookies stay until they expire.
At home
Clearing cookies logs you out of websites but removes tracking data too. In my opinion, using a privacy-focused browser is easier than clearing cookies constantly.
At work
Session cookie theft by infostealer malware can bypass MFA. Use short session lifetimes for sensitive apps, bind sessions to devices where possible, and revoke sessions after suspected compromise.
Real-world examples
At home
Fatima noticed ads for shoes she'd viewed following her across websites. She switched her browser to block third-party cookies, and the ads mostly stopped.
At work
Jerome secures a Saskatoon company's web app. He set cookies to HttpOnly and Secure and shortened session times after reading about cookie theft attacks.
How it compares
| feature | First-party cookie | Third-Party Cookie |
|---|---|---|
| Set by | Site you're visiting | Other companies |
| Common use | Logins, preferences | Ads, tracking |
| Blocked by default | No | In Safari, Firefox, and Brave |
| Privacy concern | Low | High |
First-party cookies help sites work. Third-party ones mostly track.
For analysts
In website projects, I'd list every cookie the site sets and why. It simplifies consent banners and often reveals tracking scripts nobody remembered adding.
History & origin
Lou Montulli, an engineer at Netscape, invented cookies in 1994 to let websites remember shopping carts, borrowing the term 'magic cookie' from earlier computing. The technology quickly spread, and advertisers began using third-party cookies to track people across sites. Privacy concerns grew, and European rules from 2009 and 2011 led to cookie consent banners. Apple's Safari began blocking many third-party cookies by default in 2017 and Firefox followed in 2019. Google announced in 2020 that Chrome would phase out third-party cookies, delayed the plan several times, and in 2024 and 2025 backed away from removing them altogether. In my view, cookies show how a small convenience feature can grow into the backbone of online advertising.