What Is Cookie Privacy?

What cookie privacy means#

A cookie is a small piece of data a website asks your browser to store. The next time you load a page, your browser sends that data back, which is how a site remembers that you are logged in, what is in your cart, or which language you prefer. Cookies are ordinary plumbing, and most of the web would break without them.

Cookie privacy is the question of what those stored files reveal about you and who is allowed to read them. It has two sides. One is what a cookie holds, which might be a harmless session identifier or a marker that ties back to a detailed record of your behaviour. The other is who can read it, because a cookie that only one website can see is very different from a cookie that dozens of companies can read as you move around the web.

That difference is the whole story. A cookie is not automatically a privacy problem, and treating every cookie as a threat misses the point. The cookie that keeps you signed in is not what regulators, browser makers, and privacy advocates worry about. The cookies that follow you from site to site to build an advertising profile are. To see why, you need the distinction between first-party and third-party cookies.

First-party vs third-party cookies#

A first-party cookie is set by the website whose name is in your address bar, on its own domain, and only that site can read it. When you sign in to a shop, the cookie that keeps you logged in is a first-party cookie. It stays with that shop, does its job, and never leaves. These cookies raise few privacy concerns because the site you chose to visit already knows you are there.

A third-party cookie is set by a different domain that is embedded inside the page, such as an advertising network, an analytics service, or a social media widget. The key detail is that the same third-party domain is embedded across thousands of unrelated sites. Because it is the same domain each time, it can read its own cookie on every one of those sites and connect what it sees into a single record. A news article you read, a product you looked at, and a video you watched can all be linked to the same profile, even though those sites have nothing to do with each other. That cross-site linking is exactly what cookie privacy is about.

Browsers have quietly made this harder over the years through a cookie setting called SameSite, which controls whether a cookie is sent when a request comes from another site. Since early 2020, Chrome treats any cookie that does not state a SameSite value as SameSite=Lax, meaning it is not sent on cross-site requests at all. For a cookie to work in a third-party context it now has to explicitly declare SameSite=None; Secure, which also forces it onto an encrypted connection. This does not end cross-site tracking on its own, but it made the third-party cookie something a site has to ask for on purpose rather than get by accident.

Why cookie privacy matters#

The concern with cross-site tracking is not that a company knows you visited one page. It is that a profile assembled from hundreds of pages can infer things you never chose to share. A pattern of visits can suggest a health condition, a financial situation, a pregnancy, or a political leaning, and that inferred profile can be used to target advertising, priced and traded between data brokers, or exposed in a breach. You did not hand any single site that picture of yourself, yet it exists because the same tracker was watching across all of them.

For the people being tracked, the problem is a loss of control. Tracking happens silently in the background, the profile is invisible, and there is rarely a clear way to see it or delete it. For the businesses running websites, poor cookie privacy is both a trust problem and a legal one. Visitors increasingly notice and resent being followed, and regulators now issue real fines over how tracking is done. The rules differ by region, and the full legal picture for the European Union is covered in our guide to GDPR cookie consent requirements, but the short version is that non-essential cookies increasingly need a genuine choice behind them.

How browsers handle cookie privacy#

Much of what has changed about cookie privacy did not come from laws at all. It came from the browsers themselves, and this is where the picture in 2026 surprises people who stopped paying attention a couple of years ago.

Apple's Safari has blocked third-party cookies by default for every user since 2020, through a feature called Intelligent Tracking Prevention. Mozilla's Firefox followed in 2022 with Total Cookie Protection, which takes a slightly different route. Rather than blocking third-party cookies outright, it gives each website its own separate cookie jar, so a tracker's cookie set on one site cannot be read on another. The effect is the same, cross-site tracking through cookies stops working. Brave, a privacy-focused browser, blocks third-party cookies and trackers by default as well.

Chrome is the plot twist. For years Google announced that it would remove third-party cookies from Chrome and replace them with a set of privacy-preserving browser tools called the Privacy Sandbox. That removal kept slipping, and then it reversed. In April 2025 Google confirmed it would keep third-party cookies in Chrome and would not add a new prompt asking users to choose, leaving the existing browser settings as the way to turn them off. In October 2025 Google went further and began winding down most of the Privacy Sandbox tools, citing low adoption, though a few narrower pieces survive, including partitioned cookies, which isolate a third-party cookie to the single site that set it.

The result is a landscape almost nobody predicted. Third-party cookies are still switched on by default in Chrome, which is by far the most used browser, while the project meant to replace them has been shelved. If you use Chrome without changing anything, third-party cookies still work. Safari and Firefox users have been protected from them for years. So the practical state of your cookie privacy now depends heavily on which browser you use, which was not true when everyone assumed the third-party cookie was on its way out everywhere.

How the law protects cookie privacy#

Because browsers no longer agree on how to treat cookies, the law has become the more consistent force. In the European Union and the United Kingdom, two rules work together. The General Data Protection Regulation, or GDPR, treats a cookie identifier as personal data when it can single out a person, and the ePrivacy Directive requires consent before any non-essential cookie is stored or read. In practice that means analytics and advertising cookies have to wait for a clear opt-in. The full set of requirements, and how to check your own site against them, is covered in our companion guides on GDPR cookie consent requirements and how to verify cookie compliance.

The United States has no single federal cookie law, but a growing set of state laws fills the gap. California, Colorado, Connecticut, and others give people the right to opt out of the sale or sharing of their personal information, which covers a lot of cross-site advertising. Crucially, several of these laws now require businesses to honour a browser signal that broadcasts that opt-out automatically, so a person does not have to click a refusal on every site.

That signal is Global Privacy Control, or GPC. When it is on, the browser adds a small header, Sec-GPC: 1, to its requests and exposes a matching property that sites can read, which together tell every site that the visitor is opting out. Firefox, Brave, and DuckDuckGo can send it, and it is available as an extension for browsers that do not, including Chrome, which does not send it on its own. Enforcement is not hypothetical. California fined the retailer Sephora 1.2 million dollars in 2022 in part for ignoring GPC signals, the California Privacy Protection Agency settled with an automaker in 2025 over a broken opt-out, and in September 2025 the regulators of California, Colorado, and Connecticut launched a joint sweep against businesses that fail to honour the signal.

Fingerprinting and the cookieless shift#

As third-party cookies became less reliable, tracking did not disappear. It moved. Two shifts matter most for anyone thinking about cookie privacy today, and both can quietly undo the protection that cookie blocking provides.

The first is server-side tracking, where the tags that used to run in your browser instead run on a server the website controls. Because the data is collected first-party and then shared onward behind the scenes, it slips past browser cookie limits and ad blockers. It is worth knowing that this does not remove a site's legal duty to get consent, and privacy regulators note that it can make tracking harder for a visitor to see.

The second is fingerprinting, and it is the one to watch. Instead of storing a cookie, a tracker combines dozens of small signals about your device, such as your screen size, installed fonts, time zone, and browser configuration, into a value that is distinctive enough to recognise you again without saving anything at all. Regulators treat fingerprinting as more invasive than cookies precisely because you cannot see it, block it in the usual way, or clear it. When Google changed its advertising policy to allow fingerprinting from February 2025, the United Kingdom's data protection regulator publicly called the move irresponsible and stressed that fingerprinting is still bound by consent and transparency rules.

How to protect your cookie privacy#

What you can do depends on whether you are browsing the web or running a site. Both sides have a few concrete steps that make a real difference.

If you are browsing the web

• Choose a browser that blocks third-party cookies by default, such as Safari, Firefox, or Brave, or turn on third-party cookie blocking in Chrome's privacy settings.
• Turn on Global Privacy Control, which is built into Firefox, Brave, and DuckDuckGo and available as an extension elsewhere, so your opt-out reaches every site automatically.
• Use a private or incognito window when you do not want cookies kept, and clear your cookies periodically to reset any profiles built on them.
• Read the banner before you click. Choosing to reject non-essential cookies, or accepting only what you want, is the point of the choice being there.

If you run a website

• Keep third-party cookies and tracking tags to a minimum, and load non-essential ones only after a visitor has agreed.
• Set your own cookies with the right SameSite value so they are not exposed in cross-site contexts by accident.
• Honour opt-out signals like Global Privacy Control, and get valid consent before any non-essential cookie where the law requires it.
• Keep a clear cookie policy that matches what your site actually sets, and check regularly, since a single new plugin or tag can start loading trackers early.

If you run a site and want to see this from the outside, you can scan any page for free and watch which cookies and trackers it sets before and after consent, and whether a real consent mechanism is in place. For the security of the cookies themselves, such as whether login cookies carry their protective flags, the Cookie Security Checker and our guide to how to secure cookies go a level deeper.

FAQ#