"First-party" and "third-party" are among the first terms you meet when you look at cookies, and they are often misread. Many people assume first-party means harmless and third-party means illegal. Neither is true. This guide explains what each term means technically, how browsers treat them in 2026, how to tell them apart in practice, and what they change (and do not change) for consent. For the wider picture of cookie types, read our guide on what cookies are and how they work.
First-party vs third-party cookies: what is the difference?
First-party cookies
A first-party cookie is set for the domain shown in the address bar. If you are on shop.example, any cookie written for shop.example is first-party, whether it comes from the server in an HTTP response or from a script running on the page.
First-party cookies power the basics: keeping you logged in, remembering a basket, storing a language choice. But they are also used for analytics and advertising. The Google Analytics _ga cookie and the Meta _fbp cookie are both first-party: they live on your domain, yet the script that writes them sends their value to Google or Meta.
Third-party cookies
A third-party cookie is set for a different domain from the one you are visiting. When shop.example loads a script, an image or an iframe from ads.network, and that resource writes a cookie for ads.network, the cookie is third-party.
The key property is reach. The browser sends the same ads.network cookie every time any site loads a resource from ads.network. If that network is embedded on thousands of sites, it can recognise one browser everywhere and build a browsing profile. This is what people usually mean by "third-party tracking", and our article on tracking cookies shows how those profiles are assembled.
Examples of first-party and third-party cookies
Typical first-party cookies:
- a session cookie such as
PHPSESSIDthat keeps you logged in (see what a session cookie is); - a cart or language cookie set by your CMS or shop;
_gaand_ga_<ID>from Google Analytics 4;_fbpfrom the Meta Pixel and_gcl_aufrom Google Ads conversion tracking;- the cookie in which your consent banner stores the visitor's choice.
Typical third-party cookies:
IDEon doubleclick.net, used by Google's advertising services;- cookies set by a YouTube or Vimeo player embedded in an iframe;
- cookies from social widgets, such as the
frcookie on facebook.com; - cookies from chat, review or comment widgets loaded from their own domain.
Notice that the same vendor can appear in both lists. Google and Meta moved much of their measurement to first-party cookies precisely because browsers restrict third-party ones.
How browsers decide what is first-party
Browsers do not compare full host names. They compare "sites": the scheme plus the registrable domain. So blog.example.com and www.example.com are the same site, and a cookie shared between them is first-party. A cookie for example.net, loaded from example.com, is third-party.
Three mechanisms then shape what a third-party cookie can do:
- SameSite. Since Chrome 80 in 2020, a cookie without a SameSite attribute is treated as
SameSite=Laxand is not sent in most cross-site requests. A cookie meant to work as third-party must declareSameSite=Noneand theSecureflag. - Blocking. Safari has blocked third-party cookies by default since March 2020 through Intelligent Tracking Prevention. Chrome blocks them by default in Incognito mode only.
- Partitioning. Firefox's Total Cookie Protection, on by default for all users since 2022, gives each site its own cookie jar: a third-party cookie set while you are on site A is not visible when the same service loads on site B. Chrome supports a similar opt-in model called CHIPS, where a service marks its cookie as
Partitioned.
Safari also limits some first-party cookies. Cookies written by JavaScript through document.cookie are capped at seven days, which is why analytics tools sometimes see returning visitors as new in Safari.
How to tell if a cookie is first-party or third-party
Open your browser's developer tools (F12, or Cmd + Option + I on a Mac), go to the Application tab in Chrome or Edge, or the Storage tab in Firefox and Safari, and look at the Domain column. If the domain matches the site in your address bar (with or without a leading dot or a subdomain), the cookie is first-party. Anything else is third-party. Our step-by-step guide on how to check cookies on a website covers each browser.
Two caveats. First, the domain tells you who can read the cookie, not who receives the data: _ga is first-party but feeds Google Analytics. Second, run the check in a private window before touching the banner, so you see what the site sets without your consent.
Doing this page by page gets tedious on a real site. Check in 30 seconds which cookies your site sets, first-party and third-party, with the free cookie scanner.
Consent tools usually make the distinction visible for you. In FlowConsent, for example, every entry in the cookie list shown to visitors carries a first-party or third-party type, so the declaration matches what the browser actually stores.
Are third-party cookies being phased out?
Not everywhere. Safari and Firefox already restrict them, as described above. Google long planned to remove them from Chrome, then reversed course: in July 2024 it dropped the deprecation, in April 2025 it also dropped the planned choice prompt, and in October 2025 it retired most Privacy Sandbox technologies. In standard Chrome, third-party cookies stay enabled unless the user turns them off. Our article on Google Privacy Sandbox and third-party cookies tells that story in detail.
In practice, your audience is split. A third-party cookie may work for your Chrome visitors and not for your Safari visitors, so attribution gaps are normal. The answer is not a workaround: fingerprinting and other replacements fall under the same consent rules.
First-party vs third-party cookies under GDPR and ePrivacy
Consent depends on purpose, not on the domain
Article 5(3) of the ePrivacy Directive requires consent before storing or reading information on a device, unless it is strictly necessary for a service the user asked for. That rule does not mention first or third parties. A first-party analytics or advertising cookie needs consent just as a third-party one does. A third-party cookie can also be exempt, for instance a load-balancing cookie set by a payment provider during checkout.
Regulators confirm this reading. In December 2020, the CNIL fined Google a total of 100 million euros, partly because advertising cookies were placed automatically on visitors to google.fr, Google's own site. The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3) also make clear that the rule covers any access to the device, whoever performs it.
When cookies contain or are linked to personal data, the GDPR applies on top: valid consent, information, and records you can show.
The Spanish nuance: who uses the data
The Spanish authority, the AEPD, adds a useful legal angle in its cookie guide. A cookie is "own" (first-party) when it is sent from a domain managed by the publisher. If a cookie is served from your domain but the information is managed by a third party that uses it for its own purposes, the AEPD does not treat it as first-party. Under that reading, a cookie such as _fbp, set on your domain but used by Meta for its own purposes, should be presented to visitors as a third party's cookie.
Who is responsible for third-party cookies?
You are, at least in part. In Fashion ID (C-40/17, July 2019), the Court of Justice held that a site embedding a Facebook "Like" button is a joint controller with Facebook for the collection and transmission of visitors' data. Embedding a third-party script is a decision you make, so blocking it until consent is your job, not the vendor's.
Should you accept or block third-party cookies?
As a visitor, blocking third-party cookies in your browser settings rarely breaks anything important and cuts most cross-site tracking. Some embedded services (logins through another domain, certain payment or chat widgets) can need them, and you can allow exceptions per site. First-party cookies are a different matter: blocking all of them would log you out everywhere. Refusing non-essential cookies on the banner is the targeted option. Our article should I accept cookies? explains what each choice does.
As a site owner, keep this checklist:
- List every cookie, with its domain, and mark it first-party or third-party.
- Classify each one by purpose: necessary, preferences, analytics, marketing.
- Block every non-essential script, first-party or third-party, until the visitor accepts.
- Name the third parties that receive data in your banner and cookie policy.
- Re-scan after each new tag, plugin or embed.
How FlowConsent handles first-party and third-party cookies
FlowConsent blocks non-essential scripts before consent, whatever domain their cookies end up on, and passes the visitor's choice to Google through Consent Mode v2. The cookie list shown in the banner is generated from your active services, and each entry carries a first-party or third-party type; you add your own first-party cookies by hand. The automatic scan then compares what your pages really set with what you declare and flags any undeclared cookie with its domain and type. The cookie declaration documentation shows how it works. FlowConsent is free up to 25,000 sessions per month, is hosted in Europe and installs in about ten minutes.