> First-party vs third-party cookies explained: how they differ, real examples, how browsers treat them in 2026 and when GDPR consent is needed. > > Canonical: https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies [Comparisons](https://www.flowconsent.com/en/blog?category=comparisons) # First-party vs third-party cookies: differences, examples and GDPR By Roland Vekemans · Published 22 October 2026 · 7 min read In short First-party vs third-party cookies: the difference is who sets them relative to the site in your address bar. A first-party cookie belongs to the site you are visiting; a third-party cookie belongs to another domain loaded on that page, such as an ad network or an embedded video player. Third-party cookies can follow you across sites, which is why Safari and Firefox block or isolate them while Chrome still allows them by default. Under EU law, the label does not decide whether you need consent: the purpose of the cookie does. "First-party" and "third-party" are among the first terms you meet when you look at cookies, and they are often misread. Many people assume first-party means harmless and third-party means illegal. Neither is true. This guide explains what each term means technically, how browsers treat them in 2026, how to tell them apart in practice, and what they change (and do not change) for consent. For the wider picture of cookie types, read our guide on [what cookies are and how they work](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work). ## First-party vs third-party cookies: what is the difference? ### First-party cookies A first-party cookie is set for the domain shown in the address bar. If you are on shop.example, any cookie written for shop.example is first-party, whether it comes from the server in an HTTP response or from a script running on the page. First-party cookies power the basics: keeping you logged in, remembering a basket, storing a language choice. But they are also used for analytics and advertising. The Google Analytics `_ga` cookie and the Meta `_fbp` cookie are both first-party: they live on your domain, yet the script that writes them sends their value to Google or Meta. ### Third-party cookies A third-party cookie is set for a different domain from the one you are visiting. When shop.example loads a script, an image or an iframe from ads.network, and that resource writes a cookie for ads.network, the cookie is third-party. The key property is reach. The browser sends the same ads.network cookie every time any site loads a resource from ads.network. If that network is embedded on thousands of sites, it can recognise one browser everywhere and build a browsing profile. This is what people usually mean by "third-party tracking", and our article on [tracking cookies](https://www.flowconsent.com/en/blog/what-are-tracking-cookies) shows how those profiles are assembled. ## Examples of first-party and third-party cookies Typical first-party cookies: - a session cookie such as `PHPSESSID` that keeps you logged in (see [what a session cookie is](https://www.flowconsent.com/en/blog/what-is-a-session-cookie)); - a cart or language cookie set by your CMS or shop; - `_ga` and `_ga_` from Google Analytics 4; - `_fbp` from the Meta Pixel and `_gcl_au` from Google Ads conversion tracking; - the cookie in which your consent banner stores the visitor's choice. Typical third-party cookies: - `IDE` on doubleclick.net, used by Google's advertising services; - cookies set by a YouTube or Vimeo player embedded in an iframe; - cookies from social widgets, such as the `fr` cookie on facebook.com; - cookies from chat, review or comment widgets loaded from their own domain. Notice that the same vendor can appear in both lists. Google and Meta moved much of their measurement to first-party cookies precisely because browsers restrict third-party ones. ## How browsers decide what is first-party Browsers do not compare full host names. They compare "sites": the scheme plus the registrable domain. So blog.example.com and www\.example.com are the same site, and a cookie shared between them is first-party. A cookie for example.net, loaded from example.com, is third-party. Three mechanisms then shape what a third-party cookie can do: - **SameSite.** Since Chrome 80 in 2020, a cookie without a SameSite attribute is treated as `SameSite=Lax` and is not sent in most cross-site requests. A cookie meant to work as third-party must declare `SameSite=None` and the `Secure` flag. - **Blocking.** Safari has blocked third-party cookies by default since March 2020 through Intelligent Tracking Prevention. Chrome blocks them by default in Incognito mode only. - **Partitioning.** Firefox's Total Cookie Protection, on by default for all users since 2022, gives each site its own cookie jar: a third-party cookie set while you are on site A is not visible when the same service loads on site B. Chrome supports a similar opt-in model called CHIPS, where a service marks its cookie as `Partitioned`. Safari also limits some first-party cookies. Cookies written by JavaScript through `document.cookie` are capped at seven days, which is why analytics tools sometimes see returning visitors as new in Safari. ## How to tell if a cookie is first-party or third-party Open your browser's developer tools (F12, or Cmd + Option + I on a Mac), go to the Application tab in Chrome or Edge, or the Storage tab in Firefox and Safari, and look at the Domain column. If the domain matches the site in your address bar (with or without a leading dot or a subdomain), the cookie is first-party. Anything else is third-party. Our step-by-step guide on [how to check cookies on a website](https://www.flowconsent.com/en/blog/how-to-check-cookies-on-a-website) covers each browser. Two caveats. First, the domain tells you who can read the cookie, not who receives the data: `_ga` is first-party but feeds Google Analytics. Second, run the check in a private window before touching the banner, so you see what the site sets without your consent. Doing this page by page gets tedious on a real site. **Check in 30 seconds which cookies your site sets, first-party and third-party, with the** [**free cookie scanner**](https://www.flowconsent.com/en/scan)**.** Consent tools usually make the distinction visible for you. In FlowConsent, for example, every entry in the cookie list shown to visitors carries a first-party or third-party type, so the declaration matches what the browser actually stores. ## Are third-party cookies being phased out? Not everywhere. Safari and Firefox already restrict them, as described above. Google long planned to remove them from Chrome, then reversed course: in July 2024 it dropped the deprecation, in April 2025 it also dropped the planned choice prompt, and in October 2025 it retired most Privacy Sandbox technologies. In standard Chrome, third-party cookies stay enabled unless the user turns them off. Our article on [Google Privacy Sandbox and third-party cookies](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies) tells that story in detail. In practice, your audience is split. A third-party cookie may work for your Chrome visitors and not for your Safari visitors, so attribution gaps are normal. The answer is not a workaround: fingerprinting and other replacements fall under the same consent rules. ## First-party vs third-party cookies under GDPR and ePrivacy ### Consent depends on purpose, not on the domain Article 5(3) of the [ePrivacy Directive](https://www.flowconsent.com/en/laws/eprivacy-directive) requires consent before storing or reading information on a device, unless it is strictly necessary for a service the user asked for. That rule does not mention first or third parties. A first-party analytics or advertising cookie needs consent just as a third-party one does. A third-party cookie can also be exempt, for instance a load-balancing cookie set by a payment provider during checkout. Regulators confirm this reading. In December 2020, the CNIL fined Google a total of 100 million euros, partly because advertising cookies were placed automatically on visitors to google.fr, Google's own site. The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3) also make clear that the rule covers any access to the device, whoever performs it. When cookies contain or are linked to personal data, the [GDPR](https://www.flowconsent.com/en/laws/gdpr) applies on top: valid consent, information, and records you can show. ### The Spanish nuance: who uses the data The Spanish authority, the AEPD, adds a useful legal angle in its cookie guide. A cookie is "own" (first-party) when it is sent from a domain managed by the publisher. If a cookie is served from your domain but the information is managed by a third party that uses it for its own purposes, the AEPD does not treat it as first-party. Under that reading, a cookie such as `_fbp`, set on your domain but used by Meta for its own purposes, should be presented to visitors as a third party's cookie. ### Who is responsible for third-party cookies? You are, at least in part. In Fashion ID (C-40/17, July 2019), the Court of Justice held that a site embedding a Facebook "Like" button is a joint controller with Facebook for the collection and transmission of visitors' data. Embedding a third-party script is a decision you make, so blocking it until consent is your job, not the vendor's. ## Should you accept or block third-party cookies? As a visitor, blocking third-party cookies in your browser settings rarely breaks anything important and cuts most cross-site tracking. Some embedded services (logins through another domain, certain payment or chat widgets) can need them, and you can allow exceptions per site. First-party cookies are a different matter: blocking all of them would log you out everywhere. Refusing non-essential cookies on the banner is the targeted option. Our article [should I accept cookies?](https://www.flowconsent.com/en/blog/should-i-accept-cookies) explains what each choice does. As a site owner, keep this checklist: 1. List every cookie, with its domain, and mark it first-party or third-party. 2. Classify each one by purpose: necessary, preferences, analytics, marketing. 3. Block every non-essential script, first-party or third-party, until the visitor accepts. 4. Name the third parties that receive data in your banner and cookie policy. 5. Re-scan after each new tag, plugin or embed. ## How FlowConsent handles first-party and third-party cookies FlowConsent blocks non-essential scripts before consent, whatever domain their cookies end up on, and passes the visitor's choice to Google through Consent Mode v2. The cookie list shown in the banner is generated from your active services, and each entry carries a first-party or third-party type; you add your own first-party cookies by hand. The automatic scan then compares what your pages really set with what you declare and flags any undeclared cookie with its domain and type. The [cookie declaration documentation](https://www.flowconsent.com/en/doc/cookie-declaration) shows how it works. FlowConsent is free up to 25,000 sessions per month, is hosted in Europe and installs in about ten minutes. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Ffirst-party-vs-third-party-cookies) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Ffirst-party-vs-third-party-cookies) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### How can you tell if a cookie is first-party or third-party? Open your browser's developer tools (F12), go to the Application tab in Chrome or Edge or the Storage tab in Firefox and Safari, and read the Domain column. If the cookie's domain matches the site in the address bar, including its subdomains, it is first-party. Any other domain means it is third-party. Remember that a first-party cookie such as \_ga can still send data to another company. ### Should I accept first-party cookies? First-party cookies that keep you logged in, hold your basket or remember your language are needed for the site to work, and the banner does not ask about them. Other first-party cookies serve analytics or advertising, and those depend on your choice. Accepting them is not dangerous, but refusing is your right: a compliant site must work normally after you click Reject all. ### Should I block third-party cookies? Blocking third-party cookies in your browser settings stops most cross-site tracking and rarely breaks anything important. Safari already blocks them by default and Firefox isolates them per site. A few services, such as logins handled by another domain or some payment and chat widgets, may need them, so you can allow exceptions for specific sites in your browser settings. ### Are third-party cookies being phased out? Only in some browsers. Safari has blocked them by default since 2020 and Firefox partitions them per site. Google planned to remove them from Chrome but abandoned that plan in 2024, dropped the replacement choice prompt in April 2025 and retired most Privacy Sandbox technologies in October 2025. Standard Chrome still accepts third-party cookies unless the user turns them off. ### Do first-party cookies need consent under GDPR? It depends on their purpose, not on the domain. Article 5(3) of the ePrivacy Directive requires consent for any cookie that is not strictly necessary for the service the user requested. A first-party analytics or advertising cookie such as \_ga or \_fbp therefore needs consent, while a first-party login or basket cookie does not. The GDPR then adds its own rules when personal data is involved. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Marketing tools · 21 May 2026](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies) ### [Google Privacy Sandbox: Impact on Cookie Consent and Third-Party Cookies](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies) [Chrome is keeping third-party cookies and Google has retired most Privacy Sandbox APIs. Here is what actually changed, and why your consent obligations under GDPR and ePrivacy stay exactly the same.](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies) [Read the article ](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies)· [Regulation · 9 March 2026](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences) ### [CCPA vs GDPR: the real differences for cookies](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences) [CCPA and GDPR handle cookies differently. Opt-in vs opt-out, penalties, geographic scope: here is what changes for your website.](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences) [Read the article ](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences)· [Best practices · 16 October 2026](https://www.flowconsent.com/en/blog/what-are-tracking-cookies) ### [Tracking cookies: what they are, examples and how to block them](https://www.flowconsent.com/en/blog/what-are-tracking-cookies) [What tracking cookies are, how they follow you across visits and sites, common examples like \_ga and \_fbp, what the law requires and how to check or block them.](https://www.flowconsent.com/en/blog/what-are-tracking-cookies) [Read the article](https://www.flowconsent.com/en/blog/what-are-tracking-cookies) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)