What are cookies? Types of cookies, how they work and what the law requires

This page is the reference article of our Cookies 101 series. Each section links to a dedicated article when you want to go further, from individual cookies such as _ga or _fbp to retention periods and cookieless alternatives.

What are cookies? A simple definition

A web cookie (or HTTP cookie) is a small piece of text sent by a web server and stored by the browser on the user's device: computer, phone or tablet. When the user comes back to the same site, the browser automatically sends the cookie back to the server. This lets the site recognize the browser and remember information: preferred language, shopping cart contents, login session or a tracking identifier.

Cookies exist because the HTTP protocol is stateless: each request a browser sends is independent, and without a memory mechanism a site would forget you between two clicks. Cookies are the standard way to keep that state.

The term was coined in 1994 by Lou Montulli, a developer at Netscape, by analogy with the "magic cookie" of Unix programming, a token passed between programs. The mechanism was later standardized by the IETF; the current reference is RFC 6265.

In legal texts, the word covers more than the technical cookie. The European ePrivacy Directive speaks of any information stored on, or read from, the user's device. Regulators such as the CNIL use the broader term "trackers", which includes cookies, local storage, pixels and fingerprinting.

How do cookies work?

Step by step

1. You visit example.com. The server's response contains a Set-Cookie header, for example Set-Cookie: lang=en; Max-Age=31536000; Secure; SameSite=Lax.
2. Your browser stores the cookie, tied to the domain example.com.
3. On every following request to example.com, the browser adds a Cookie: lang=en header. The server reads it and shows the page in English.
4. JavaScript running on the page can also read and write cookies through document.cookie, unless the cookie is marked HttpOnly. This is how most analytics and advertising scripts create theirs.

What a cookie contains

A cookie is made of a name and a value, plus attributes that tell the browser how to handle it:

• Domain and Path: which sites and pages receive the cookie.
• Expires or Max-Age: when the cookie is deleted. Without them, it is a session cookie.
• Secure: the cookie is only sent over HTTPS.
• HttpOnly: the cookie is invisible to JavaScript, which protects session cookies against theft by malicious scripts.
• SameSite: whether the cookie is sent with requests coming from other sites (Strict, Lax or None). Chrome treats cookies without this attribute as Lax.

The value is usually a random identifier rather than readable data. A Google Analytics cookie looks like _ga=GA1.1.1234567890.1700000000: a client identifier and a timestamp. Our article on the _ga, _gid and _gat cookies breaks down what each one stores. Browsers must accept cookies of at least 4,096 bytes, so a cookie never holds a large file, and it contains no executable code.

What are cookies used for?

Cookies serve three broad purposes:

• Session management: keeping you logged in, remembering your cart, protecting forms against fraud. Without these cookies, most websites would not work.
• Personalization: language, currency, region, dark mode, the products you viewed.
• Tracking: measuring audiences, attributing sales to an ad campaign, building profiles to show targeted advertising, retargeting you on other sites.

The first category serves the visitor directly. The last one mainly serves the site owner and its partners, and it is the one privacy law targets.

Examples of cookies you will find on most sites

• PHPSESSID or JSESSIONID: a session identifier set by the server (PHP or Java) to keep you logged in during a visit. Strictly necessary.
• A cart cookie on an online shop, such as cart on Shopify: keeps the products you added. Strictly necessary.
• The consent cookie of the banner itself: stores your choice so the banner does not reappear. Strictly necessary.
• __cf_bm: set by Cloudflare to tell humans from bots. Strictly necessary for security.
• _ga and _ga_<id>: Google Analytics identifiers, kept up to two years by default. Analytics, consent required.
• _fbp: the Meta Pixel browser identifier, kept 90 days. Advertising, consent required.
• IDE on doubleclick.net: a Google advertising cookie set as a third party. Advertising, consent required.

Each of these has a name, a domain, a duration and a purpose: the four pieces of information your cookie policy must list.

The types of cookies

Cookies are classified along three independent axes. A single cookie has a value on each: the _ga cookie, for instance, is first-party, persistent and used for analytics.

First-party vs third-party cookies

A first-party cookie is set by the domain shown in the address bar. If you are on example.com, a cookie created for example.com is first-party, whether it was set by the server or by a script running on the page. These cookies serve site features, but also first-party analytics.

A third-party cookie is set for a different domain than the one you are visiting. If example.com embeds a script or an iframe from ad-network.com, which writes a cookie for ad-network.com, that cookie is third-party. Because the same third-party cookie is sent from every site embedding the network, it allows cross-site tracking. It is the type browsers and regulators scrutinize most. Our guide to first-party vs third-party cookies goes further: how browsers decide what counts as third-party, how to tell them apart and why both can need consent.

Safari (through Intelligent Tracking Prevention) and Firefox (through Total Cookie Protection) already block or isolate third-party cookies by default. Google Chrome long planned to phase them out, then abandoned that plan and keeps them enabled by default. Our article on Google Privacy Sandbox and third-party cookies traces that story and what it means for consent.

Session vs persistent cookies

A session cookie has no expiry date. It disappears when the browser session ends, typically when you close the browser. It is used to keep you logged in or keep your cart during a visit. Our guide to what a session cookie is covers real examples, session restore in browsers and when these cookies are exempt from consent.

A persistent cookie has an expiry date and survives the closing of the browser, for minutes or for years. It remembers your preferences, keeps you signed in for weeks, or recognizes you on your next visit for measurement or advertising. Browsers now cap lifetimes: Chrome limits new cookies to 400 days, and Safari limits cookies created by JavaScript to 7 days at most.

Regulators also set maximum durations for consent-based trackers. The CNIL recommends 13 months, a rule explained in our article on cookie retention and the 13-month rule.

Types of cookies by purpose

This is the classification your cookie banner uses, and the one that decides whether consent is required:

• Strictly necessary cookies: authentication, security, load balancing, cart, storing the consent choice itself. They are exempt from consent. Our guide to strictly necessary cookies details the legal test, real cookie names and the cookies that are often wrongly placed in this category.
• Preference (functional) cookies: language, region, display options chosen by the user. They are exempt only when they are strictly needed for a service the user explicitly asked for; otherwise they require consent.
• Analytics (statistics) cookies: visits, pages viewed, time on site. They require consent, except under narrow exemptions for audience measurement strictly limited and configured accordingly.
• Advertising (marketing) cookies: targeting, retargeting, conversion tracking. They always require consent.

For a detailed breakdown with examples and the rules per category, read our guide to the 4 GDPR cookie categories.

Other terms you will meet

• Tracking cookies: an informal name for cookies used to follow a user over time or across sites, usually analytics or advertising cookies. Our guide to tracking cookies lists the most common ones and explains how to check or block them.
• Advertising pixel cookies: the Meta Pixel sets _fbp and _fbc to tie visits to ad clicks. Our article on the _fbp and _fbc cookies explains them.
• Secure and HttpOnly cookies: not separate types, but cookies carrying these security attributes.
• Zombie cookies: cookies recreated from another storage after the user deletes them. Regulators treat this as circumventing the user's choice.

Cookies and other trackers: local storage, pixels and fingerprinting

Cookies are not the only way to store or read information in a browser. Local storage and session storage keep data in the browser without sending it with each request. Tracking pixels are tiny images or scripts that send a request to a third party when a page or email loads. Our guide to what a tracking pixel is explains how pixel tracking works and how it differs from a cookie. Fingerprinting combines browser and device characteristics to recognize a user without storing anything.

For the law, the technology does not matter. Article 5(3) of the ePrivacy Directive covers any storing of information on the user's device or access to information already stored there, and the European Data Protection Board confirmed in its Guidelines 2/2023 that it applies to pixels, local storage and similar techniques. Replacing a cookie with local storage does not remove the consent requirement. If you want to measure without consent, the options and their limits are in our cookieless analytics guide.

Are cookies dangerous?

A cookie is a text file: it cannot run code, spread a virus or read files on your device. The risks come from elsewhere:

• Privacy: third-party and advertising cookies let companies build a profile of your browsing across many sites. That is why European law requires your consent.
• Session theft: if an attacker steals a session cookie (through a malicious script or an unsecured network), they can impersonate you on the site. The Secure and HttpOnly attributes exist to prevent this.
• Shared devices: on a shared computer, persistent login cookies keep accounts open for the next user.

Deleting cookies regularly limits tracking, at the cost of being logged out and losing your preferences.

What happens when you accept or reject cookies?

When you click "Accept all", the site loads the analytics and advertising scripts it declared, and they set their cookies. Your visit is measured, and advertising networks can recognize your browser on other sites to show you targeted ads. Our article should I accept cookies? walks through each step after the click and when refusing is the better choice.

When you click "Reject", only strictly necessary cookies should be set. The site must still work: refusal cannot block access to the content, apart from narrow cases discussed in our article on cookie walls and their alternatives. The site stores your refusal, usually in a necessary cookie, so the banner does not reappear on every page.

You can change your mind at any time: the site must offer a link or button to reopen the cookie settings, and withdrawing consent must be as easy as giving it. Many users click without reading because they see banners everywhere; our article on consent fatigue looks at why and what sites can do about it.

How to view and delete cookies in your browser

• Chrome: Settings > Privacy and security > Third-party cookies to set the policy, and "Delete browsing data" to clear cookies. For a single site, click the icon left of the address bar, then "Cookies and site data".
• Safari (Mac): Settings > Privacy > Manage Website Data. On iPhone: Settings > Apps > Safari > Advanced > Website Data.
• Firefox: Settings > Privacy & Security > Cookies and Site Data > Manage Data.
• Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data.

On a phone, cookies work exactly as on a computer: each browser and each in-app browser keeps its own. Apps also use advertising identifiers that cookie settings do not cover.

To see the cookies of the site you are on, open the developer tools (F12), then the Application tab (Chrome, Edge) or Storage tab (Firefox, Safari).

What cookies mean for website owners

The legal framework

In the European Union, two texts apply together. The ePrivacy Directive (Article 5(3)), transposed into each national law, requires prior consent for storing or reading any non-essential tracker. The GDPR defines what valid consent is: free, specific, informed, unambiguous, given by a clear positive action, and as easy to withdraw as to give. Our article on the conditions of valid GDPR consent details each one. The UK applies the same logic through PECR and the UK GDPR, under the supervision of the ICO.

Regulators enforce these rules. The CNIL in France, the AEPD in Spain and the German data protection authorities have fined companies for setting cookies before consent or for making refusal harder than acceptance; see our review of CNIL cookie sanctions. Outside Europe, laws differ: the CCPA in California works mostly on an opt-out basis, as explained in our CCPA vs GDPR comparison.

What you need in practice

Not sure whether your own site needs a banner? Our article do I need a cookie banner? answers by case. If your site sets any non-essential cookie, you need:

• an inventory of every cookie and tracker your site sets, including those from embedded content;
• a consent management platform and a GDPR-compliant cookie banner that blocks non-essential cookies until the visitor accepts, with a refusal as visible as acceptance;
• a cookie policy listing each cookie, its purpose and its duration;
• proof of consent you can show if a regulator asks.

The first step is always the inventory. Check in 30 seconds which cookies your site sets with the free cookie scanner: it lists each cookie, its domain and whether it appears before consent. For a deeper review, our website cookie audit guide gives the full method.

Embedded content and common tools

Many cookies come from tools you did not write yourself:

• YouTube videos set cookies as soon as the player loads; our guide to embedding videos with youtube-nocookie shows how to reduce them.
• Google Analytics sets first-party cookies but sends the data to Google; see is Google Analytics GDPR compliant?. If you use Google Ads too, the consent choice reaches Google tags through Google Consent Mode v2.
• Matomo can, under strict conditions, be configured to be exempt from consent; see Matomo and cookies.
• Maps, chat widgets and social buttons set third-party cookies that your banner must also cover.

Common misconceptions about cookies

"Cookies are viruses." A cookie cannot execute code. The issue is how the data it enables is used.

"First-party cookies never need consent." The Google Analytics _ga cookie is first-party, yet it requires consent because its purpose is measurement and the data goes to Google. Purpose decides, not origin.

"Session cookies are exempt." A session cookie used for advertising still needs consent, even if it disappears when the browser closes. Lifespan does not decide either.

"Replacing cookies with local storage avoids the banner." It does not: the ePrivacy rule covers any storage on the device.

"A banner is enough." A banner that shows but lets cookies load before the choice is not compliant. Blocking before consent is the core requirement.

"Only big sites are checked." Regulators act on complaints and run checks on sites of every size.

Checklist: managing cookies on your site

1. Scan your site to list every cookie and tracker, with its domain and lifespan.
2. Classify each cookie by origin (first-party or third-party), duration (session or persistent) and purpose.
3. Identify the strictly necessary cookies, the only ones exempt from consent.
4. Configure your CMP to block every non-essential cookie before consent.
5. Cover embedded content: videos, maps, widgets, social buttons.
6. Set retention periods within 13 months for consent-based trackers.
7. Publish a cookie policy and keep proof of each consent.
8. Test with the browser's developer tools that nothing non-essential is set before a choice, and re-scan whenever you add a script.

How FlowConsent handles cookies on your site

FlowConsent starts where this article ends: with the inventory. Its automatic cookie scan detects the cookies and trackers your site actually sets, the cookie list shown to visitors is generated from your active services and their categories, and an alert flags any cookie the scan observes but your banner does not declare. The banner then blocks every non-essential script before consent, sends the choice to Google tags through Consent Mode v2, and stores an exportable proof of each consent, hosted in Europe. Installation takes about ten minutes on Webflow, WordPress, Shopify, Wix, Framer or through GTM, and FlowConsent is free up to 25,000 sessions per month. The cookie declaration documentation explains how the inventory is kept up to date, and the getting started guide walks you through the setup.