> What are cookies and how do they work? First-party, third-party, session, persistent: every type of cookie explained, with what the law asks of websites.
>
> Canonical: https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work

[Regulation](https://www.flowconsent.com/en/blog?category=regulation)

# What are cookies? Types of cookies, how they work and what the law requires

By FlowConsent · Published 4 March 2026 · Updated 26 October 2026 · 13 min read

In short

Cookies are small text files that a website stores in your browser to remember information between visits: a login, a cart, a language, or an identifier used to measure or target you. There are several types of cookies: first-party or third-party (who sets them), session or persistent (how long they last), and essential, preference, analytics or advertising (what they are for). Essential cookies need no consent, but in Europe every other cookie may only be set after the visitor agrees, which is why websites show a cookie banner. This guide explains what cookies are, how they work, each type of cookie, what happens when you accept or reject them, and what the law asks of website owners.

This page is the reference article of our Cookies 101 series. Each section links to a dedicated article when you want to go further, from individual cookies such as `_ga` or `_fbp` to retention periods and cookieless alternatives.

## What are cookies? A simple definition

A web cookie (or HTTP cookie) is a small piece of text sent by a web server and stored by the browser on the user's device: computer, phone or tablet. When the user comes back to the same site, the browser automatically sends the cookie back to the server. This lets the site recognize the browser and remember information: preferred language, shopping cart contents, login session or a tracking identifier.

Cookies exist because the HTTP protocol is stateless: each request a browser sends is independent, and without a memory mechanism a site would forget you between two clicks. Cookies are the standard way to keep that state.

The term was coined in 1994 by Lou Montulli, a developer at Netscape, by analogy with the "magic cookie" of Unix programming, a token passed between programs. The mechanism was later standardized by the IETF; the current reference is RFC 6265.

In legal texts, the word covers more than the technical cookie. The European ePrivacy Directive speaks of any information stored on, or read from, the user's device. Regulators such as the CNIL use the broader term "trackers", which includes cookies, local storage, pixels and fingerprinting.

## How do cookies work?

### Step by step

1. You visit `example.com`. The server's response contains a `Set-Cookie` header, for example `Set-Cookie: lang=en; Max-Age=31536000; Secure; SameSite=Lax`.
2. Your browser stores the cookie, tied to the domain `example.com`.
3. On every following request to `example.com`, the browser adds a `Cookie: lang=en` header. The server reads it and shows the page in English.
4. JavaScript running on the page can also read and write cookies through `document.cookie`, unless the cookie is marked HttpOnly. This is how most analytics and advertising scripts create theirs.

### What a cookie contains

A cookie is made of a name and a value, plus attributes that tell the browser how to handle it:

- **Domain and Path:** which sites and pages receive the cookie.
- **Expires or Max-Age:** when the cookie is deleted. Without them, it is a session cookie.
- **Secure:** the cookie is only sent over HTTPS.
- **HttpOnly:** the cookie is invisible to JavaScript, which protects session cookies against theft by malicious scripts.
- **SameSite:** whether the cookie is sent with requests coming from other sites (`Strict`, `Lax` or `None`). Chrome treats cookies without this attribute as `Lax`.

The value is usually a random identifier rather than readable data. A Google Analytics cookie looks like `_ga=GA1.1.1234567890.1700000000`: a client identifier and a timestamp. Our article on [the \_ga, \_gid and \_gat cookies](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) breaks down what each one stores. Browsers must accept cookies of at least 4,096 bytes, so a cookie never holds a large file, and it contains no executable code.

## What are cookies used for?

Cookies serve three broad purposes:

- **Session management:** keeping you logged in, remembering your cart, protecting forms against fraud. Without these cookies, most websites would not work.
- **Personalization:** language, currency, region, dark mode, the products you viewed.
- **Tracking:** measuring audiences, attributing sales to an ad campaign, building profiles to show targeted advertising, retargeting you on other sites.

The first category serves the visitor directly. The last one mainly serves the site owner and its partners, and it is the one privacy law targets.

### Examples of cookies you will find on most sites

- `PHPSESSID` or `JSESSIONID`: a session identifier set by the server (PHP or Java) to keep you logged in during a visit. Strictly necessary.
- A cart cookie on an online shop, such as `cart` on Shopify: keeps the products you added. Strictly necessary.
- The consent cookie of the banner itself: stores your choice so the banner does not reappear. Strictly necessary.
- `__cf_bm`: set by Cloudflare to tell humans from bots. Strictly necessary for security.
- `_ga` and `_ga_<id>`: Google Analytics identifiers, kept up to two years by default. Analytics, consent required.
- `_fbp`: the Meta Pixel browser identifier, kept 90 days. Advertising, consent required.
- `IDE` on doubleclick.net: a Google advertising cookie set as a third party. Advertising, consent required.

Each of these has a name, a domain, a duration and a purpose: the four pieces of information your cookie policy must list.

## The types of cookies

Cookies are classified along three independent axes. A single cookie has a value on each: the `_ga` cookie, for instance, is first-party, persistent and used for analytics.

### First-party vs third-party cookies

A first-party cookie is set by the domain shown in the address bar. If you are on example.com, a cookie created for example.com is first-party, whether it was set by the server or by a script running on the page. These cookies serve site features, but also first-party analytics.

A third-party cookie is set for a different domain than the one you are visiting. If example.com embeds a script or an iframe from ad-network.com, which writes a cookie for ad-network.com, that cookie is third-party. Because the same third-party cookie is sent from every site embedding the network, it allows cross-site tracking. It is the type browsers and regulators scrutinize most. Our guide to [first-party vs third-party cookies](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) goes further: how browsers decide what counts as third-party, how to tell them apart and why both can need consent.

Safari (through Intelligent Tracking Prevention) and Firefox (through Total Cookie Protection) already block or isolate third-party cookies by default. Google Chrome long planned to phase them out, then abandoned that plan and keeps them enabled by default. Our article on [Google Privacy Sandbox and third-party cookies](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies) traces that story and what it means for consent.

### Session vs persistent cookies

A session cookie has no expiry date. It disappears when the browser session ends, typically when you close the browser. It is used to keep you logged in or keep your cart during a visit. Our guide to [what a session cookie is](https://www.flowconsent.com/en/blog/what-is-a-session-cookie) covers real examples, session restore in browsers and when these cookies are exempt from consent.

A persistent cookie has an expiry date and survives the closing of the browser, for minutes or for years. It remembers your preferences, keeps you signed in for weeks, or recognizes you on your next visit for measurement or advertising. Browsers now cap lifetimes: Chrome limits new cookies to 400 days, and Safari limits cookies created by JavaScript to 7 days at most.

Regulators also set maximum durations for consent-based trackers. The CNIL recommends 13 months, a rule explained in our article on [cookie retention and the 13-month rule](https://www.flowconsent.com/en/blog/cookie-retention-duration-gdpr-13-months).

### Types of cookies by purpose

This is the classification your cookie banner uses, and the one that decides whether consent is required:

- **Strictly necessary cookies:** authentication, security, load balancing, cart, storing the consent choice itself. They are exempt from consent. Our guide to [strictly necessary cookies](https://www.flowconsent.com/en/blog/strictly-necessary-cookies-examples) details the legal test, real cookie names and the cookies that are often wrongly placed in this category.
- **Preference (functional) cookies:** language, region, display options chosen by the user. They are exempt only when they are strictly needed for a service the user explicitly asked for; otherwise they require consent.
- **Analytics (statistics) cookies:** visits, pages viewed, time on site. They require consent, except under narrow exemptions for audience measurement strictly limited and configured accordingly.
- **Advertising (marketing) cookies:** targeting, retargeting, conversion tracking. They always require consent.

For a detailed breakdown with examples and the rules per category, read our [guide to the 4 GDPR cookie categories](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide).

### Other terms you will meet

- **Tracking cookies:** an informal name for cookies used to follow a user over time or across sites, usually analytics or advertising cookies. Our guide to [tracking cookies](https://www.flowconsent.com/en/blog/what-are-tracking-cookies) lists the most common ones and explains how to check or block them.
- **Advertising pixel cookies:** the Meta Pixel sets `_fbp` and `_fbc` to tie visits to ad clicks. Our article on [the \_fbp and \_fbc cookies](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained) explains them.
- **Secure and HttpOnly cookies:** not separate types, but cookies carrying these security attributes.
- **Zombie cookies:** cookies recreated from another storage after the user deletes them. Regulators treat this as circumventing the user's choice.

## Cookies and other trackers: local storage, pixels and fingerprinting

Cookies are not the only way to store or read information in a browser. Local storage and session storage keep data in the browser without sending it with each request. Tracking pixels are tiny images or scripts that send a request to a third party when a page or email loads. Our guide to [what a tracking pixel is](https://www.flowconsent.com/en/blog/what-is-a-tracking-pixel) explains how pixel tracking works and how it differs from a cookie. Fingerprinting combines browser and device characteristics to recognize a user without storing anything.

For the law, the technology does not matter. Article 5(3) of the ePrivacy Directive covers any storing of information on the user's device or access to information already stored there, and the European Data Protection Board confirmed in its Guidelines 2/2023 that it applies to pixels, local storage and similar techniques. Replacing a cookie with local storage does not remove the consent requirement. If you want to measure without consent, the options and their limits are in our [cookieless analytics guide](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide).

## Are cookies dangerous?

A cookie is a text file: it cannot run code, spread a virus or read files on your device. The risks come from elsewhere:

- **Privacy:** third-party and advertising cookies let companies build a profile of your browsing across many sites. That is why European law requires your consent.
- **Session theft:** if an attacker steals a session cookie (through a malicious script or an unsecured network), they can impersonate you on the site. The Secure and HttpOnly attributes exist to prevent this.
- **Shared devices:** on a shared computer, persistent login cookies keep accounts open for the next user.

Deleting cookies regularly limits tracking, at the cost of being logged out and losing your preferences.

## What happens when you accept or reject cookies?

When you click "Accept all", the site loads the analytics and advertising scripts it declared, and they set their cookies. Your visit is measured, and advertising networks can recognize your browser on other sites to show you targeted ads. Our article [should I accept cookies?](https://www.flowconsent.com/en/blog/should-i-accept-cookies) walks through each step after the click and when refusing is the better choice.

When you click "Reject", only strictly necessary cookies should be set. The site must still work: refusal cannot block access to the content, apart from narrow cases discussed in our article on [cookie walls and their alternatives](https://www.flowconsent.com/en/blog/cookie-wall-legal-alternatives). The site stores your refusal, usually in a necessary cookie, so the banner does not reappear on every page.

You can change your mind at any time: the site must offer a link or button to reopen the cookie settings, and withdrawing consent must be as easy as giving it. Many users click without reading because they see banners everywhere; our article on [consent fatigue](https://www.flowconsent.com/en/blog/consent-fatigue-visitors-ignore-cookie-banner) looks at why and what sites can do about it.

## How to view and delete cookies in your browser

- **Chrome:** Settings > Privacy and security > Third-party cookies to set the policy, and "Delete browsing data" to clear cookies. For a single site, click the icon left of the address bar, then "Cookies and site data".
- **Safari (Mac):** Settings > Privacy > Manage Website Data. On iPhone: Settings > Apps > Safari > Advanced > Website Data.
- **Firefox:** Settings > Privacy & Security > Cookies and Site Data > Manage Data.
- **Edge:** Settings > Cookies and site permissions > Manage and delete cookies and site data.

On a phone, cookies work exactly as on a computer: each browser and each in-app browser keeps its own. Apps also use advertising identifiers that cookie settings do not cover.

To see the cookies of the site you are on, open the developer tools (F12), then the Application tab (Chrome, Edge) or Storage tab (Firefox, Safari).

## What cookies mean for website owners

### The legal framework

In the European Union, two texts apply together. The ePrivacy Directive (Article 5(3)), transposed into each national law, requires prior consent for storing or reading any non-essential tracker. The GDPR defines what valid consent is: free, specific, informed, unambiguous, given by a clear positive action, and as easy to withdraw as to give. Our article on [the conditions of valid GDPR consent](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) details each one. The UK applies the same logic through PECR and the UK GDPR, under the supervision of the ICO.

Regulators enforce these rules. The CNIL in France, the AEPD in Spain and the German data protection authorities have fined companies for setting cookies before consent or for making refusal harder than acceptance; see our review of [CNIL cookie sanctions](https://www.flowconsent.com/en/blog/cnil-cookie-sanctions-real-cases). Outside Europe, laws differ: the CCPA in California works mostly on an opt-out basis, as explained in our [CCPA vs GDPR comparison](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences).

### What you need in practice

Not sure whether your own site needs a banner? Our article [do I need a cookie banner?](https://www.flowconsent.com/en/blog/do-i-need-cookie-banner-website) answers by case. If your site sets any non-essential cookie, you need:

- an inventory of every cookie and tracker your site sets, including those from embedded content;
- a [consent management platform](https://www.flowconsent.com/en/blog/what-is-consent-management-platform-cmp) and a [GDPR-compliant cookie banner](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) that blocks non-essential cookies until the visitor accepts, with a refusal as visible as acceptance;
- a [cookie policy](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide) listing each cookie, its purpose and its duration;
- [proof of consent](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store) you can show if a regulator asks.

The first step is always the inventory. Check in 30 seconds which cookies your site sets with the [free cookie scanner](https://www.flowconsent.com/en/scan): it lists each cookie, its domain and whether it appears before consent. For a deeper review, our [website cookie audit guide](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) gives the full method.

### Embedded content and common tools

Many cookies come from tools you did not write yourself:

- **YouTube videos** set cookies as soon as the player loads; our guide to [embedding videos with youtube-nocookie](https://www.flowconsent.com/en/blog/youtube-nocookie-embed-videos-without-cookies-gdpr) shows how to reduce them.
- **Google Analytics** sets first-party cookies but sends the data to Google; see [is Google Analytics GDPR compliant?](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant). If you use Google Ads too, the consent choice reaches Google tags through [Google Consent Mode v2](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide).
- **Matomo** can, under strict conditions, be configured to be exempt from consent; see [Matomo and cookies](https://www.flowconsent.com/en/blog/matomo-cookies-gdpr-do-you-need-banner).
- **Maps, chat widgets and social buttons** set third-party cookies that your banner must also cover.

## Common misconceptions about cookies

**"Cookies are viruses."** A cookie cannot execute code. The issue is how the data it enables is used.

**"First-party cookies never need consent."** The Google Analytics `_ga` cookie is first-party, yet it requires consent because its purpose is measurement and the data goes to Google. Purpose decides, not origin.

**"Session cookies are exempt."** A session cookie used for advertising still needs consent, even if it disappears when the browser closes. Lifespan does not decide either.

**"Replacing cookies with local storage avoids the banner."** It does not: the ePrivacy rule covers any storage on the device.

**"A banner is enough."** A banner that shows but lets cookies load before the choice is not compliant. Blocking before consent is the core requirement.

**"Only big sites are checked."** Regulators act on complaints and run checks on sites of every size.

## Checklist: managing cookies on your site

1. Scan your site to list every cookie and tracker, with its domain and lifespan.
2. Classify each cookie by origin (first-party or third-party), duration (session or persistent) and purpose.
3. Identify the strictly necessary cookies, the only ones exempt from consent.
4. Configure your CMP to block every non-essential cookie before consent.
5. Cover embedded content: videos, maps, widgets, social buttons.
6. Set retention periods within 13 months for consent-based trackers.
7. Publish a cookie policy and keep proof of each consent.
8. Test with the browser's developer tools that nothing non-essential is set before a choice, and re-scan whenever you add a script.

## How FlowConsent handles cookies on your site

FlowConsent starts where this article ends: with the inventory. Its automatic cookie scan detects the cookies and trackers your site actually sets, the cookie list shown to visitors is generated from your active services and their categories, and an alert flags any cookie the scan observes but your banner does not declare. The banner then blocks every non-essential script before consent, sends the choice to Google tags through Consent Mode v2, and stores an exportable proof of each consent, hosted in Europe. Installation takes about ten minutes on Webflow, WordPress, Shopify, Wix, Framer or through GTM, and FlowConsent is free up to 25,000 sessions per month. The [cookie declaration documentation](https://www.flowconsent.com/en/doc/cookie-declaration) explains how the inventory is kept up to date, and the [getting started guide](https://www.flowconsent.com/en/doc/getting-started) walks you through the setup.

[Back to the blog](https://www.flowconsent.com/en/blog)

Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fwhat-are-cookies-types-how-they-work) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fwhat-are-cookies-types-how-they-work)

Questions

## Common questions on this topic.

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### What are cookies in simple terms?

Cookies are small text files a website stores in your browser so it can remember you. Each time you return, your browser sends the cookie back, which lets the site keep you logged in, remember your cart or language, or recognize you for analytics and advertising. A cookie contains a name, a value and an expiry date, never executable code.

### What are the main types of cookies?

Cookies are classified in three ways. By origin: first-party cookies are set by the site you visit, third-party cookies by another domain. By duration: session cookies disappear when you close the browser, persistent cookies stay until their expiry date. By purpose: strictly necessary, preference, analytics and advertising cookies. Only strictly necessary cookies are exempt from consent in Europe.

### Should I accept or reject cookies?

It depends on what you are comfortable with. Accepting lets the site measure your visit and lets advertising networks recognize you across sites for targeted ads. Rejecting keeps only the cookies the site needs to work, and a compliant site must remain usable. You can change your choice later through the cookie settings link, usually in the site footer.

### Are cookies dangerous?

A cookie cannot run code or carry a virus: it is plain text. The risks are about privacy and security. Third-party and advertising cookies let companies profile your browsing across sites, which is why consent is required in Europe. A stolen session cookie can let an attacker access your account, which the Secure and HttpOnly attributes help prevent.

### Which cookies do not need consent?

Only cookies that are strictly necessary for a service the user explicitly asked for: login sessions, shopping carts, security and load balancing, and the cookie that stores the consent choice itself. Analytics cookies generally need consent, with narrow exemptions in some countries such as France. Advertising and social media cookies always need consent, whatever their origin or lifespan.

### How do I delete cookies?

In Chrome, open Settings, Privacy and security, then Delete browsing data. In Safari on Mac, go to Settings, Privacy, Manage Website Data; on iPhone, Settings, Apps, Safari, Advanced, Website Data. In Firefox, open Settings, Privacy and Security, Cookies and Site Data. Deleting cookies logs you out of sites and resets your preferences and cookie choices.

Read next

## Keep reading.

[All articles](https://www.flowconsent.com/en/blog)

[Comparisons · 22 October 2026](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies)

### [First-party vs third-party cookies: differences, examples and GDPR](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies)

[What separates first-party and third-party cookies, real examples of each, how Safari, Firefox and Chrome treat them in 2026, and why consent depends on purpose rather than domain.](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies)

[Read the article ](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies)·

[Marketing tools · 21 May 2026](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies)

### [Google Privacy Sandbox: Impact on Cookie Consent and Third-Party Cookies](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies)

[Chrome is keeping third-party cookies and Google has retired most Privacy Sandbox APIs. Here is what actually changed, and why your consent obligations under GDPR and ePrivacy stay exactly the same.](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies)

[Read the article ](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies)·

[Best practices · 11 October 2026](https://www.flowconsent.com/en/blog/what-is-a-session-cookie)

### [What is a session cookie? Definition, examples and consent rules](https://www.flowconsent.com/en/blog/what-is-a-session-cookie)

[What a session cookie is, how it works, how it differs from a persistent cookie, real examples, and when it needs consent under EU rules.](https://www.flowconsent.com/en/blog/what-is-a-session-cookie)

[Read the article](https://www.flowconsent.com/en/blog/what-is-a-session-cookie)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)