Most cookies on a typical website do something you asked for: keep you logged in, remember your cart, store your language. Tracking cookies are different. They exist so that someone can measure you, follow you or target you. This guide explains what they are, how they work, which ones you will meet most often, what the law requires and how to check or block them. For the general mechanics of cookies and the main categories, start with our guide to what cookies are and how they work.
What are tracking cookies?
A tracking cookie is a small text file stored by your browser that contains a unique identifier, usually a random string such as GA1.1.1234567890.1700000000. Each time your browser sends a request to the domain that set the cookie, it sends the identifier back. The server can then link the new visit to the previous ones.
"Tracking cookie" is not a legal category. It is an everyday name for cookies whose purpose is to follow a user: most analytics cookies and almost all advertising cookies. Regulators prefer the broader word "trackers", because the same job can be done with local storage, tracking pixels or device fingerprinting. The legal rules apply to all of them.
What a tracking cookie does not contain is usually just as important. It rarely holds your name or email address. It holds a pseudonymous ID, and the data about you (pages viewed, ads clicked, purchases) sits on the server of the company that reads the cookie.
How do tracking cookies work?
Every tracking cookie follows the same cycle:
- A script or an embedded element on the page (an analytics tag, an ad pixel, a social widget) asks the browser to store a cookie with a new identifier.
- On the next page or the next visit, the browser sends that cookie back with each request to the same domain.
- The server records the event (page view, click, purchase) against the identifier.
- Over time, the events form a history: which pages you read, which campaign brought you, whether you converted.
What changes from one cookie to another is who can read it, and therefore how far the tracking reaches.
First-party tracking cookies
A first-party cookie is set on the domain you are visiting. Google Analytics, the Meta Pixel and the TikTok Pixel all write first-party cookies today: the cookie lives on example.com, but the script sends its value to Google, Meta or TikTok. Tracking stays limited to one site unless the provider matches the identifier with other data, such as a logged-in account.
Third-party tracking cookies
A third-party cookie is set by another domain, for example an ad server whose script or iframe is embedded on many sites. Because the browser sends the same cookie to that ad server from every site that embeds it, the network can follow one browser across the web and build an interest profile. This is the form of tracking that browsers restrict most. Safari and Firefox already block or isolate third-party cookies by default, while Chrome kept them; our article on Google Privacy Sandbox and third-party cookies explains that story.
Examples of tracking cookies
You will find the same names on thousands of sites. A few common examples, with the lifetimes their providers document:
_gaand_ga_<id>(Google Analytics): a client ID that recognizes the browser for 2 years by default, renewed at each visit. Our article on the _ga, _gid and _gat cookies goes into detail._gcl_au(Google Ads conversion linker): links ad clicks to conversions, 90 days.IDEon doubleclick.net: a Google advertising cookie set as a third party._fbpand_fbc(Meta Pixel): a browser ID and a click ID, about 90 days, explained in our guide to the _fbp and _fbc cookies._ttp(TikTok Pixel): an identifier for targeting and conversion measurement, 13 months.MUID,_uetsidand_uetvid(Microsoft Advertising UET tag): user and session identifiers for Bing ads.bcookie(LinkedIn): a browser identifier, 2 years.
Note the pattern: a unique ID, a long lifetime and a third party that receives the value. That combination is what makes a cookie a tracking cookie.
Tracking cookies vs other cookies
Two comparisons come up often.
A session cookie is deleted when the browser closes. A session cookie can still carry a tracking ID, but most tracking cookies are persistent, precisely because their value lies in recognizing you days or months later.
Strictly necessary cookies are the opposite of tracking cookies. They exist to deliver a service you requested, such as a login or a cart, and they are the only cookies exempt from consent. A cookie that measures or targets you never qualifies, even if the business considers analytics essential.
Are tracking cookies bad or dangerous?
Tracking cookies are not malware. A cookie is passive text: it cannot run code, read your files or install anything. Antivirus tools that flag "tracking cookies" are pointing at a privacy issue, not an infection.
The concern is what the data enables. A single site measuring its own audience is limited in scope. A network that sees the same identifier on thousands of sites can infer interests, habits and sometimes sensitive traits (health, finances, politics) from the pages you visit. Those profiles feed ad targeting and can be shared with other companies. That is why European law treats tracking as something the user must choose, not something that happens by default.
Are tracking cookies legal? GDPR and ePrivacy rules
In the EU, Article 5(3) of the ePrivacy Directive requires consent before any information is stored on or read from a user's device, unless it is strictly necessary for a service the user requested. Tracking cookies never meet that exception, so they need consent. The GDPR defines what valid consent is: free, specific, informed, unambiguous, given by a clear action and as easy to withdraw as to give.
In practice, a compliant website must:
- not set any tracking cookie before the visitor makes a choice;
- offer a Reject option as easy to use as Accept;
- name the purposes and the third parties involved;
- respect a refusal, and let visitors change their mind later.
Regulators enforce these rules. In December 2021, the CNIL fined Google 150 million euros and Facebook 60 million euros because refusing cookies on their sites took more clicks than accepting them. The UK ICO applies the same logic under PECR.
Before you go further, check what your own site does. Scan your site for free and see in 30 seconds which cookies it sets before any consent.
The technical side matters as much as the banner. A banner that asks the question while the Google Analytics tag already fires on page load is still non-compliant. A CMP such as FlowConsent, for example, holds every analytics and advertising script until the visitor accepts the matching category, and passes the choice to Google tags through Consent Mode v2.
How to check if a website uses tracking cookies
You can see the cookies a site sets in a few minutes:
- Open the site in a private window, without clicking the banner.
- Open the developer tools (F12 or right click, then Inspect) and go to Application, then Cookies, in Chrome or Edge, or Storage in Firefox.
- Look at each domain listed and at cookie names such as
_ga,_fbp,_gcl_auorIDE. Long expiry dates and random-looking values are strong signs of tracking. - Click Reject, reload the page and check again. No tracking cookie should appear.
The Network tab gives a second view: requests sent to google-analytics.com, facebook.com or doubleclick.net before consent mean that tracking starts too early. For a complete method, see our website cookie audit guide.
How to block or remove tracking cookies
As a visitor, you have several options:
- Refuse on the banner. On a compliant site, Reject prevents the tracking cookies from being set.
- Use your browser's protection. Safari's Intelligent Tracking Prevention and Firefox's Enhanced Tracking Protection block most third-party trackers by default. In Chrome, you can block third-party cookies in the privacy settings.
- Delete cookies regularly. Clearing cookies resets the identifiers, at the cost of being logged out of sites.
- Use a content blocker. Extensions that block tracking scripts stop the cookies at the source.
Deleting cookies does not stop fingerprinting, which recognizes a device without storing anything. Browser protections and refusing consent remain the most effective combination.
How FlowConsent handles tracking cookies
FlowConsent treats every tracking cookie as consent-based. Its automatic cookie scan finds the cookies your site actually sets, including those from embedded tools, and sorts them into categories such as analytics and marketing. Until the visitor accepts a category, the scripts that would set those cookies are blocked, and Google tags receive the choice through Consent Mode v2. Each decision is stored as an exportable proof of consent, hosted in Europe. Installation takes about ten minutes on Webflow, WordPress, Shopify, Wix, Framer or through GTM, and FlowConsent is free up to 25,000 sessions per month. The cookie declaration documentation shows how the scanned cookies become the list your visitors see.