HTTP Cookie

An HTTP cookie, often simply called a cookie, is a small piece of data that a website sends to a visitor’s browser, which stores it and sends it back to that same website on later visits, letting the website remember information about that visitor across what would otherwise be a series of completely separate, disconnected page loads. This matters because the underlying protocol browsers use to communicate with websites was designed to be stateless, treating every single page request independently with no built-in memory of any previous request, so without cookies or a similar mechanism, a website would have no way to recognize a returning visitor or remember what they were doing moments earlier.

How Cookies Work

When a browser requests a page, a website can include an instruction in its response asking the browser to store a cookie, typically a small text value paired with a name, an expiration date, and the specific website domain the cookie belongs to. On every subsequent request to that same domain, the browser automatically includes any matching stored cookies, letting the website read that previously stored information back and respond accordingly, for example keeping a shopper logged in or remembering items already placed in a shopping cart between separate page visits without requiring the shopper to log in or re-add those items again each time.

Cookies are generally limited to the specific domain that originally set them, a restriction intended to prevent one website from reading cookies that belong to an entirely different, unrelated website. Session cookies exist only temporarily and are automatically deleted once a browser is closed, commonly used to maintain a logged-in state for the duration of a single visit, while persistent cookies include a specific future expiration date and remain stored on a device across multiple separate browsing sessions, which is how a website can remember a visitor’s preferences or login status even after their browser has been fully closed and later reopened.

First-Party, Third-Party, and Privacy Concerns

First-party cookies are set directly by the website a person is actively visiting and are generally considered essential for basic functionality, such as keeping a user logged in or remembering items in a shopping cart. Third-party cookies, by contrast, are set by a different domain than the one the visitor is actually browsing, typically embedded through advertising or analytics code included on many different websites, which lets the company controlling that third-party cookie track a single visitor’s behavior across numerous unrelated sites over time, building a much broader picture of that person’s browsing habits than any single website could assemble on its own.

This cross-site tracking capability has become a significant privacy concern, prompting many web browsers to restrict or block third-party cookies by default and leading lawmakers in various jurisdictions to require websites to obtain a visitor’s informed consent before setting non-essential tracking cookies at all. In response, the advertising industry has developed alternative tracking and targeting approaches intended to work without relying on traditional third-party cookies, though no single replacement technology has yet achieved the same near-universal adoption that cookies held for several decades across the web.

From a Simple Fix to a Policy Flashpoint

Cookies were invented in 1994 by a programmer working on an early web browser, created specifically to let an online shopping website remember whether a particular visitor had already placed an item in a virtual shopping cart, a seemingly small technical fix for a real and immediate problem the stateless web had no other way to solve at the time. The technology spread quickly across the web over the following years as it proved useful for far more than shopping carts, becoming the standard mechanism behind login sessions, saved preferences, and eventually the advertising and analytics tracking that grew into a massive industry of its own.

That same tracking capability eventually made cookies a focal point of broader debates over online privacy, leading to landmark data protection regulations in various parts of the world that require websites to disclose their cookie usage and, in many cases, obtain explicit visitor consent before setting non-essential tracking cookies. Major browser makers have since taken their own additional steps to limit third-party cookie tracking by default, continuing a gradual, ongoing shift away from the kind of largely invisible, consent-free tracking that characterized much of the cookie’s first two decades of widespread use across the web.

Frequently Asked Questions

Why were cookies originally created? Cookies were created to solve a basic limitation of how browsers and websites communicate, since each page request was treated independently with no memory of previous requests, meaning a website had no way to recognize a returning visitor or remember information, such as a logged-in state, across separate page loads without some mechanism like cookies.

What is the difference between a session cookie and a persistent cookie? A session cookie is deleted automatically once the browser is closed and typically maintains a temporary state like a login during a single visit, while a persistent cookie includes a specific future expiration date and remains stored on the device across multiple separate browsing sessions until it expires or is manually deleted.

Why are third-party cookies considered a bigger privacy concern than first-party cookies? Third-party cookies are typically set by advertising or analytics code embedded across many unrelated websites, letting a single company track one visitor’s browsing behavior across all of those sites, while first-party cookies are limited specifically to the one website that actually set them in the first place.

Editorially reviewed by Specialty Digest Editorial TeamLast reviewed November 2, 2026Researched and drafted with AI assistanceReport an issue