What Is a Cookie on a Website? Guide to Types & Privacy

Chances are you’ve clicked through more cookie popups than you can count this week alone. But what actually happens when you hit “Accept”? A cookie is a small text file that a website drops on your device to keep track of your session, save preferences, or remember what you left in your cart. Ever since GDPR enforcement began on May 25, 2018, websites serving EU users are legally required to ask before tracking you — but most people just click through without reading. Understanding cookies means understanding what you’re actually agreeing to.

Created by: web server · Stored on: user device · Size: small text file · Purpose: track user state · Examples: session ID, preferences

What are cookies?

At the most basic level, a cookie is a tiny text file that a web server sends to your browser and that your browser stores on your device. The file contains plain text — a name, a value, and usually an expiration date. When you revisit the same site, your browser sends that cookie back, allowing the server to recognize you.

How cookies work

The process follows a simple request-response loop: your browser requests a page, the server sends it along with a Set-Cookie header, your browser saves the data, and on your next visit it includes the cookie in the request header. This handshake is what lets a website know you logged in five minutes ago or that you prefer your cart in euros.

Types of cookies

Cookies break down along two axes: who sets them and how long they last. First-party cookies come directly from the site you’re visiting and handle core functionality like keeping you logged in or remembering your language setting. Third-party cookies come from a different domain — usually an advertiser or analytics provider — and can track you across multiple sites. Session cookies vanish when you close your browser; persistent cookies survive with an expiration date, sometimes for years. A more dangerous variant, supercookies, are planted at the network level and can recreate themselves even after you try to delete them (Termly).

What is an example of cookies?

Concrete examples clarify what can otherwise feel like abstract infrastructure. A website stores a user_session cookie after you log in, so you don’t have to re-enter your password on every page. It saves a language cookie to remember you prefer the French version of the site. An e-commerce store holds a wishlist cookie so items you saved last week are still there when you return (iubenda). None of these examples are sinister — they’re the ordinary mechanics that make the web convenient.

Session cookies

• Exist only while the browser tab is open
• Automatically deleted on browser close
• Common use: shopping cart during a single visit, form progress

Persistent cookies

• Carry a set expiration date (days, months, or years)
• Survive browser restarts and device changes
• Common use: “Remember me” login, site preferences, targeted advertising IDs

Third-party cookies

• Placed by domains other than the one you’re visiting
• Feed advertising networks and cross-site analytics tools
• Subject to increasing browser restrictions since 2020

The 95% figure worth remembering: about 95% of websites use cookies for relatively harmless purposes like keeping you logged in or remembering your preferences (Cardlytics). The remaining fraction drives the privacy debates.

Should I accept cookies?

The short answer: it depends on what kind of cookie is asking. Essential cookies — those that handle login, security, or load balancing — are usually required for a site to function at all. Declining them may break core features. Tracking and advertising cookies are another story.

Essential vs tracking cookies

Under the ePrivacy Directive, strictly necessary cookies (such as those for load balancing or authenticated sessions) are exempt from consent requirements (iubenda). Everything else — analytics, advertising, personalization — requires opt-in consent under GDPR, at least for EU users. The cookies pop-up you see on European sites reflects this legal requirement.

Privacy implications

Third-party cookies are the main privacy concern. They enable cross-site tracking that can build a surprisingly detailed profile of your browsing habits, including potentially sensitive inferences about health, finance, or political views (Cardlytics). If intercepted on an unsecured network, cookies can also enable session hijacking — where an attacker takes over your logged-in session (Netwrix).

What happens if I refuse to accept cookies?

Refusing cookies produces varying outcomes depending on the site and your jurisdiction. In the EU and UK, sites must honor your refusal — GDPR and the ePrivacy Directive require consent to be genuine, not just a checkbox on the way to content. In the US under CCPA, you typically get the right to opt out of data sales, though the mechanism varies by site.

Site functionality loss

• Login sessions fail — the site can’t recognize you between pages
• Shopping carts empty on every new page
• Language and theme preferences reset each visit

Personalization impact

• No saved reading history or recommended content
• Generic ads instead of interest-based targeting
• Repeated cookie consent banners on every visit (since no preference cookie is saved)

The catch: refusing all cookies on most sites creates a worse user experience, which is why consent popups often push toward acceptance. You can often compromise by blocking third-party cookies while allowing first-party essential ones.

How to clear your browser’s cache and cookies?

Managing cookies is straightforward once you know where to look. Each major browser provides settings to view, block, or delete cookies — though the steps differ slightly.

Steps for Chrome

1. Type chrome://settings/cookies directly into your address bar (Google Privacy & Terms)
2. Use the search bar to find “Clear browsing data” or navigate to Privacy and security
3. Select “Cookies and other site data” or choose a time range and confirm
4. For site-specific control, scroll to “Sites that can always use cookies”

Steps for other browsers

• Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data
• Safari: Preferences → Privacy → Manage Website Data → Remove relevant entries
• Edge: Settings → Cookies and site permissions → See all cookies and site data

For a fresh start without clearing manually every time, incognito or private mode deletes all cookies when you close the window — Chrome’s official documentation confirms this behavior (Google Privacy & Terms).

Supercookies are very dangerous because they have great potential for causing privacy violations.

— Termly (Privacy Resource)

Cookies aren’t inherently bad and, in fact, about 95 percent of all websites use cookies for relatively harmless purposes.

— Cardlytics (Marketing Tech Blog)

Even with Chrome keeping third-party cookies as an option, the overall trend is clear: the industry is moving toward cookieless monetization strategies.

— Clickio (Ad Tech Blog)

The practical reality sits between the two extremes. Cookies are genuinely useful infrastructure that makes logged-in web experiences possible — and they are also a surveillance mechanism when third parties use them without meaningful oversight. The browsers and regulations have moved the needle: Safari has blocked third-party cookies by default since March 2020 (version 13.1), Firefox blocks known trackers with Enhanced Tracking Protection, and GDPR mandates consent for non-essential cookies across the EU. Chrome’s reversal in July 2024 complicates the picture, but it doesn’t erase the direction the industry was already heading.

Related reading: How to Download YouTube Videos: Legal & Safe Methods · Best Online Learning Platforms – Top Picks for Students and Adults

When facing those ubiquitous cookie banners, understanding their role as detailed in guide to uses and privacy empowers users to manage privacy risks effectively with expert-recommended steps.

Frequently asked questions