A web cookie, also known as an internet cookie or a browser cookie, is a text file that contains information that the website needs to store relating to a particular visit or visitor. The file is stored on the user\u2019s machine, can be deleted by the user, and can only be read by the user or the website that created the cookie.<\/span><\/p>\n Cookies, and other forms of local storage, are vital to running a usable web. Without Cookies, websites wouldn\u2019t remember our settings or logins, our preferences or what content we have already seen. <\/span><\/p>\n Without cookies, a website cannot pass any information from one pageview to another. For example, if a website like Facebook didn\u2019t use cookies to remember logged in users then users would have to enter their username and password every time they clicked a link and loaded a new page.\u00a0<\/span><\/p>\n Cookies are used for a broad range of purposes that can be briefly summarised as:<\/span><\/p>\n Cookies are a very normal part of the web and perfectly safe. Cookies will not cause harm to you or your devices and cannot \u201cleak\u201d private information about you. But, like many technologies, they can be abused. There is growing concern about the (mis)use of cookies and the effect this has on user privacy.<\/span><\/p>\n Most of this concern centres around a couple of particular types of cookie. <\/span><\/p>\n Cookies are discussed in terms of their \u201cparty\u201d. A first-party cookie is one that is set by the domain of the website that the user is visiting. A third-party cookie is one set by another domain that the website has allowed to set a cookie.<\/span><\/p>\n First and third-party cookies are really the same thing. Only the domain that set them can read them. However, there are concerns particular to third-party cookies relating to how they allow users to be tracked.<\/span><\/p>\n A cookie set by the domain that the user is visiting. An example would be a website setting a cookie containing a user\u2019s login details so that they are automatically logged in when they return to the site.\u00a0<\/span><\/p>\n Third-party cookies are those set by a domain other than the one the user is visiting, such as when a remote script is embedded.\u00a0 An example would be a website using a live-chat script from another company that sets a cookie so that the conversation can be continued between page loads.<\/span><\/p>\n Most developers will tell you that second-party cookies don\u2019t exist, but the term is beginning to crop up. It is being used to describe a first-party cookie that has been created with the contents of another first-party cookie meant for another domain. This can happen as part of data-sharing deals between companies.\u00a0<\/span><\/p>\n If you are keeping up with cookie-parties, then the last to understand is a first-party cookie that is being used in a third-party context.\u00a0 This description has gained traction since Apple\u2019s IPT privacy features began blocking this type of cookie. In essence, these are first-party cookies that are being used in a cross-site manner like a third-party cookie would usually be used. <\/span><\/p>\n As well as the context of a cookie (first\/third-party) there are differences in how long those cookies, and the data they contain, can survive.\u00a0<\/span><\/p>\n Some cookies are automatically destroyed when the browser window is closed. These are called session cookies. Others stay in existence longer and are called persistent cookies. Persistent cookies can theoretically hang around forever (or at least the life of the computer), which is also a privacy concern to some.\u00a0<\/span><\/p>\n None of the types of cookie are inherently bad, and how comfortable users are with different types depends a lot on the individual. Generally speaking, very few users have issues with the concept of the first-party cookie. They are essential to the smooth running of the web and largely innocuous.<\/span><\/p>\n Third-party cookies (and those acting like third-party cookies) tend to cause more concern. This is understandable; whilst there are many good reasons for this type of cookie they have been widely abused too. <\/span><\/p>\n The cookie provides a convenient way to identify a user over time, which has a lot of appeal to the online advertising industry. In most cases, the cookie is being used to store a unique ID that allows a network or technology to recognise that user wherever they see them. Identifying the user is useful in three broad ways:<\/span><\/p>\n If a user frequently reads photography content, then they can be shown photography-related ads (even when on a non-photography site using the same technology). This makes advertising more valuable to marketers.<\/span><\/p>\n A benefit to users of Cookie Matching<\/a> is that users see ads that are more likely to be of interest to them. According to Marketing Dive, <\/span>71%<\/span><\/a> of consumers prefer targeted ads over untargeted ads. A drawback to users is their interests being tracked by third parties.\u00a0<\/span><\/p>\n Cookies also allow ad tech providers to track how often a user is being shown a particular advertisement. This allows advertisers to cap how often users see their ads. End-users benefit from this by seeing less annoying repetitive ads, but the downside is that some form of identity tracking is needed to do this.<\/span><\/p>\n Advertisers want to know when their ads produce results. Recognising whether a user has seen an ad then made a purchase enables this. This allows advertisers to focus on campaigns that get results, but also means that users are shown fewer ads for things that they have already bought.\u00a0<\/span><\/p>\n The advertising industry has definitely pushed the use of cookies well beyond how they were intended and how users expect them to be used. Cookies have allowed companies to track huge amounts of information about users\u2019 browsing habits and use that information to target advertising.\u00a0 Much of this has been done \u201cbehind the scenes\u201d by companies the user has not even heard of, so the industry should not be surprised that people distrust them.<\/span><\/p>\n The future looks increasingly shaky for the third-party cookie in particular. Privacy legislation such as GDPR and CCPA<\/a> has already dealt a blow to the advertising tracking cookie, putting the user back in control with consent. Similar legislation is in the works in many other territories and many are anticipating the death of the third-party cookie.<\/span><\/p>\nWhy do websites use cookies?<\/b><\/h2>\n
\n
Are cookies dangerous?<\/b><\/h2>\n
First-party and Third-party Cookies<\/b><\/h2>\n
What are first-party cookies?<\/b><\/h3>\n
What are third-party cookies?<\/b><\/h3>\n
What are second-party cookies?<\/b><\/h3>\n
What are third-party cookies used in a first-party context?<\/b><\/h3>\n
Session cookies vs persistent cookies<\/b><\/h2>\n
So, which type of cookie is bad?<\/b><\/h2>\n
Why does online advertising use cookies?<\/b><\/h2>\n
Matching ads to interests<\/b><\/h3>\n
Frequency capping<\/b><\/h3>\n
Conversion tracking<\/b><\/h3>\n
Why do some users hate cookies?<\/b><\/h2>\n
What is the future of cookies?<\/b><\/h2>\n