A cookie is a small piece of text that a website asks your browser to save, so the site can recognize you on your next click or visit. If you have ever asked what is a cookie on a website and why almost every page mentions them, the answer is that cookies give the web a memory.
Without cookies, a site would treat every page request as coming from a stranger. You’d have to log in again on each page, and your cart would empty the moment you clicked a product. This guide covers how cookies work, the types you will meet, how US privacy rules treat them, and how to check and control them yourself.
How a Cookie on a Website Works
Web servers do not remember you by default. Each request your browser sends is treated as new, which is why HTTP is called a stateless protocol. Cookies fix this with a simple handoff.
When you visit a site, the server can send a Set-Cookie header along with the page. Your browser saves the cookie and attaches it to every later request to that site. The server reads it and knows which session or settings belong to you.
Lou Montulli, then a Netscape engineer, built the first browser cookies in 1994 to keep a shopping cart working between pages. The format is now documented in the IETF’s RFC 6265, which says browsers should support cookies of at least 4,096 bytes. That is a page or so of plain text.
A cookie is not a program. It cannot run code or read files on your computer. It is a name and a value with a few settings attached.
What Is Inside a Cookie
According to Mozilla’s MDN Web Docs, a cookie usually carries these parts:
- A name and a value, such as a session ID
- A domain and path that say which pages can receive it
- An expiration date or maximum age
- Attributes such as Secure, HttpOnly, and SameSite
Most sites do not store personal details in the cookie itself. Think of it as a coat-check ticket: the ticket is a number, and the coat stays in the site’s own storage.
A Real Example: Adding Shoes to a Cart
Say you open a retailer’s site, browse running shoes, and add a pair to your cart without logging in. The site sets a session cookie with a random ID, and your cart contents are tied to that ID on the server.
Close the tab and come back an hour later, and the cart is often still full, because a persistent cookie kept the ID alive. Switch to a different browser, and the cart is empty, since that browser has no cookie.
Later, an ad network cookie on the same page may note that you looked at running shoes, which is why shoe ads can follow you around other sites.
Types of Cookies You Will Run Into
Cookies are sorted by how long they last and who sets them.
1. Session Cookies
Session cookies disappear when you close the browser. They hold temporary things, like a cart or a logged-in state during one visit.
2. Persistent Cookies
Persistent cookies stay until an expiration date or until you delete them. They remember choices like “keep me signed in” or a dark mode setting.
3. First-Party Cookies
The site you are visiting sets these. They handle logins, language choices, and the site’s own analytics, and they cause few privacy complaints.
4. Third-Party Cookies
These come from a domain other than the one in your address bar, usually an ad network or analytics tool embedded in the page. They can follow you across unrelated sites to build an interest profile, which is where most privacy concerns come from.
5. Strictly Necessary vs. Optional Cookies
Cookie banners usually split cookies into necessary, functional, analytics, and advertising groups. Necessary ones handle login, cart, and security, and the site cannot work without them. The rest are optional, and that is what the banner’s toggles control.
Why Websites Use Cookies
Sites use cookies for a handful of everyday jobs:
- Keeping you logged in as you move between pages
- Holding items in your cart until checkout
- Remembering settings such as language, location, or theme
- Counting visitors and seeing which pages get read, as Google Analytics does with its own first-party cookies
- Showing ads and measuring whether they worked
- Spotting suspicious logins and fraud
Cookies vs. Other Ways Sites Remember You
Cookies are not the only tool. Browsers also offer localStorage and sessionStorage, which keep data on your device but do not automatically travel to the server with every request, according to MDN.
Some trackers skip storage entirely. Browser fingerprinting combines details like screen size, fonts, and browser version to recognize a device, so clearing cookies alone does not erase every trace. Blocking cookies helps, but it does not stop every form of tracking.
Common Cookie Myths
Cookies are not spyware. A first-party cookie cannot see what you do on other sites, and a single cookie cannot read your files or browsing history.
Deleting cookies does not make you anonymous. Your IP address, device details, and logged-in accounts can still identify you to many services.
Private browsing still accepts cookies while the window is open and deletes them when you close it. It does not hide your activity from the sites you visit.
Are Cookies Safe?
Cookies cannot carry viruses, so the file itself is harmless. The risks are session theft and tracking.
If an attacker steals a session cookie, they may be able to act as you without knowing your password. To limit that, sites add attributes: HttpOnly stops page scripts from reading the cookie, Secure sends it only over HTTPS, and SameSite restricts sending it on cross-site requests, per MDN.
On your end, stick to HTTPS sites, log out on shared computers, and clear cookies after using a public device.
Cookies and US Privacy Rules
The US has no single federal cookie law. Rules come mainly from state privacy statutes and from the FTC’s authority over deceptive practices.
California’s CCPA, as amended by the CPRA, lets residents opt out of the sale or sharing of their personal information. The California Attorney General’s office says businesses must treat opt-out preference signals such as Global Privacy Control as valid requests. Several other states, including Virginia, Colorado, and Connecticut, have passed similar laws.
This is why many US sites show opt-out banners, while sites serving EU visitors ask for opt-in consent under the ePrivacy Directive and GDPR. This is general information, not legal advice, so site owners should confirm their obligations with a privacy attorney.
What Is Happening to Third-Party Cookies
Safari and Firefox already block third-party cookies by default, through Intelligent Tracking Prevention and Total Cookie Protection. Chrome, the most-used browser in the US, spent years planning to phase them out.
In 2025, Google said it would keep third-party cookies and not add a standalone prompt, leaving the choice in Chrome’s existing privacy settings (per Google’s Privacy Sandbox update). Advertisers are meanwhile leaning on first-party data and contextual ads. Browser policies shift, so check current settings.
How to See the Cookies on Any Site
You can inspect cookies in about a minute. In Chrome, open a site, press F12 (or right-click and choose Inspect), and click the Application tab.
Under Storage, expand Cookies and pick the domain. You will see each cookie’s name, value, domain, expiration, and its HttpOnly, Secure, and SameSite settings.
Try a large ad-supported news site, then a small local business page. The difference in how many cookies each one sets is often easy to spot.
How to Manage or Delete Cookies
The menu names change between versions, but the paths below are a reliable starting point.
1. Chrome
Go to Settings, then Privacy and Security, then Third-Party Cookies, and choose to block them. To clear existing cookies, use Delete Browsing Data and tick the cookies box.
2. Safari
On a Mac, open Safari Settings, go to Privacy, and use Manage Website Data. On iPhone, the Safari section of Settings includes a Block All Cookies option.
3. Firefox and Edge
Firefox manages this under Settings, then Privacy and Security, with Enhanced Tracking Protection. In Edge, look under Settings, then Cookies and Site Permissions. Firefox and Brave can also send a Global Privacy Control signal.
Blocking every cookie breaks logins and carts, and clearing them signs you out everywhere. Blocking only third-party cookies is the middle ground most people can live with.
That is what a cookie on a website comes down to: a small label your browser carries so a site can pick up where you left off. Checking and managing them takes a minute, and the choice is yours.
