Cookies (browser)
Browser cookies are small pieces of data that a website asks the visitor's browser to store and send back on later requests, used to keep people logged in, remember settings and baskets, and track visits.
Cookies give websites a memory. Each request a browser makes is otherwise independent, so without cookies a site could not tell that the person adding an item to a basket is the same one who logged in a moment ago. Most cookies are harmless and necessary; some exist mainly to follow people for analytics and advertising, which is why they are regulated.
Cookies are not programs and cannot run code or carry viruses. They are also not the only way to store data in a browser; local storage and similar features are often covered by the same privacy rules. The cookie banner on a site is about cookie consent, which is a legal question, not a technical one.
How it works
When a browser loads a page, the server's response can include an instruction to set a cookie: a name, a value and some rules. The browser stores it and sends it back with every later request to that site, until it expires or is deleted. A login cookie typically holds a random session ID that the server matches to the logged-in account.
Rules on each cookie control its behaviour. An expiry date decides whether it lasts only for the session or for weeks. The Secure flag sends it only over HTTPS. HttpOnly hides it from scripts on the page, which protects login cookies if a malicious script runs. SameSite limits whether it is sent when another site links or posts to yours, which helps prevent forged requests.
First-party cookies are set by the site you are visiting. Third-party cookies are set by other domains whose content is embedded on the page, such as an advertising network, and let that network recognise the same browser across many sites. Several major browsers block or restrict third-party cookies by default, which has reduced cross-site tracking and made first-party data more important to marketers.
Example
An online pharmacy uses a session cookie to keep customers logged in and their basket intact, a preference cookie to remember the language, an analytics cookie to measure which pages people visit and an advertising pixel that sets cookies for retargeting.
Under EU privacy rules, the login, basket and language cookies are strictly necessary and can be set straight away, while the analytics and advertising cookies need the visitor's consent first. UK rules allow a narrow exception for first-party statistics with a clear way to opt out, but advertising cookies still need consent there too. The pharmacy's consent banner therefore loads the analytics and advertising scripts only after the visitor accepts, and the shop still works fully for those who decline.
Why it matters for your business
Cookies affect both how your site works and your legal exposure. Necessary cookies keep logins, baskets and forms working; non-essential ones for analytics and ads usually require consent under rules such as GDPR and the EU ePrivacy rules, and many sites set them before consent without realising. Fewer cookies also means less to explain in your privacy policy. You can check what your site sets by opening the browser's developer tools, looking at the stored cookies for your domain in a fresh private window, and comparing them before and after accepting the banner.
Common mistakes
- Loading analytics and advertising tags before the visitor has given consent.
- Setting login cookies without the Secure and HttpOnly flags, making accounts easier to hijack.
- Keeping marketing tags from old campaigns that still set cookies nobody uses.
- Listing cookies in the privacy policy that no longer match what the site actually sets.
Questions people ask
Do I need a cookie banner?
If your site uses cookies or similar storage for advertising, analytics or other non-essential purposes and you have visitors in the EU, you generally need consent first, which is what a banner collects. UK rules exempt some simple first-party statistics if visitors can opt out, but not advertising. Sites using only strictly necessary cookies usually do not need consent, though they should still explain them.
What is the difference between first-party and third-party cookies?
First-party cookies are set by the site in the address bar and usually support logins, baskets and settings. Third-party cookies are set by other services embedded on the page, such as ad networks, and can track people across sites. Many browsers restrict third-party cookies.
Are cookies dangerous?
Cookies cannot run code or install anything. The risks are privacy, when cookies are used to track people without consent, and security, when a stolen login cookie lets someone into an account. Proper cookie flags, HTTPS and limited tracking address both, and visitors can clear cookies at any time in their browser settings.
