third-party cookie

basicwidespread

A tiny data packet of identifiers placed in your browser not by the currently opened website, but by an external company embedded in it (typically an advertiser or measurement service).

In plain terms

A cookie is a small data packet that a website leaves in your browser so it can recognize you next time. If this is done by the site you are currently visiting, it is a first-party cookie: this keeps your cart full and means you do not have to log in again.

However, a third-party cookie is placed by an external company whose code – an advertisement, a share button, or a tracking script – is embedded in the page. Since the same company appears on thousands of pages, it reads the same cookie everywhere and can thus piece together where you have been.

It is as if the same external company stuck a numbered sticker on you in every shop along a shopping street: the shopkeepers do not recognize you, but the sticker company sees which stores you entered and tailors the flyers meant for you accordingly.

The online advertising market was built on this for decades: targeted advertising, remarketing, and measuring whether an advertisement led to a purchase. From a data protection perspective, however, this is the most controversial type of cookie, so several browsers now block it by default.

How it works

You open a website that loads elements from external companies alongside its own content: ad space, social media buttons, and visitor tracking code.
Your browser contacts the external company's server for these elements. The server sends a cookie with a unique identifier in its response, which is stored under the external company's domain.
When code for the same company runs on another website, the browser automatically sends the same cookie back to it. This way, the company knows the same browser visited both places.
The company collects visited pages linked to the identifier and builds an interest profile from them. Based on this, it decides which advertisement to show or attributes a purchase to a previous ad.
Whether all this happens depends on two things. Your browser settings determine whether a third-party cookie can be stored and sent back at all, and whether it functions only in isolation per website. Your response on the cookie banner decides whether the website loads the tracking codes.

An everyday example

You look at a pair of hiking boots in an online store but do not buy them. The next day, the same boots appear in ads on a news portal and a recipe site – this is typically enabled by a third-party cookie from an advertising network that recognized your browser on all three sites.

Who is affected

everyoneCookie banners largely determine whether external companies can track your browsing from page to page.

marketerThe accuracy of targeting, retargeting, and conversion measurement depends on whether the visitor's browser allows these cookies. → Marketing

entrepreneur, executiveThe company is responsible for ensuring that third-party code embedded in its website places cookies that are not strictly necessary only after valid consent.

developerEmbedded content, external logins, and payment modules behave differently in browsers that block these cookies. → Code

A common misconception

MythThird-party cookies have been discontinued because Google removed them from Chrome.

In realityGoogle did announce a phase-out in 2020, but reversed course in 2024. In 2025, it also indicated it would not introduce a separate choice prompt, so Chrome still allows these cookies by default. Safari blocks them by default, while Firefox isolates them on a per-site basis.

Limits and risks

A cookie identifies the browser, not you personally: on another device or browser you get a new identifier, so the picture built about you is fragmented and often inaccurate.
Banning them does not mean invisibility, because there are other ways to track, such as browser fingerprinting, login-based identification, or server-side measurement.
If you block all of them, some embedded services (external login, embedded video, chat window) may lag or require re-login.
In the EU, prior consent is required for cookies that are not strictly necessary, but due to deceptively designed cookie banners, many people accept them without knowing what they are agreeing to.

Similar, but not the same

first-party cookie – The browser stores it under the name of the website visited and sends it back only to that website. For this reason, on its own it is not suited to tracking across sites.
browser fingerprint – It stores nothing on your device but calculates an identifier from your browser and device characteristics, so you cannot delete it like a cookie.
tracking pixel – This is an invisible, tiny image or code snippet that indicates a view. It often works with cookies but is not the stored identifier itself.

Related concepts

Broader

cookie, online tracking, data protection

Narrower

tracking cookie, advertising cookie

On the edge

first-party cookie, retargeting, targeted advertising, browser fingerprint, cookie banner

A brief history

The cookie was invented in 1994 by Lou Montulli, an engineer at Netscape, originally to remember shopping carts in online stores. Advertising networks soon realized that placing them as third parties was also effective for cross-site tracking. Safari completely disabled them by default in 2020, and Google announced the phase-out for Chrome that same year. Google stepped back from this in 2024 and permanently abandoned the plan in 2025.

Where things stand

An old, widely used but declining technique. Safari and Firefox block or isolate it by default, while Chrome still allows it in its default settings, and users can disable it in the settings. The advertising market is therefore increasingly shifting to first-party data, server-side measurement and consent-based solutions.

Status: 2026 November

Also known as

third-party cookie · third-party cookie · third-party cookie · third-party cookie · third-party cookie · third party cookies · 3P cookie · 3rd-party cookie

Sources

Wikipedia: HTTP cookie

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.