A cookie is a small name-value record that a website instructs the browser to store and that the browser sends back automatically with subsequent requests to the same site. Defined by the HTTP State Management Mechanism in RFC 6265, cookies give the otherwise stateless HTTP protocol a memory, which makes logins, shopping carts and preferences possible.
In cookies and consent, the term matters because the same mechanism also enables tracking across visits and across websites. European ePrivacy rules therefore require prior consent for storing or reading cookies that are not strictly necessary, which is why consent banners exist.
How a cookie is set and returned
A server sets a cookie with the Set-Cookie response header, or a script sets one through document.cookie. The browser stores it in its cookie jar, scoped to a domain and path, and attaches matching cookies to every later request in the Cookie request header until the cookie expires or is deleted.
Cookies are small by design. Browsers typically allow about 4 KB per cookie and a limited number of cookies per domain, so a cookie usually holds an identifier that points to data stored on the server rather than the data itself.
| Attribute | Purpose | Typical value or effect |
|---|---|---|
| Expires / Max-Age | Sets lifetime | Absent: session cookie; present: persistent cookie |
| Domain | Defines which hosts receive it | Includes subdomains when set |
| Path | Limits the URL paths | Usually the site root |
| Secure | Sends only over HTTPS | Required for SameSite=None |
| HttpOnly | Hides it from JavaScript | Reduces theft through script injection |
| SameSite | Controls cross-site sending | Strict, Lax (common default) or None |
Types of cookies by origin, lifetime and purpose
Cookies are classified along three independent axes, and consent decisions depend mainly on purpose, not on technical form. A first-party cookie is set by the site in the address bar; a third-party cookie is set by another domain whose content is embedded in the page, such as an advertising or social media script.
| Axis | Category | Example |
|---|---|---|
| Origin | First-party | Session ID of the shop being visited |
| Origin | Third-party | Ad network ID set through an embedded tag |
| Lifetime | Session | Deleted when the browser session ends |
| Lifetime | Persistent | Kept for days, months or until a set date |
| Purpose | Strictly necessary | Login, cart, load balancing, security |
| Purpose | Preferences, statistics, marketing | Language choice, analytics, ad targeting |
Only strictly necessary cookies are exempt from consent under the ePrivacy Directive. Analytics, personalization and advertising cookies need an affirmative opt-in before they are set, and regulators have stressed that the exemption is interpreted narrowly.
Cookies compared with other storage and tracking techniques
Cookies are not the only way to keep state or recognize a browser. Consent rules apply to all of them whenever information is stored on or read from the user’s device, so replacing cookies with another technique does not avoid the obligation.
| Technique | Sent automatically to server | Typical use | Consent relevance |
|---|---|---|---|
| HTTP cookie | Yes | Sessions, preferences, tracking | Required unless strictly necessary |
| Local storage | No | Client-side app data | Same rule as cookies |
| Device fingerprinting | Not stored, computed | Covert recognition | Treated as access to device information |
| Tracking pixel | Request carries cookies | Email and page view tracking | Required for non-essential tracking |
| Server-side session | Needs a cookie or token | Authenticated state | Usually strictly necessary |
Cookie management through consent tools
Most websites manage cookies through a CMP, a consent management platform that shows the consent banner, records choices and blocks tags until consent is given. A compliant setup offers reject as easily as accept, uses no pre-ticked boxes, and lets users withdraw consent at any time.
| Situation | Recommended choice | Reason |
|---|---|---|
| Login and cart | Set without consent, HttpOnly and Secure | Strictly necessary and sensitive |
| Web analytics | Load only after opt-in | Not strictly necessary in most interpretations |
| Advertising tags | Block until marketing consent | Highest privacy impact |
| Embedded videos | Use a privacy-enhanced mode or click-to-load | Third-party cookies on load |
Browsers also limit cookies independently of law. Safari and Firefox block third-party cookies by default, and partitioned storage keeps embedded content from sharing one cookie across sites, so cross-site tracking via cookies is steadily losing reliability.
Security and compliance pitfalls
Cookies sit at the intersection of application security and privacy law, so mistakes tend to cause both a vulnerability and a compliance gap. A session cookie is effectively a bearer credential: whoever holds it is treated as the logged-in user until it expires or the server invalidates it.
- Session cookies without HttpOnly can be stolen through cross-site scripting.
- Missing SameSite settings on older code paths expose forms to cross-site request forgery.
- Tags firing before consent is one of the most common findings in regulatory audits.
- Overlong lifetimes, such as several years for analytics IDs, conflict with storage limitation.
- Inaccurate cookie lists in the policy undermine the validity of consent.
Regular automated cookie scans comparing what pages actually set against the declared list are the practical way to keep the inventory honest.
In plain words
A cookie is like a coat-check ticket. The website hands your browser a small ticket, and every time you come back, the browser shows it so the site remembers who you are, what is in your cart or which language you chose.
Some tickets are needed for the site to work at all. Others are handed out by advertisers to recognize you on many different sites. That second kind is why websites must ask before using cookies that are not essential.
A real-world example
An online bookstore audits its homepage and finds 27 cookies set on first load, including advertising IDs from three ad networks and an analytics cookie with a two-year lifetime, all before the visitor touches the consent banner.
The team configures its CMP to block every non-essential tag until opt-in, adds an equally visible reject button, shortens the analytics cookie lifetime to 13 months and marks its session cookie HttpOnly, Secure and SameSite=Lax. Embedded video players switch to click-to-load.
After the change, only three strictly necessary cookies load before consent. The store keeps its login and cart functions intact and can show a regulator a clean, documented consent flow.