What a cookie is
A cookie is a small piece of text that a website asks your browser to store. The next time your browser contacts that site, it sends the text back. That is the whole mechanism, and it is useful. Cookies are how a site remembers that you are logged in, what is in your shopping cart or which language you prefer. Without them, every page load would feel like meeting the site for the first time.
The privacy concerns come from how cookies are used, not from the idea itself.
First-party and third-party
A first-party cookie is set by the site you are visiting. These are mostly about making that site work, though some are used for the site’s own analytics.
A third-party cookie is set by a different company whose content is embedded in the page, such as an advertising network, a social media button or an analytics service. If the same company’s content appears on many unrelated sites, its cookie can recognize you on each of them. Over time that company can assemble a picture of which kinds of pages you visit.
Browser makers have changed how they treat third-party cookies, and some block them by default, while others have taken different approaches. The details vary by browser and have changed over the years, so it is worth checking your own browser’s current settings.
Other ways sites follow activity
Cookies are only one tool. Others include:
- Tracking pixels. A tiny, often invisible image loaded from another company. When your browser fetches it, that company learns that you loaded the page or opened an email.
- Scripts. Code on a page that records things like how far you scrolled, what you clicked or how long you stayed.
- Device fingerprinting. Instead of storing anything on your device, a tracker collects many small details, such as screen size, fonts, time zone and browser version. The combination can be distinctive enough to recognize a device even when cookies are cleared.
- Account-based tracking. When you are signed in, a company can link your activity across its own services and devices.
- App software kits. Mobile apps often include code from outside companies that collects information about usage and the device.
From activity to profile
A single page view reveals little. The value comes from combining many of them. A profile might note that a device often visits cooking sites, searched for hiking boots, and tends to be active in the evening. Combined with an approximate location, this can be used to guess at interests and sometimes at life circumstances. These inferences can be wrong, but they are used all the same.
This is the engine behind much personalized advertising. An advertiser says what kind of audience it wants, and the system tries to find matching people in real time as a page loads.
Who are data brokers
Data brokers are companies whose business is collecting, combining and selling or licensing information about people. Their sources may include public records, purchase and loyalty-card data, app and website data, and information bought from other companies. They then package it, for example into lists of people who fit certain descriptions, for uses such as marketing, risk assessment or identity verification.
Most people never deal with a broker directly, which makes the trade hard to see. What is collected, how accurate it is and what rights you have to see or remove it depends heavily on where you live. Some places give residents formal rights to ask for deletion or to opt out of the sale of their data, and others do not. If you want to use such rights, it is best to check the rules and the company’s own instructions.
Why the cookie banners
Many sites show a banner asking you to accept or manage cookies. In some regions, laws require websites to explain their use of non-essential cookies and ask for consent. The quality of these banners varies. Some make it easy to decline, while others make rejecting harder than accepting. If a banner has a settings or manage option, it usually lists categories such as essential, analytics and advertising, and you can often turn off the last two without breaking the site.
Reasonable steps to limit tracking
You cannot prevent all tracking, but a few measures reduce a lot of it:
- Review browser settings. Look for options to block third-party cookies or to enable tracking protection.
- Clear cookies from time to time, or set the browser to clear them when it closes. This will log you out of sites, which is a trade-off.
- Consider a content blocker. Extensions that block ads and trackers are widely available, though you should install them only from the official store of your browser and read what they ask permission for.
- Check app permissions. Turn off location, contacts or microphone access that an app does not need.
- Use private browsing for specific tasks. It stops your browser from saving history locally, but it does not make you invisible to the sites you visit or your network.
- Limit what you share when signing up. Fewer details means a thinner profile.
- Use opt-out tools where they exist. Some advertising and data-broker services offer opt-out forms, although results can be partial and may need repeating.
Keeping perspective
Not all tracking is sinister. Basic analytics help site owners fix broken pages, and many services you value are funded by ads. The more useful question is whether the data collected is proportionate to what you get in return, and whether you have any real choice. The wider picture of why this matters is covered under online privacy, and the connection to security risk is that large pools of stored data can be leaked or misused. Understanding the system makes it easier to decide how much friction you are willing to accept in exchange for less exposure.