Third party cookies: What happens when websites share your data

The internet runs on invisible handshakes between websites you visit and companies you’ve never heard of. Every time you browse multiple sites, tiny files called Third-party cookies are created when a third-party website—such as an ad network or analytics provider—places cookies on the user's device. These cookies enable tracking of your movements across the web, building detailed profiles of your interests, habits, and behavior.

These digital breadcrumbs follow you from site to site, tracking user activity and linking to your browsing history across different websites. They know you browsed for running shoes on Monday, read articles about cryptocurrency on Tuesday, and spent Wednesday evening shopping for vacation rentals. This isn’t science fiction—it’s happening right now, on every website you visit.

Here’s how third-party cookies work: when a website loads content from a third-party website, such as an ad, analytics script, or social media widget, the third-party server sets cookies on the user's device. This allows third-party cookies to track user activity across multiple sites, enabling targeted advertising and personalized experiences.

The advertising industry built a trillion-dollar ecosystem on this data collection. But user privacy concerns, regulatory pressure, and browser changes are forcing a major shift. As of 2024, all major web browser vendors had plans to phase out third-party cookies due to increasing privacy concerns and regulations. However, Google Chrome reversed this plan in July 2024, causing significant industry concern and uncertainty about the future of web tracking.

What are third-party cookies exactly?

Third-party cookies are HTTP cookies set by a different domain than the one shown in your browser's address bar. When you visit example.com and see an advertisement or embedded content from adnetwork.com (a different domain), that ad can place its own cookie on your browser—even though you’re not directly interacting with adnetwork.com. This process is known as using third party cookies for online tracking, advertising, and user profiling.

The key difference lies in the domain origin. If you’re on website-A.com and a cookie comes from website-A.com, that’s a first-party cookie. If a cookie comes from tracking-company.com while you’re still on website-A.com, that’s a third-party cookie. Understanding the distinction between first and third party cookies is crucial for grasping their roles in web tracking and user privacy.

Think of it like this: you’re at a restaurant (first-party), but the music playing comes from a radio station (third-party). The radio station can now track that you were at that restaurant, at that time, listening to their content. Even if your browser window has multiple tabs open, cookies can persist across sessions, depending on your browser settings. Using third party cookies allows companies to track users across different domains, not just the site in the address bar.

Third-party cookies weren’t originally designed for tracking. Party cookies are created when a website loads resources or scripts from a different domain, such as advertising networks, analytics providers, or social media plugins. They were created to enable legitimate cross-site functionality. But the advertising industry quickly realized their potential for building user profiles across multiple websites.

How third-party cookies track users across websites

The tracking process starts when you visit a website containing third-party content. This content might be advertisements, social media widgets, analytics scripts, or embedded videos. When such content loads, a third-party server may place cookies on your device via a JavaScript file. Each piece of third-party content can set cookies from its own domain.

Here’s a simplified tracking scenario:

1. You visit news-site.com, which contains an ad from tracker.com

2. The third-party server at tracker.com sets a unique cookie ID (like “user12345”) in your browser using a JavaScript file

3. Later, you visit shopping-site.com, which also has content from tracker.com

4. Tracker.com recognizes your cookie ID and connects your user visits across these different sites and other sites that use its content

5. Over time, tracker.com builds a profile of your browsing habits by tracking user activity across multiple websites

These cookies allow companies to track user activity not just on the current site, but across different sites and other sites where their content appears. Each time a user visits a site with the same third-party content, the third-party server can recognize the user and link their visits across multiple sites.

The HTTP referer header makes this tracking even more powerful. When your browser loads third-party content, it often sends information about which page you’re visiting. This allows tracking companies to see not just that you visited a website, but which specific pages you viewed.

Placing cookies for tracking purposes typically requires a cookie consent banner and the user's consent under privacy regulations like GDPR and CCPA, which in turn relies on disciplined GDPR consent management across all tracking technologies. Websites must inform users and obtain explicit consent before placing third-party cookies, following best practices for implementing compliant cookie consent banners.

Some websites work with over 100 different third-party domains. Each domain can potentially set cookies and track your behavior. The result is a detailed behavioral profile that follows you across the entire web, which many organizations first discover by running a website cookie checker for GDPR risks.

Research from the mid-2010s showed that individual websites were setting an average of 10 cookies, with some sites deploying over 800 cookies total. Many of these came from third-party tracking services.

First-party vs third-party cookies

The distinction between first-party and third-party cookies matters for both functionality and privacy. First-party cookies come from the website you’re directly visiting and typically serve legitimate purposes like remembering your login status or shopping cart contents.

Third-party cookies come from external domains and primarily exist for cross-site tracking. There is also a category called second-party cookies, which are shared between trusted partners with the user's consent, allowing data sharing within established relationships rather than tracking across multiple sites. Second party data refers to information exchanged between these trusted partners, often to enhance user experience or targeting efforts.

Here’s a breakdown of their typical uses:

First-party cookies:

• User authentication and login sessions

• Shopping cart persistence

• Website preferences and settings

• Basic analytics about site usage

• Personalized content delivery

Second-party cookies:

• Data sharing between trusted partners

• Enhancing user experience through shared information

Third-party cookies:

• Cross-site user tracking

• Behavioral advertising

• Personalized advertising

• Targeted ads

• Social media integration

• Third-party analytics services

• Retargeting and remarketing campaigns

Most users find first-party cookies acceptable because they directly improve their experience on the website they chose to visit. Third-party cookies feel more intrusive because they involve companies the user never directly interacted with.

The technical implementation differs too. First-party cookies are set by the same domain serving the main webpage content. Third-party cookies are set by external resources loaded within that webpage—images, scripts, iframes, or other embedded content. These cookies use site data and other site data from external domains to enable cross-site tracking, targeted advertising, and analytics, which raises important privacy considerations.

The privacy concerns surrounding third-party cookies

Third-party cookies raise significant privacy concerns for online users and web users, as they enable tracking and data collection across the web. These cookies allow advertisers and tracking companies to monitor web users' browsing activities across multiple websites, often without explicit user awareness or consent. Most people don’t realize that visiting a single webpage might share their information with dozens of tracking companies.

Privacy regulations and browser features, such as settings to prevent cross site tracking, are increasingly being implemented to protect user privacy and limit the reach of third-party cookies.

The scope of data collection can be extensive. Tracking companies don’t just know which websites you visit—they can build detailed profiles including:

• Browsing patterns and frequency

• Time spent on different types of content

• Shopping interests and purchase behavior

• Geographic location and movement patterns

• Device characteristics and technical specifications

• Social connections and interests

Collecting user data via third-party cookies is a major driver of digital advertising, enabling advertisers to deliver targeted ads to online users based on their interests and behaviors, even as GDPR changes in 2025 tighten consent and transparency expectations.

This data often gets combined with offline information purchased from data brokers, creating comprehensive profiles that extend far beyond web browsing. The profiles can reveal sensitive information about health conditions, financial status, political beliefs, and personal relationships.

Users have little control over this data collection. The tracking happens invisibly, and most people don’t know which companies have collected their information or how to opt out, or how to exercise their rights through data subject request (DSR) processes. Even when opt-out mechanisms exist, they’re often difficult to find and use.

The persistence of tracking creates additional concerns. These profiles can follow users for years, potentially affecting future opportunities in employment, insurance, credit, and other areas where data-driven decisions are made.

Cookie consent laws and regulations

Privacy regulations worldwide have started addressing third-party cookie tracking. The European Union’s General Data Protection Regulation (GDPR) requires explicit consent for non-essential cookies, including most third-party tracking cookies, grounding these rules in the seven core principles of GDPR compliance.

GDPR treats cookies as personal data when they can identify individuals or track their behavior. This means websites must:

• Obtain clear, specific consent before setting non-essential cookies

• Provide detailed information about what data is collected and why

• Allow users to withdraw consent easily

• Ensure cookies are only set after consent is given

Regulations like GDPR and CCPA require websites to disclose their use of third-party cookies and provide users with options to opt-out, highlighting the importance of user consent in data privacy. Website owners must manage third party cookies carefully to comply with these regulations, ensuring transparency and clear consent mechanisms, often relying on dedicated GDPR compliance software like ComplyDog to operationalize these requirements.

These requirements led to the proliferation of cookie consent banners across websites. Organizations now need robust GDPR cookie compliance implementation to avoid legal risk. But many of these banners use “dark patterns“—deceptive design techniques that manipulate users into accepting all cookies. Common dark patterns include:

• Making “Accept All” buttons more prominent than “Reject All”

• Hiding rejection options behind multiple clicks

• Using confusing language to obscure choices

• Pre-selecting consent options

• Making rejection processes unnecessarily complex

Website owners should provide users with clear options to manage third party cookies, including the ability to block cookies or enable third party cookies in their browser settings, to enhance user trust and comply with privacy laws.

Some websites chose a different approach: geoblocking. Rather than implement proper consent mechanisms, they simply block users from countries with strong privacy laws. This effectively denies people access to information and services based on their location.

Other privacy regulations with cookie implications include the California Consumer Privacy Act (CCPA), Brazil’s Lei Geral de Proteção de Dados (LGPD), and various national implementations of the EU ePrivacy Directive requirements.

How browsers are blocking third-party cookies

Major web browsers have moved aggressively to block third-party cookies by default. This shift reflects growing user demand for privacy protection and regulatory pressure on tech companies. Users can also block cookies, including third-party cookies, in browsers like the Chrome browser and Google Chrome through their privacy settings.

Safari led the charge, implementing Intelligent Tracking Prevention (ITP) in 2017. ITP uses machine learning to identify tracking domains and automatically blocks their cookies. Safari now blocks all third-party cookies by default, with limited exceptions for legitimate use cases. Safari also offers a "Prevent Cross Site Tracking" feature, which users can enable or disable to further control how sites track their activity across the web.

Firefox followed with Enhanced Tracking Protection, which blocks third-party tracking cookies by default while allowing some functional cookies. The browser maintains lists of known tracking domains and prevents them from setting persistent identifiers.

Chrome took a more gradual approach. The Chrome browser implemented third-party cookie blocking in Incognito mode first, then began testing broader restrictions. Google Chrome initially planned to phase out third-party cookies entirely by late 2024, but reversed this decision in July 2024, citing concerns about industry readiness and regulatory approval.

Other browsers have taken varied approaches:

Browser	Third-party cookie policy
Safari	Blocked by default with ITP and Prevent Cross Site Tracking
Firefox	Blocked by default with Enhanced Tracking Protection
Chrome	User choice (blocking coming)
Edge	Blocks known trackers
Brave	Blocked by default
Even browsers that still allow third-party cookies provide user controls to disable them. Privacy-focused browsers like Brave and Tor Browser block tracking by default, treating user privacy as a fundamental right rather than an optional feature.

The technical implementation varies, but most browsers now use some combination of:

• Tracking domain blacklists

• Machine learning algorithms to identify tracking behavior

• Heuristic analysis of cookie usage patterns

• User-configurable privacy settings

Additionally, website owners can use tools like Google Tag Manager and broader GDPR compliance software tools to help manage and block third-party cookies, ensuring compliance with evolving privacy settings and regulations.

Alternatives to third-party cookies

The advertising and analytics industries are developing numerous alternatives to third-party cookies. These solutions aim to maintain targeting capabilities and deliver targeted ads while addressing privacy concerns, though with mixed success.

Browser-based targeting keeps user interest data locally in the browser rather than sending it to external servers. Google’s Privacy Sandbox includes several such proposals:

• Topics API: Browsers categorize user interests locally and share general topics with advertisers

• FLEDGE: Enables remarketing without cross-site tracking

• Attribution Reporting: Measures ad effectiveness without detailed user tracking

Server-side identification uses various techniques to identify users without cookies:

• Browser fingerprinting analyzes technical characteristics like screen resolution, installed fonts, and system specifications

• IP address tracking (though this becomes less effective with VPNs and shared networks)

• Login-based tracking through social media or email accounts

Additionally, server side tracking is emerging as a privacy-compliant alternative, allowing data to be sent, processed, and managed centrally on the server, reducing reliance on client-side cookies and enhancing data security.

First-party data strategies involve businesses collecting information directly from their customers:

• Email-based identification and segmentation

• Customer loyalty programs with explicit data sharing

• Progressive profiling through voluntary information sharing

• Zero-party data where customers actively provide preferences

First-party cookies can personalize user experience by remembering settings such as language preferences, making website interactions more tailored to individual users.

Consent-based tracking attempts to maintain cookie-based tracking with proper user permission:

• Transparency and Consent Framework (TCF) standardizes consent mechanisms

• Consent management platforms (CMPs) handle user preferences across websites

• Global Privacy Control allows users to signal privacy preferences automatically

Collaborative identification involves multiple parties sharing limited data:

• Clean rooms allow data analysis without exposing raw user information

• Hashed email matching connects customer databases without sharing personal details

• Probabilistic matching uses statistical techniques to infer user connections

Contextual advertising uses the content of the webpage to determine which ads to show, rather than relying on user data. This method does not require tracking users across websites, offering a privacy-friendly approach to ad targeting.

Many of these alternatives raise their own privacy concerns. Browser fingerprinting, for example, can be even more invasive than cookies because users can’t easily detect or block it. The effectiveness of privacy-preserving alternatives remains unclear, and some may simply shift the privacy problem rather than solving it.

Technical mechanisms behind cookie tracking

Third-party cookie tracking relies on the fundamental architecture of the web. When browsers load web pages, they automatically request resources from multiple domains—images, scripts, stylesheets, and other content. Third party cookies are created when a website loads resources from a third party domain, often via a JavaScript file, which sets cookies on the user's device. These requests trigger the setting of cookies by the third-party domain, enabling tracking and personalization across sites.

The process works through HTTP headers. When a browser requests a resource from tracker.com, it automatically includes any existing cookies from that domain in the request headers. The server can then set new cookies or update existing ones in the response headers.

Cookie attributes control how tracking works:

• Domain: Specifies which domain can access the cookie

• Path: Limits cookie access to specific URL paths

• Expires/Max-Age: Sets cookie lifetime

• Secure: Requires HTTPS for cookie transmission

• SameSite: Controls cross-site cookie behavior

The SameSite attribute has become particularly important for privacy. It can be set to:

• None: Allows cross-site cookie transmission (required for third-party cookies)

• Lax: Blocks most cross-site requests but allows some navigation

• Strict: Blocks all cross-site cookie transmission

Modern browsers require third-party cookies to explicitly set SameSite=None and use HTTPS. This makes tracking more difficult and provides users with better security.

JavaScript also plays a role in tracking. A JavaScript file loaded from a third-party service can read and write cookies using the document.cookie API, enabling sophisticated tracking behaviors. Third-party scripts can coordinate tracking across multiple domains and implement fallback mechanisms when cookies are blocked.

Some tracking systems use multiple techniques simultaneously:

• HTTP cookies for primary identification

• Local storage for backup identification

• Session storage for temporary tracking

• Browser fingerprinting as a cookieless fallback, using device characteristics such as browser version, screen resolution, and operating system

• URL parameters to pass tracking information between sites

Methods to bypass cookie blocking

Tracking companies have developed various techniques to circumvent cookie blocking, though browsers and privacy regulations are responding with countermeasures.

CNAME cloaking involves website operators creating DNS records that make third-party domains appear to be first-party. For example, analytics.example.com might actually point to a tracking company’s servers, making their cookies and tracking requests appear to come from example.com rather than other websites or different websites, thus disguising the true origin of the data collection.

Server-side proxying routes tracking requests through the website’s own servers. This makes all tracking appear to originate from the first-party domain, bypassing browser restrictions on third-party requests from other websites. But it requires active cooperation from website operators and can be expensive to implement.

Subdomain tracking uses different subdomains of the same domain for tracking purposes. Cookies set on .example.com are accessible to all subdomains, allowing tracking across different parts of a website or related properties.

Browser storage alternatives replace cookies with other storage mechanisms, which can also be used to store other site data:

• Local storage persists data beyond browser sessions

• Session storage maintains data during individual browsing sessions

• IndexedDB provides more sophisticated local data storage

• Web SQL databases (though support is declining)

Legitimate cross-site storage needs are sometimes addressed using the Storage Access API, which allows controlled access to storage for embedded content from other websites.

Fingerprinting techniques identify users without storing any local data:

• Canvas fingerprinting uses HTML5 canvas rendering differences

• Audio fingerprinting analyzes how devices process sound

• WebGL fingerprinting examines graphics card characteristics

• Font fingerprinting detects installed fonts and rendering variations

Timing attacks use network latency and response times to infer information about users and their connections. These attacks can sometimes identify users even when all other tracking methods are blocked.

Privacy-focused browsers are implementing countermeasures against these bypass techniques. Safari’s ITP detects and blocks CNAME cloaking. Firefox includes fingerprinting protection. Chrome is adding restrictions on storage APIs and fingerprinting vectors.

The cat-and-mouse game between trackers and privacy advocates continues, with each side developing new techniques to circumvent the other’s efforts.

The future of web tracking

The web is moving toward a more privacy-conscious model, driven by third party cookie deprecation and regulatory changes. Google planned to phase out third-party cookies, but reversed course in July 2024, opting instead for a more gradual transition and pilot schemes.

Privacy Sandbox and similar initiatives represent the tech industry’s attempt to balance advertising needs with user privacy. Google's Privacy Sandbox initiative aims to replace third-party cookies with privacy-focused tools that allow for interest-based advertising without compromising user privacy. These systems aim to provide targeting capabilities without cross-site tracking, using techniques like:

• Local processing of user data

• Aggregated reporting instead of individual tracking

• Differential privacy to protect individual users

• On-device ad auctions and selection

Regulatory pressure will likely increase, with more countries implementing privacy laws similar to GDPR. Enforcement is becoming stricter, with larger fines and faster resolution of privacy complaints. This regulatory environment makes privacy compliance a business necessity rather than just an ethical consideration.

User awareness and demand for privacy protection continues growing. Browser market share increasingly favors privacy-focused options, and users actively seek out privacy tools and services. This creates market pressure for better privacy practices.

Technical standards are evolving to support privacy by default. New web standards increasingly include privacy protections, and older standards are being updated to close privacy loopholes.

Business model changes may be necessary for some companies that rely heavily on third-party tracking. Publishers and advertisers are experimenting with:

• Subscription-based models

• First-party data strategies

• Contextual advertising based on content rather than user behavior

• Privacy-preserving measurement techniques

The transition won’t be smooth. Some legitimate uses of third-party cookies will break, requiring technical solutions and user education. Smaller websites may struggle with the technical complexity of implementing alternatives. And some tracking will likely shift to less transparent methods.

But the overall direction is clear: the web is moving away from pervasive cross-site tracking toward more privacy-respecting alternatives. The exact technical solutions are still evolving, but user privacy is becoming a fundamental design principle rather than an afterthought.

How businesses can prepare for a cookieless world

Companies that rely on third-party cookies for marketing, analytics, or other business functions need to start preparing now for a cookieless future . The transition requires both technical changes and business strategy adjustments.

Audit current cookie usage to understand what might break when third-party cookies are blocked. Many businesses don't fully know which services they use set third-party cookies or how those cookies support business functions. A comprehensive audit should identify:

• All third-party services and their cookie requirements

• Business processes that depend on cross-site tracking

• User experiences that might be affected

• Legal and compliance implications

Test with third-party cookies disabled to identify problems before they affect real users. Most browsers allow users to disable third-party cookies, and some provide developer tools specifically for testing cookieless scenarios. Regular testing can catch issues early and guide technical remediation efforts.

Develop first-party data strategies that don't rely on third-party tracking. This might involve:

• Improving customer data collection through direct relationships

• Building customer loyalty programs that encourage data sharing

• Creating valuable content that motivates users to provide information voluntarily

• Implementing progressive profiling to gather information over time

Implement privacy-preserving alternatives where cross-site functionality is necessary. Options include:

• Storage Access API for legitimate cross-site storage needs

• CHIPS (Cookies Having Independent Partitioned State) for partitioned cookies

• Federated Credential Management for identity use cases

• Privacy Sandbox APIs for advertising and measurement

Update privacy policies and consent mechanisms to reflect changes in data collection practices. Users need clear information about how their data is collected and used, especially as tracking mechanisms become more complex and less visible.

Train staff on privacy-preserving practices and new technical requirements. The shift away from third-party cookies requires new skills and knowledge across technical, marketing, and legal teams.

Monitor regulatory developments in jurisdictions where the business operates. Privacy laws are evolving rapidly, and compliance requirements may change as governments respond to new tracking technologies.

Consider compliance software to manage the complexity of privacy regulations and technical requirements. Platforms like ComplyDog help businesses track regulatory changes, implement proper consent mechanisms, conduct privacy audits, and maintain compliance across multiple jurisdictions. As privacy requirements become more complex and enforcement increases, comprehensive compliance tools become valuable for managing risk and ensuring ongoing adherence to evolving regulations.

The cookieless transition represents both a challenge and an opportunity for businesses to build more transparent, trust-based relationships with their customers while maintaining effective marketing and analytics capabilities.