Third-party cookies are cookies created or set in the context of a website by a domain different from the primary domain the user is visiting. A cookie is a small piece of data stored by a browser and associated with a domain, allowing information to persist between requests or visits.
In a traditional advertising example, a person visits Website A, but a script or resource associated with advertising company B causes a cookie associated with B to be stored or accessed. If the same third-party service appears across multiple websites, that service can potentially recognise the same browser across those contexts and build information about browsing activity, subject to browser restrictions, consent requirements and technical implementation.
This is the technical basis behind many historical forms of cross-site tracking and behavioural advertising. Third-party cookies are therefore not simply "cookies from another website" in an everyday sense; they are browser identifiers associated with a domain other than the primary site context in which the user is interacting.
Third-party cookies became important to digital advertising because advertising and analytics companies could use identifiers across many participating websites. A publisher could place an advertising tag on its pages, while an advertising platform could use its own cookie to recognise a browser that had previously interacted with another participating site. Over time, repeated observations could contribute to an advertising profile containing interests, browsing patterns or audience classifications. This supported practices such as frequency capping, retargeting, audience segmentation and measurement.
Third-party cookies could also support embedded services, although not every third-party cookie was used for advertising. The important distinction is between the technical mechanism and its purpose: a third-party cookie could be used for functionality, analytics or advertising. Privacy concerns became especially significant when third-party identifiers were used to construct profiles across many unrelated websites without users having a clear understanding of the extent of tracking.
Third-party cookies differ from first-party cookies primarily by the domain context. A first-party cookie is generally associated with the website the user intentionally visits, while a third-party cookie is associated with another domain embedded in or interacting with that site. For example, a shop's own login cookie can help keep a customer signed in, whereas an advertising platform's cookie embedded on the shop's pages can identify the browser to the advertising platform.
The distinction is not identical to the distinction between "good" and "bad" cookies. First-party cookies can also be used for analytics, personalisation and tracking, and some may require consent under applicable rules. Third-party cookies are particularly significant because their cross-site nature can enable broader tracking. Modern browsers have increasingly restricted such tracking through blocking, partitioning and other technical controls, making the historical third-party-cookie ecosystem substantially different from the environment in which it originally developed.
Third-party cookies have also been affected by privacy and electronic-communications regulation. In the UK, cookies and similar tracking technologies can be subject to PECR, while processing associated personal data can additionally engage UK GDPR requirements. The ICO states that organisations are likely to need consent under e-privacy rules for many website cookies and online tracking methods, and that where consent is required, the UK GDPR standard of consent applies.
This means that a company cannot assume that because a cookie is technically provided by an advertising vendor, the vendor's involvement removes the site's compliance responsibilities. Website operators need to understand which technologies are deployed, what information they collect, their purposes, relevant third parties, and what consent or other applicable legal route is required. Cookie banners that obscure choices or treat continued browsing as automatic agreement can create compliance problems where valid consent is required.
Third-party cookies historically supported retargeting, where an advertising system could recognise a browser that had previously visited a particular website or viewed particular products and subsequently display related advertisements elsewhere. They could also support frequency capping by helping an advertising system estimate how often a browser had seen an advertisement. Attribution systems could use identifiers to associate advertising exposures with later actions. Audience platforms could combine signals from multiple sites to construct interest segments.
These capabilities contributed to the growth of programmatic advertising, but they also raised concerns about surveillance, transparency, data sharing and the creation of detailed behavioural profiles. The technical availability of a cross-site identifier does not itself establish that the resulting data is accurate or that its use is lawful. Modern privacy controls increasingly require advertisers and publishers to use alternative mechanisms or consented approaches for functions previously supported by unrestricted third-party cookies.
Browser technology has changed substantially because of privacy concerns and the technical risks associated with cross-site tracking. Major browsers have introduced restrictions such as blocking third-party cookies by default in some contexts, limiting cookie lifetime, partitioning storage and applying other anti-tracking measures. Browser behaviour can therefore differ by platform, version and configuration. This makes third-party cookies less reliable as a universal advertising identifier than they were historically.
Advertisers and publishers have consequently developed alternatives, including first-party identifiers, authenticated environments, contextual advertising, privacy-preserving measurement approaches and platform-specific advertising APIs. These alternatives have different technical and privacy properties and should not simply be described as equivalent replacements. The broader trend is toward reducing unrestricted cross-site identity linkage and giving users or browsers greater control over tracking.
Third-party cookies should also be distinguished from third-party data. A third-party cookie is a technical storage and identification mechanism, whereas third-party data describes information obtained from an external source. A company can use third-party data without using cookies, and a third-party cookie can technically exist without the resulting information being sold as a conventional third-party data product.
Similarly, contextual advertising does not require identifying a user across websites because it can select advertisements based on the content or context of the page. Behavioural targeting, by contrast, traditionally benefits from information about previous user activity. These distinctions matter because replacing third-party cookies with another identifier does not automatically eliminate privacy concerns if the replacement continues to enable extensive cross-site profiling. The underlying privacy issue concerns the collection, linkage, use and sharing of information, not merely the particular browser technology used to perform it.
Third-party cookies remain an important concept for understanding the history of digital advertising, even as their practical role has diminished in many environments. Their significance lies in demonstrating how a small browser-side identifier could enable a service operating across many websites to recognise a browser and connect interactions over time. The technology enabled useful functions but also created extensive opportunities for cross-site tracking.
Current implementations must be assessed according to the actual browser environment, applicable law, consent state, data flows and advertising purpose rather than assuming that every third-party cookie behaves identically. For marketers, the decline of unrestricted third-party-cookie tracking has increased the importance of first-party relationships, contextual signals, consented data and privacy-conscious measurement. For users, the key distinction is between a cookie's technical existence and the broader processing and profiling activities that may occur because of it.
