A cookie is a small text file — usually a few kilobytes at most — that a website asks your browser to store and send back on every subsequent visit. That's the whole mechanism. Everything cookies get blamed or credited for, from staying logged into your email to being tracked across a dozen unrelated news sites, comes from this one simple trick of storing a small identifier and handing it back on request.
What's Actually Inside a Cookie
A typical cookie contains a name-value pair (like session_id=8f3a2c), an expiration date, and the domain it belongs to. It does not contain your password in plain text, and it can't reach into your files or run code on your machine — it's inert data, not a program. What makes cookies powerful is that the site reads that identifier on your next visit and looks it up in its own database, where the actual account details, cart contents, or tracking profile live. The cookie itself is just a claim ticket.
First-Party vs Third-Party: The Distinction That Matters
A first-party cookie is set by the site whose address is in your URL bar. When you log into your bank and it remembers your session, that's first-party — necessary, expected, and generally not privacy-invasive on its own.
A third-party cookie is set by a different domain embedded on the page you're visiting — an ad network, an analytics script, a social media "like" button widget. If that same ad network is embedded on hundreds of unrelated sites, it can recognize the same cookie on all of them and build a profile of which sites you visit, in what order, and how often. This cross-site tracking is what most cookie-related privacy concern is actually about, and it's also what most major browsers have moved to restrict by default over the past several years.
Session Cookies vs Persistent Cookies
- Session cookies have no set expiration and are deleted automatically when you close the browser. They're what keeps you logged in while you're actively using a site during one visit.
- Persistent cookies carry an explicit expiration date, sometimes years out, and survive browser restarts. These are what let a site remember you're logged in a week later without re-entering a password, but they're also what enables longer-term tracking.
Clearing Cookies in Chrome, Firefox, and Safari
Each major browser gives you both a nuclear option (clear everything) and a surgical option (manage per-site).
- Chrome: Settings → Privacy and security → Delete browsing data, or for per-site control, Settings → Privacy and security → Third-party cookies → Sites that can always use cookies / Manage exceptions.
- Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data, or Manage Exceptions to allow-list specific domains while blocking the rest.
- Safari: Settings → Privacy → Manage Website Data, which lists every site currently holding data on your Mac or iPhone and lets you remove entries individually.
Clearing cookies logs you out of essentially everything and forces sites to forget preferences like dark mode toggles or dismissed banners. It's a reasonable once-in-a-while reset, not something to do daily — the constant re-authentication defeats the convenience cookies exist to provide.
Cookie Consent Banners: What You're Actually Agreeing To
The cookie consent popups you see on nearly every site exist because of privacy regulations like the EU's ePrivacy Directive and GDPR, which require sites to get explicit permission before setting non-essential cookies. "Accept all" typically enables tracking and advertising cookies alongside functional ones; "Reject all" or "Manage preferences" usually lets the site still function while opting out of the tracking category specifically. The European Commission's guidance on this is publicly documented at commission.europa.eu if you want the regulatory detail behind why every site suddenly started asking.
Why Some Sites Break When Cookies Are Blocked
Shopping carts, multi-step checkout flows, and login sessions almost all depend on first-party cookies to track state between page loads. If a site suddenly logs you out repeatedly, drops items from your cart, or won't remember a language selection, check whether you've blocked first-party cookies for that domain specifically — that's a much more common cause than third-party blocking, which most sites are built to tolerate.
If you use a browser's private or incognito mode for a specific task, remember that cookies set during that session are simply discarded when the window closes — nothing carries forward to your normal browsing, which our guide to what private browsing actually does covers in more depth, including what it doesn't hide from your network or ISP.
Local Storage and Cookies Aren't the Same Thing
Modern sites increasingly use "local storage" and "IndexedDB" — separate browser storage mechanisms that hold more data than a cookie can and don't get sent with every request automatically. Clearing cookies alone sometimes leaves this other stored data behind. If you're trying to fully reset a site's memory of you, use the "Clear browsing data" option and make sure "Cookies and other site data" is checked, not just "Cookies" — the wording varies slightly by browser version but that broader category is what also removes local storage.