What Is a Cookie on a Website? Browser Cookies Explained

A cookie on a website is a small piece of text that a site (or embedded third-party service) asks your browser to store on your device. On future visits, the browser sends that cookie back to the server, letting the site remember who you are, what is in your cart, or which language you prefer. Cookies are not programs — they cannot run code or access your files — but they do carry identifiers that power much of the modern web, including advertising and analytics.

What It Is

When you load a webpage, the server may respond with an HTTP header like:

`

Set-Cookie: session_id=abc123; Path=/; Secure; HttpOnly

`

Your browser saves session_id=abc123 and attaches it to subsequent requests to the same domain. The server reads it and knows this browser session continues the same visit or logged-in user.

Cookies contain name-value pairs plus attributes:

• Expiration — session cookies die when you close the browser; persistent cookies last days or years
• Domain / Path — which URLs may receive the cookie
• Secure — sent only over HTTPS
• HttpOnly — JavaScript cannot read it (helps against some theft attacks)
• SameSite — limits cross-site sending (anti-CSRF and tracking mitigation)

First-party cookies come from the site you visit. Third-party cookies come from embedded ads, social widgets, or analytics on other domains — the focus of most privacy debates.

Why It Matters

Login sessions depend on cookies. Without them, you would re-enter credentials on every page click.

Shopping carts persist items as you browse — the cookie ties cart data to your browser before checkout creates an account.

Preferences — dark mode, currency, accessibility settings — often live in cookies or similar browser storage.

Analytics and advertising use cookies to count unique visitors, attribute ad clicks, and build interest profiles — valuable to businesses, controversial to privacy advocates.

Regulations like GDPR in Europe and CCPA in California require consent banners and disclosure for many non-essential cookies. Publishers and site owners must classify cookie purposes and offer opt-outs where mandated.

How It Works

Typical lifecycle:

1. You visit example.com.

2. Server sends Set-Cookie in the response.

3. Browser stores the cookie locally (per browser profile).

4. Next request to example.com includes Cookie: name=value.

5. Server personalizes the response — logged-in dashboard, filled cart, etc.

Cookie vs. local storage

localStorage and sessionStorage hold larger data client-side but do not automatically transmit on every HTTP request. Cookies excel at server-readable session state; storage APIs excel at client-side app data.

Clearing cookies

Browser settings let you delete all cookies or per-site. Clearing breaks saved logins and site preferences — expected tradeoff.

Blocking third-party cookies

Safari and Firefox limit third-party cookies by default; Chrome has phased similar restrictions. Advertisers adapt with first-party data and server-side tracking — the privacy landscape keeps shifting.

Common Examples

| Cookie purpose | What it remembers |

|----------------|-------------------|

| Login session | You are user #48291, stay signed in |

| Shopping cart | Three items pending checkout |

| Language | Display site in Spanish |

| A/B test bucket | Show variant B of homepage |

| Analytics (_ga) | Distinguish returning vs. new visitor |

| Ad tracking | Which ads you clicked recently |

The "Accept cookies" banner you see references these categories — essential, functional, analytics, marketing.

Common Misconceptions

"Cookies are viruses"

Cookies are plain text key-value strings. They do not execute code. Malware uses different mechanisms. Cookies can enable tracking, which feels invasive, but they are not viruses.

"Deleting cookies deletes my files"

Cookies store small identifiers, not your documents or photos. Deleting them logs you out of sites and resets preferences — nothing on your hard drive outside the browser profile.

"Incognito mode means no cookies ever"

Incognito limits persistence — cookies vanish when you close the window — but sites still set session cookies during that session. You are not anonymous to websites; only locally less remembered.

"All cookies are bad for privacy"

Strictly necessary cookies (login, security tokens) enable basic function. Privacy concerns focus on cross-site tracking and non-consensual profiling, not every cookie equally.

"HTTPS hides cookies from everyone"

HTTPS encrypts transit — observers on the network cannot read cookie contents easily. The destination server and third parties you allow still receive them.

The Takeaway

A website cookie is a small browser-stored text record that helps sites remember sessions, preferences, and analytics state. They are essential to modern login and commerce but central to privacy regulation when used for tracking. Understanding cookie types helps you make informed choices in browser settings and consent dialogs.

*This article is for general informational purposes only and does not constitute legal or privacy compliance advice.*