What are cookies? A cookie is a small text file that a website asks your browser to save on your device. When you visit the site again, your browser sends the cookie back, so the site recognises you. That is how a website remembers that you are logged in, what is in your shopping basket, or that you chose the dark theme. A cookie is a memory aid, designed to make the web easier to use, and it is also the main way that companies track what you do online.
Every time you click Accept all cookies, you are making a trade. You get a site that remembers you, and in return you give a company information about what you read, watch and buy. This guide explains what are cookies in plain English, how they work, the difference between first-party and third-party cookies, why you see cookie banners everywhere, whether cookies are dangerous, and how to control them in your browser.
How Cookies Actually Work
When you first visit a website, the server can include a small instruction in its reply: please save this cookie. Your browser stores it in a file on your device, along with the name of the site that set it. The next time you load a page from that site, your browser reads its cookies and sends them back. The site checks them, sees that you are the same browser as before, and shows you the right content.
A cookie is a text file, and it is small. It might contain your language choice, a session code that says you are logged in, or an identifier that links your visits together. A cookie cannot run programs, it cannot read other files on your computer, and it cannot spread like a virus. What it can do is remember things, and what it remembers depends on the site that set it.
The name comes from magic cookies, old bits of data passed between programs, which were themselves named after fortune cookies. The name is strange, but the idea is simple: a small token that proves you have been here before. If you are unsure about a website itself, read our guide on how to tell if a website is safe before entering your details.
First-Party Cookies vs Third-Party Cookies
Not all cookies are the same, and the most important distinction is who set them. A first-party cookie is set by the website you are visiting. It remembers your login, your basket, your theme and your language. These cookies make websites work better, and they are usually helpful. If a site uses first-party cookies, the data is shared mainly with that site.
A third-party cookie is set by a different company from the one whose site you are visiting. The most common example is an advertising or analytics company whose code is embedded on many sites. When you visit a site with its code, that company sets a cookie on your device, and the next time you visit another site with the same company’s code, it can read the same cookie. That is how ads can follow you across the internet, showing you the same product on a news site, a video site, and a shop, even though those are different websites.
Browsers are now blocking third-party cookies. Google Chrome, Safari, Firefox and Edge all have plans to limit third-party cookies, and Apple and Mozilla have already blocked many of them. First-party cookies will remain, because websites need them to work.
Session Cookies vs Persistent Cookies
A session cookie lasts only as long as your visit. It is deleted when you close the browser. It is used for things such as keeping your shopping basket while you browse a shop, or staying logged in while you move between pages. A persistent cookie has an expiry date, which can be days, months or years in the future. It is used for things such as remembering you on a site, keeping your language preference, or holding an advertising ID that follows you from visit to visit.
Persistent cookies are given short lifetimes to stop people logging in every day. Many of them are deleted after 30 days, some after a year, but some older cookies were designed to last for two years. If you use a browser’s privacy mode, session cookies are kept until the private window closes, and most persistent cookies are deleted when you close the window, which is why some sites ask you to log in again after using private browsing.
Why Do Websites Ask You to Accept Cookies?
If you use the internet in Europe, you have seen a banner on almost every site asking you to accept cookies. This is due to European privacy law, especially the GDPR and the ePrivacy Directive, sometimes called the cookie law. The rule is that a site can use necessary cookies without asking, but it must ask before storing cookies used for advertising or tracking.
In practice, that means most sites put a big banner asking you to accept all cookies, and a smaller link where you can change the settings. Those banners exist because companies are required by law to get consent before using cookies for tracking. They are annoying because they were written to be legal, not to be helpful. You do not need to accept all cookies. The slower route through Manage preferences lets you decline the advertising and analytics trackers while still allowing the necessary ones that the site needs to work.
Are Cookies Dangerous?
A cookie is a text file, and it cannot harm your computer on its own. It cannot run programs, read your files, or spread like a virus. But a cookie can be used to track you, and a badly designed site can let an attacker use one against you. The main risk is called cookie theft or session hijacking. If an attacker can read your cookie for a site where you are logged in, they can copy the session code inside the cookie and use it to pretend to be you. That is how some account takeovers happen. That is one of the reasons that sites now encrypt cookies, mark them as secure, and expire sessions quickly.
That risk is small if you use a modern website with a secure connection (https), which encrypts cookies in transit. The bigger risk is what data is stored and who it is shared with. Cookies from advertising companies can be used to build a profile of your browsing, which is then used to target ads or to set the price you see for a product. You can browse more safely by using a VPN on public Wi-Fi, and by keeping your browser updated.
How to Control Cookies in Your Browser
Every browser lets you control cookies. In Chrome, go to Settings, then Privacy and security, then Third-party cookies. You can choose to block third-party cookies entirely, which most people should do, and keep first-party cookies, because a site needs them to remember you are logged in. In Safari, go to Settings, then Privacy, and turn on Prevent cross-site tracking. In Firefox and Edge, go to Settings, then Privacy, and choose Strict or Balanced tracking protection.
Clearing cookies is also useful. If you want to log out of everything, or you are using a shared computer, open Settings, find Cookies and site data, and clear it, then close the browser. Also check the exceptions list in your browser’s settings, and add sites for which you want to allow first-party cookies. After you block third-party cookies, a shopping site may need cookies from a payment provider, so add exceptions for sites you trust. If you want a browser with stronger privacy controls, our comparison of how to choose a web browser in 2026 can help you pick one.
For regular browsing, choose Reject all in a cookie banner when the choice is given, and block third-party cookies in settings. For the technical details, see the Wikipedia article on HTTP cookies.
Cookie Alternatives Trackers Use
When third-party cookies disappear, tracking will not stop. Companies are testing newer methods to identify browsers. One is fingerprinting, which builds a picture of a device from its screen size, operating system, fonts, language and timezone. If your browser’s fingerprint is unusual enough, a site can recognise you even without a cookie. Another is first-party data: a site can ask you to log in, or offer a loyalty programme, and then link your visits to that account.
That is why the privacy question is not just about cookies. It is about what data is stored, who it is shared with, how long it is kept, and whether you can see and delete it. The best habits are to use a privacy-friendly browser where you can, to block fingerprinting where your browser offers it, and to ask yourself what a service does with the data it collects.
Conclusion
What are cookies? They are small text files that websites ask your browser to save on your device, so the site remembers you when you come back. First-party cookies are set by the site you are on, make it work better, and are usually harmless. Third-party cookies are set by advertising and analytics companies, track you across sites, and are being blocked by modern browsers.
You can control cookies through the settings in your browser. Block third-party cookies, clear cookies on shared devices, and choose the Reject option in cookie banners instead of Accept all. Cookies cannot run programs, but what they remember can be shared, so it is worth knowing which cookies a site uses and how to control them.
Frequently Asked Questions
What are cookies in simple words?
Cookies are small files a website asks your browser to save on your device, so the site remembers you. They keep you logged in, remember your basket, and let companies track what you do online.
Should I accept all cookies?
Only if you do not mind being tracked by advertising and analytics companies. Choose the Reject or Manage preferences option when it is available, and block third-party cookies in your browser settings.
Are cookies bad for my computer?
No. Cookies are small text files that cannot run programs, cannot read your files, and cannot spread malware. The risk is privacy, not viruses.
What happens if I delete all cookies?
You will be logged out of most websites, and sites will forget your preferences. You can always log in again, and deleting cookies on a shared computer is a good habit.
What is the difference between a cookie and cache?
Cookies store information about you and your choices. The cache stores copies of files from a website, such as images, so pages load faster the next time you visit. They are both stored by your browser, but they do different jobs.