A cookie is a small file that a website stores on your computer to remember information about you
When you visit a website, the server can ask your browser to save a tiny text file — usually a few kilobytes — on your hard drive. That file is called a cookie. The next time you visit that same website, your browser automatically sends the cookie back to the server. The server reads it and knows something about you: that you've been there before, what you looked at, whether you're logged in, or what's in your shopping cart.
Cookies are not programs. They cannot run code, steal files, or infect your computer. They are plain text — just data. But they are also the reason websites can recognize you, remember your preferences, and track your behavior across the internet. Understanding what they do and who can read them is the foundation for making choices about your own privacy.
Key Takeaways
- Cookies are text files that websites store on your device to remember information about you between visits.
- First-party cookies come from the website you're visiting; third-party cookies come from advertisers or analytics companies and track you across multiple sites.
- Session cookies disappear when you close your browser; persistent cookies stay on your device for weeks, months, or years.
- You can see what cookies a website has stored, delete them, or block new ones from being set — the controls are in your browser settings.
- Blocking all cookies may break some website features, so the real choice is deciding which trade-offs fit your own comfort level.
How a cookie actually gets stored and sent back
The process is straightforward. You type a URL into your browser and press Enter. Your browser connects to the website's server and asks for the page. The server sends back the HTML, images, and other files — and it can also include an instruction that says "please store this cookie on the user's device." Your browser obeys and saves the file, usually in a folder like AppData\Local\Google\Chrome\User Data\Default\Cookies on Windows or ~/Library/process Support/Google/Chrome/Default/Cookies on Mac.
The cookie contains a few pieces of information: a name, a value (which might be a random ID number or a username), the domain it came from, an expiration date, and sometimes a path or security flag. When you visit that website again, your browser automatically reads the cookie file and includes it in the request it sends to the server. The server checks the cookie, recognizes you, and can load your preferences, your login status, or your shopping cart without asking you to log in again.
This is why you stay logged into Gmail or Facebook even after closing the browser — the cookie remembers your session. It's also why Amazon shows you products similar to ones you looked at last week. The cookie told the server what you browsed.
First-party cookies versus third-party cookies
A first-party cookie comes from the website you're actually visiting. If you go to nytimes.com, the New York Times server sets a cookie on your device. That cookie can only be read by nytimes.com servers. It helps the site remember your login, your reading history, or your font size preference. First-party cookies are generally considered less invasive because they stay within one website.
A third-party cookie comes from a different domain — usually an advertising network or analytics company — embedded in the page you're visiting. If you go to a news site, that site might include an ad from Google or Facebook. When the ad loads, Google or Facebook can set a cookie on your device. That cookie can then be read by Google or Facebook on any other website that also includes their ads or tracking code. This is how advertisers follow you across the internet and build a profile of your interests, your location, your income level, and your browsing habits.
Third-party cookies are the reason you see ads for shoes on a completely different website after you looked at shoes on Amazon. The advertiser's cookie told them you were interested in shoes, and they're now showing you relevant ads everywhere they can reach you.
Session cookies and persistent cookies
A session cookie has no expiration date set, or it's set to expire when you close your browser. When you shut down Chrome or Safari, the cookie is deleted from your device. Session cookies are usually used for temporary things: keeping you logged in during a single browsing session, holding items in your shopping cart, or tracking which page you're on.
A persistent cookie has an expiration date set weeks, months, or even years in the future. It stays on your device even after you close the browser and shut down your computer. When you visit that website again next month, the cookie is still there, and the server can read it. Persistent cookies are used for things like remembering your login credentials, your language preference, or your advertising profile. Advertisers use persistent cookies to track you over long periods and build detailed profiles of your behavior.
What information cookies actually contain
Most cookies contain very little information themselves — usually just an ID number or a token. The real data lives on the server. When your browser sends the cookie back, the server looks up that ID in its database and retrieves everything it knows about you: your username, your purchase history, your location, your device type, the pages you've visited, and the time you visited them.
However, some cookies do contain readable information. You can open your browser's developer tools and see the actual text of a cookie. You might see something like user_id=12345 or language=en or dark_mode=true. These are not encrypted. Anyone with access to your device can read them. This is why you should never put passwords or credit card numbers in cookies — and legitimate websites don't.
The real privacy concern is not what's in the cookie itself, but what the server can infer from it. A single cookie ID, sent to an advertising network across hundreds of websites, creates a detailed map of your interests, your location, your income, your health concerns, and your shopping habits. That profile is then sold to other advertisers or used to target you with specific ads.
How to see, delete, and block cookies in your browser
Every major browser lets you view, delete, and control cookies. In Chrome, go to Settings > Privacy and Security > Cookies and other site data. You'll see a list of all the sites that have stored cookies on your device. Click on any site to see what cookies it has stored. You can delete cookies from individual sites or clear all cookies at once.
You can also set your browser to block third-party cookies automatically. In Chrome, this is under Settings > Privacy and Security > Cookies and other site data > Block third-party cookies. In Firefox, go to Settings > Privacy & Security > Enhanced Tracking Protection and choose "Strict". In Safari, go to Preferences > Privacy > Prevent cross-site tracking. These settings block most advertising cookies while still allowing first-party cookies so websites can function normally.
If you block all cookies, some websites may not work properly. You might not be able to log in, your shopping cart might not save, or pages might load slowly. This is the real trade-off: more privacy means less convenience. Most people find a middle ground — blocking third-party cookies but allowing first-party ones, or clearing cookies when they close the browser.
Why websites use cookies instead of other methods
Cookies are straightforward, fast, and they work across all browsers and devices. A server could store information about you in its own database and ask you to log in every time, but that's slower and more annoying. Cookies let websites remember you without requiring a password for every visit.
Advertisers use cookies because they're the easiest way to track people across the internet. Before cookies existed, there was no way to follow a single person from one website to another. Cookies made targeted advertising possible, which made the internet free for most people — because websites could sell ads instead of charging subscriptions. The trade-off is that your behavior is now tracked and sold.
Some websites are moving toward alternatives like first-party data (information you give them directly) or privacy-preserving technologies that don't require tracking individual users. But cookies remain the dominant method because they're cheap, effective, and already built into every browser.
Frequently Asked Questions
Can a cookie steal my password or credit card number?
No. A cookie is a text file that a website stores on your device. It cannot access files on your computer, run programs, or steal information you haven't put in the cookie itself. Legitimate websites never store passwords or credit card numbers in cookies. If a website asks you to log in, that information goes to the server, not to a cookie.
If I delete my cookies, will websites still work?
Most websites will still work, but you may lose some convenience. You'll have to log in again, your shopping cart will be empty, and your preferences might reset. First-party cookies are usually necessary for a website to function properly. Third-party advertising cookies can be deleted without breaking anything except the advertiser's ability to track you.
Why do I see ads for things I just looked at on a different website?
A third-party cookie from an advertising network followed you. When you looked at shoes on Amazon, an ad network's cookie recorded that. When you visited a news site, that same ad network recognized your cookie and showed you shoe ads. This is called retargeting. Blocking third-party cookies in your browser settings will stop most of this tracking.
Is it safe to accept cookies from every website?
First-party cookies from legitimate websites are generally safe — they just remember your preferences and login status. Third-party cookies from advertisers are less risky than they used to be because browsers now block many of them by default. The real question is whether you're comfortable with your browsing behavior being tracked and sold. If you're not, block third-party cookies and clear your cookies regularly.
Do I need to accept cookies when a website asks me to?
That depends on the cookie. Some websites require you to accept cookies to use the site at all. Others let you reject non-essential cookies and still browse. You can usually click "Reject all" or "Manage preferences" to see which cookies are required and which are optional. Rejecting optional cookies won't break the website, but it may disable features like personalized recommendations.