How browser cookies work: a plain guide

Every website seems to ask about cookies. This article explains what cookies actually are, what they store, and why the popup exists.

What a cookie is

A cookie is a small text file that a website stores in your browser. When you visit the site again, the browser sends the cookie back. This is how a site remembers you between visits.

Cookies were invented to solve a real problem: HTTP has no memory. Each request is independent. Without cookies, every page load would be a brand-new anonymous visitor, and "log me in" could not work.

What cookies store

A cookie holds a small amount of data: an identifier, a preference, an expiration time. Cookies cannot run code and cannot read your hard drive. They contain only what the site put in them — usually a randomly generated session ID.

Session cookies versus persistent cookies

• Session cookies — live only while the browser is open. They keep you logged in as you move between pages; they disappear when you close the browser.
• Persistent cookies — have an expiry date and survive restart. "Remember me" checkboxes create persistent cookies.

First-party versus third-party cookies

• First-party — set by the site you are visiting. They power logins, shopping carts and preferences.
• Third-party — set by a different domain, usually through embedded content (ads, analytics, videos). These are the tracking cookies used to build a profile of your browsing across sites.

The consent popup

The popup exists because of privacy laws — in Europe the ePrivacy directive and GDPR require sites to ask before setting non-essential cookies. "Accept all" typically allows advertising and analytics cookies. "Reject" or "necessary only" keeps only the cookies needed for the site to function.

How to control cookies

• Browser settings — block third-party cookies, or clear cookies when you close the browser.
• Site settings — most browsers let you inspect and delete cookies per site.
• Privacy modes — incognito/private windows discard cookies when closed.

FAQ

What is the difference between a session cookie and a persistent cookie?

A session cookie lives only while the browser is open and disappears when you close it — it keeps you logged in as you move between pages. A persistent cookie has an expiry date set by the site and survives browser restarts, which is how "remember me" checkboxes keep you signed in. The practical difference is lifetime: one ends with the browser session, the other with a date.

What is the difference between first-party and third-party cookies?

A first-party cookie is set by the site you are visiting and powers logins, carts and preferences. A third-party cookie is set by a different domain, usually through embedded ads, analytics or videos, and is used to build a profile of your browsing across sites. The first makes the web usable; the second is what privacy controls clamp down on.

Why does every site show a cookie consent popup?

Privacy laws require it — in Europe the ePrivacy directive and the GDPR demand that sites ask before setting non-essential cookies. "Accept all" typically allows advertising and analytics cookies; "Reject" or "only necessary" keeps only the cookies the site needs to function. The popup is the site asking for permission it is legally required to request.

Can cookies read my hard drive or run programs?

No. A cookie is just a small text file with the data the site put in it — usually a random session ID. Cookies cannot execute code and cannot read your hard drive; they contain only what the site stored. They are not programs and cannot act on their own.

Summary

Cookies are small files that give websites memory — they power logins, preferences and carts. The debates around them are mainly about third-party tracking. Understanding the difference between first- and third-party cookies is the practical part: the first makes the web usable, the second is what privacy controls clamp down on.