Third-party cookies are small text files stored on a user’s device while browsing, but they do not come from the website being visited at that moment. They are set by a domain other than the one shown in the browser’s address bar, typically by ad networks, analytics systems or embedded services such as maps, videos and social buttons. They work because the browser, when it loads a page, can request external resources and receive instructions from them to store information.
In SEO and digital marketing, third-party cookies played a central role for years, because they made it possible to track user behavior across multiple sites and build detailed advertising profiles. Privacy regulations, in particular the European Union’s General Data Protection Regulation, have progressively limited these practices, requiring explicit consent and clear information. The main browsers have then started a gradual phase-out of this technology, reducing its effectiveness and pushing operators toward less invasive alternatives.
What sets a third-party cookie apart
A cookie is a set of data that a server sends to the user’s browser and that the browser returns to the server on every subsequent request to the same domain. When the domain that sets the cookie matches the domain of the site being visited, it is a first-party cookie; when it belongs to a different party, it is a third-party cookie. This distinction depends solely on the origin of the cookie, not on its purpose or its duration.
From a technical point of view, the mechanism relies on the browser’s ability to load remote resources within a page. An embedded element, such as an ad banner or a visit counter, can send the browser an instruction to store a unique identifier. The same identifier is then recognized when the user visits other sites that use the same service, making it possible to link different visits to a single profile.
Difference from first-party cookies
First-party cookies are set by the domain the user is visiting and generally serve to remember preferences, language, login status or cart contents. Third-party cookies, by contrast, are set by external domains and are mainly used for profiling and cross-site measurement. The distinction also matters legally, because the two categories are subject to different consent requirements depending on their purpose.
The purposes they are set for
Third-party cookies can be grouped by the purpose pursued by the party that sets them. The most common classification distinguishes between technical, analytical, advertising and profiling purposes. Each category has different implications for user privacy and for the disclosure and consent obligations required by law.
Analytical cookies managed by external providers
These are used to collect statistical data on visits, such as the number of users, the most viewed pages and where traffic comes from. When the analytics tool is provided by an external party and does not fully anonymize the data, the cookie counts as a third-party cookie. This information is valuable for optimizing a site and improving its ranking in search engines.
Tailored ads and cross-site profiling
These are used to show ads that match the user’s interests and to measure their effectiveness. Profiling works by combining data collected across multiple sites and building audience segments. It is precisely this ability to follow the user across different domains that has made third-party cookies the target of strong criticism and increasingly strict regulatory action.
Cookies compared with other tracking techniques
Alongside third-party cookies there are other tracking techniques, some of which are gaining ground just as cookies lose effectiveness. The following table compares the main characteristics of the most widespread solutions.
| Technology | Typical origin | Duration | Tracking scope |
|---|---|---|---|
| First-party cookies | Visited domain | Variable | Single site |
| Third-party cookies | External domain | Variable | Multiple sites |
| Device fingerprinting | Page code | Persistent | Multiple sites |
| Proprietary identifiers | Platform | Variable | Platform ecosystem |
| Browser local storage | Visited domain | Variable | Single site |
What European law requires
In Europe, the processing of personal data through cookies is governed by the General Data Protection Regulation and by the ePrivacy Directive, as transposed in each member state. For cookies that are not strictly necessary for the site to function, prior, freely given, specific and revocable consent is required. The user must also receive clear information about the purposes and the third parties involved.
Supervisory authorities have repeatedly stressed that consent cannot be assumed or obtained through misleading interfaces, such as banners that make accepting easier than refusing. Refusing must be as easy as accepting, and a lack of consent cannot block access to the site’s content.
The consequences for measurement and attribution
The gradual reduction of third-party cookies has significant consequences for SEO and marketing strategies. Conversion measurement and visit attribution become less precise, while the importance of first-party data and consent-based tracking grows. Companies are pushed to invest in quality content, direct relationships with their audience and analytics tools that are proprietary or declared compliant.
Recommended activities for anyone who runs a website
Managing third-party cookies properly requires a combined approach across technical, legal and communication aspects. Below are the main activities recommended for anyone who runs a website.
- Inventory all third-party cookies on the site, noting their origin, purpose and duration.
- Update the cookie policy with clear, easy-to-understand language.
- Implement a consent management system that meets regulatory requirements.
- Make sure refusing is as simple as accepting and that no non-essential cookie is activated before consent.
- Record and keep evidence of the consent obtained from users.
- Periodically review the third parties involved and update the list when providers change.
- Where possible, prefer analytics tools that do not require cross-site tracking.
- Train internal staff on the legal and technical implications of cookie management.
Frequently asked questions
What is the difference between first-party and third-party cookies?
First-party cookies are set by the domain the user is visiting, while third-party cookies come from a different domain. The difference concerns the origin of the cookie, not necessarily its purpose.
Are third-party cookies always prohibited?
No, they are not prohibited outright, but their use is subject to user consent when they are not strictly necessary. The rules vary depending on the purpose and the applicable law.
Why are browsers removing them?
The main browser makers have started a phase-out to address privacy concerns and requests from supervisory authorities. The stated goal is to reduce non-transparent cross-site tracking.
What alternatives exist for online advertising?
Alternatives include platforms’ proprietary identifiers, contextual techniques and data collected directly by publishers with user consent. No solution, however, has fully replaced third-party cookies.
How can I block third-party cookies in my browser?
The privacy settings of modern browsers let you block third-party cookies or limit them selectively. Most programs also offer browsing modes that prevent tracking across different sites.
Do third-party cookies affect search engine ranking?
They do not directly affect ranking, which depends on content, usability and authority. They can, however, have an indirect effect, because without them it is harder to measure user behavior and optimize campaigns.
From the glossary to the projectAre your Google Ads campaigns delivering what they should?Google Ads management covers setting up, monitoring and optimizing campaigns based on measured results.Discover Google Ads management