A cookie is a small piece of text a website asks your browser to store, then sends back to that same website on every later visit. Cookies are what let a site remember you're logged in, keep items in a cart between page loads, or recall that you already dismissed a banner. Without them, every page load would start from zero: no login sessions, no saved preferences, no persistent shopping cart.
Cookies aren't a security threat by themselves. They're a storage mechanism, and like any storage mechanism, what matters is what gets put in it and who can read it.
How a cookie actually works
When your browser requests a page, the server can respond with a Set-Cookie header containing a name, a value, and some rules: which domain it applies to, how long it lasts, and whether it requires HTTPS. Your browser stores that and attaches it back to every request to matching pages via a Cookie header, automatically, with no action from the visitor.
Most cookies hold something like a random session ID rather than your actual data. The real data (your cart contents, your account details) lives on the server, keyed to that ID. The cookie is the ticket stub that lets the server find your row in its own database again.
The three categories that matter
- Session cookies have no expiration date set. They vanish when the browser closes. Login sessions are often built this way, or with a short expiry that gets renewed on activity.
- Persistent cookies carry an explicit expiration date, sometimes months or years out. "Remember me" checkboxes and saved language preferences use these.
- First-party vs. third-party is about which domain set the cookie. A first-party cookie comes from the site you're visiting. A third-party cookie comes from something embedded on that page, like an ad network or an analytics widget on a different domain. Browsers have steadily restricted third-party cookies over the past few years, which is why so many ad and tracking scripts have migrated to other techniques.
Why sites need a cookie banner
Privacy laws in the EU (ePrivacy Directive, GDPR) and similar rules elsewhere require sites to get consent before setting non-essential cookies, meaning anything beyond what's strictly needed to make the site function. A login session cookie generally doesn't need consent. An analytics or ad-tracking cookie does. Regulators decided tracking without asking first isn't acceptable, and cookie banners are the result.
Clearing or blocking cookies
Every browser has a settings page for viewing and deleting stored cookies, usually under Privacy or Site Settings. Clearing cookies for a site logs you out of it and resets anything stored client-side, like a saved cart or a "don't show this again" preference. That's normal and expected, not a sign of a broken site.
Blocking all cookies outright breaks most modern sites, since login, checkout, and even basic navigation state often depend on them. Most browsers offer a middle ground: block third-party cookies while allowing first-party ones, which cuts down on cross-site tracking without breaking the sites you actually use.
On some setups, aggressive page caching can interfere with cookie-dependent features like login state or cart contents if a cached page gets served to a logged-in visitor. That's a caching configuration issue rather than a cookie problem, and it's a good reason to test logged-in behavior after changing cache settings.
When cookies cause a real problem
Check the simple explanations first before assuming anything is broken server-side.