Tracking knowledge base
A cookie can be classified along independent axes: first-party or third-party context, session or persistent lifetime, HTTP or JavaScript creation, partitioning, and purpose. Consent depends primarily on purpose and any applicable exemption, not the technical label.
Official sourcesThe same cookie can be first-party, persistent, set by an HTTP response, protected with HttpOnly, and used for a specific purpose. These labels describe different axes. None of them alone determines whether consent is required.
To decide what to document, block, or allow, separate five questions: in which context is the cookie sent, how long may it remain, how is it set and read, is its state partitioned, and above all what purpose does it serve?
A first-party cookie is used in the context of the site the person is visiting. A third-party cookie operates in a cross-site context, for example when an external service is loaded in an iframe or as a subresource. Effective scope also depends on Domain, Path, and SameSite attributes and on browser rules.
Browsers can block or restrict cross-site cookies regardless of the requested expiry. WebKit blocks cookies for cross-site resources by default and provides the Storage Access API for some embedded uses with mandatory user control.
Consent point: first-party does not mean “necessary.” An advertising identifier written on the site domain still has to be assessed by purpose. Conversely, calling something third-party does not replace analysis of the requested service and any applicable exemption.
Under RFC 6265, a cookie without Expires or Max-Age is retained until the end of the current session as defined by the user agent. A persistent cookie instead declares a maximum lifetime with Expires or Max-Age.
That duration is a technical intention, not a browser commitment. The browser may remove the cookie earlier because of quotas, privacy controls, or user action. Technical expiry is not, by itself, an appropriate legal retention period.
A server can create a cookie with the Set-Cookie response header; the browser later returns applicable cookies in the Cookie request header. A script can also create or read some cookies through document.cookie.
HttpOnly prevents exposure through browser scripting APIs. Secure limits transmission to secure channels. Domain and Path define sending scope. These attributes matter for security and operations, but do not create a consent exemption.
CHIPS lets an embedded service opt a cookie into partitioned storage. The browser then keeps a separate cookie jar for each top-level site, so the embedded service does not automatically receive the same value when it appears on another site.
Google’s documented implementation requires Secure with Partitioned. Partitioning limits cross-site reuse, but it does not automatically turn advertising or measurement into an exempt purpose.
Article 5(3) of the ePrivacy Directive, implemented in France through Article 82 of the Data Protection Act, covers storing information in terminal equipment or gaining access to information already stored there. Prior consent is the rule, with narrow exceptions for transmitting a communication and what is strictly necessary for a service explicitly requested by the person.
Depending on their actual configuration, exemption candidates include remembering a consent choice, necessary authentication and security, a requested shopping basket, expected interface preferences, load balancing, and some audience measurement that meets every CNIL condition.
Advertising, advertising measurement that uses trackers, social-sharing buttons, and cross-site browsing measurement generally require prior consent. Associated personal-data processing remains subject to GDPR even when terminal access is exempt.
The rule is not limited to cookies. EDPB Guidelines 2/2023 cover URL and pixel tracking, some local processing, and unique identifiers when they involve storage or access on terminal equipment.
This typology explains how to classify a cookie. To follow Google, Meta, and TikTok identifiers across URLs, browser storage, requests, and server payloads, open the tracking identifier atlas.
Terms such as first-party, session, HttpOnly, or partitioned are often treated as if they determined consent. They describe different properties. Mixing them up produces inaccurate inventories, misconfigured consent interfaces, and false compliance assurance.
Explore the official texts and documentation supporting this article.
Need to validate your architecture, media signals, or measurement plan before investing further? Let’s review it together.