What are third-party cookies?

Key Concepts:

• Cookie: Small text data (name-value pair) stored by a browser on a user's machine.
• First-Party Cookie: Cookie set by the website the user is currently visiting (the top-level site).
• Third-Party Cookie: Cookie set by a domain different from the website the user is currently visiting (cross-site cookie).
• Iframe: HTML element that embeds another webpage within the current webpage.
• Cross-Site: Refers to requests or resources originating from a different domain than the top-level site.

What are Cookies?

A cookie is defined as a small piece of text data, consisting of a name and a value. This data is sent from a website and stored locally within a user's web browser. Subsequently, the stored cookie is sent back to the website's backend server with each request. Cookies enable websites to retain information about users across different pages or sessions.

Third-Party Cookies: Definition and Examples

A third-party cookie is a cookie set by a domain that is different from the domain of the website the user is currently visiting.

• Example 1: External Third-Party Services: Consider a website, cats.example, that includes content from other sites:

  • A map from catmap.example.
  • An advertisement from adtech.example.
  • An analytics script from analytics.example.
  • Any of these third-party sites can request the browser to store a cookie. For instance, analytics.example or adtech.example might use cookies to differentiate between users, while catmap.example could record a user's favorite cat locations.
  • The browser treats these cookies as third-party cookies because they originate from domains different from the top-level site, cats.example.

• Example 2: Iframes from the Same Company (Cross-Site):

  • cats.example might include an iframe from a microsite, cathire.example, even if both sites are owned by the same company.
  • An iframe is a webpage embedded within another webpage, implemented using the <iframe> HTML element.
  • Requests to cathire.example from cats.example are treated as cross-site because they are different domains.
  • If the cathire.example iframe sets a cookie, the browser treats it as a third-party cookie because it's not from the top-level site, cats.example.

Third-Party Cookies are Cross-Site Cookies

The video emphasizes that what are commonly called "third-party cookies" are more accurately described as "cross-site cookies." They can originate from:

• A genuine third party, such as the analytics.example JavaScript included on cats.example.
• A different site belonging to the same first party as the top-level site, such as the cathire.example iframe on cats.example.

Mechanisms for First-Party and Third-Party Cookies

The underlying mechanisms for communicating and storing first-party and third-party cookies are identical. A cookie, consisting of a name and a value, is sent from a backend web server, stored as text by the browser, and sent back to the server regardless of whether it's a first-party or third-party cookie. The key difference lies in the cookie's origin relative to where it is used, which determines how the browser handles it.

Conclusion

The video clarifies the concept of third-party cookies, emphasizing that they are essentially cross-site cookies. The distinction between first-party and third-party cookies lies not in the mechanism of storage or transmission, but in the relationship between the cookie's origin and the top-level site being visited. This distinction influences how browsers handle these cookies.