Category: Tracking Technologies
HTTP Cookies
Also known as: web cookie, browser cookie, cookie
Simply put
An HTTP cookie is a small piece of data that a website sends to your web browser, which stores it on your device. Websites use cookies to remember information about you, such as keeping you logged in or tracking your browsing activity, so that the site can recognize you across pages or later visits. Because cookies can store or access information on your device, their use is subject to legal rules that vary by jurisdiction.
Formal definition
An HTTP cookie is a small block of data created by a web server and stored on a user's device by the browser, typically transmitted via the Set-Cookie response header and returned to the server on subsequent requests via the Cookie header. Cookies allow otherwise stateless HTTP interactions to maintain state, enabling functions such as session management, personalization, and tracking of browsing activity across pages or sessions. From a compliance perspective, the placing of and access to cookies (and functionally similar technologies such as pixels, local storage, SDKs, and fingerprinting) is governed in the EU and UK primarily by the ePrivacy Directive and its national implementations, which generally require prior consent for non-essential cookies, while any resulting processing of personal data is separately governed by the GDPR; obligations differ under other regimes such as US state privacy laws, which often rely on opt-out mechanisms. The classification of a given cookie (for example, strictly necessary versus analytics or advertising) determines whether consent is required and is a fact-specific assessment outside the scope of this technical definition.
Why it matters
HTTP cookies are the foundational technology that makes stateful web experiences possible, but they are also the primary mechanism through which websites can store or access information on a user's device and track browsing activity across pages and visits. Because of this dual role, cookies sit at the center of most cookie consent and privacy compliance obligations. Whether a given cookie can be set without user permission depends on its purpose: strictly necessary cookies (such as those maintaining a login session) are generally exempt from consent requirements in the EU and UK, while non-essential cookies used for analytics, advertising, or similar purposes typically require prior consent under the ePrivacy Directive and its national implementations.
Who it's relevant to
Privacy officers and data protection professionals
Those responsible for privacy compliance need to understand cookies because determining which cookies a site sets, and for what purpose, drives whether consent is required and how records must be kept. Because obligations differ between the EU, the UK, and individual US states, scope should always be confirmed for the jurisdictions in which a site operates.
Legal counsel and compliance teams
Counsel advising on cookie practices must distinguish the ePrivacy rules governing the placing of and access to cookies from the GDPR rules governing any resulting processing of personal data, and should recognize that consent standards and enforcement positions vary by jurisdiction and continue to evolve.
Web developers and engineers
Developers implement cookies through the Set-Cookie and Cookie headers and configure how state is maintained. They are typically responsible for ensuring that non-essential cookies are not set before consent is obtained where that is required, and for correctly handling functionally similar technologies such as pixels, local storage, and SDKs.
Marketing and analytics teams
Teams relying on analytics and advertising cookies are directly affected by consent requirements, since these categories generally require prior consent in the EU and UK and may be subject to opt-out mechanisms in other regimes. The lawful use of such cookies depends on facts specific to each deployment rather than on the technology alone.
Inside HTTP Cookies
Name-value pair
The core content of a cookie is a name and an associated value stored in the user's browser. This is the data the server sets and later reads to recognize a browser across requests.
Domain and path attributes
Attributes that scope which host and URL paths the cookie is sent to, determining whether a cookie is treated as first-party (set by the site the user visits) or third-party (set by another domain, such as an embedded service).
Expiration and duration
Cookies may be session cookies, which are typically deleted when the browser session ends, or persistent cookies, which carry an expiry date and remain until that date or until the user clears them. Duration is often relevant to whether and how information is disclosed to users.
Security and access attributes
Attributes such as Secure (restricting transmission to encrypted connections), HttpOnly (limiting script access), and SameSite (governing cross-site sending) that affect how and when a cookie is transmitted, which can be relevant to security and to first- versus third-party contexts.
Purpose-based categories
In a consent context, cookies are commonly grouped by function, for example strictly necessary or essential, functional, analytics, and advertising. Under EU law strictly necessary cookies are generally exempt from consent, while analytics, advertising, and functional cookies typically require prior consent; the technical mechanism does not by itself determine the category.
Related storage and tracking technologies
Technologies such as pixels, local storage, SDKs, and fingerprinting are not literally HTTP cookies but are used for similar purposes. In most EU jurisdictions the same rules on storing and accessing information on a device apply to them, so they are frequently addressed alongside cookies.
Common questions
Answers to the questions practitioners most commonly ask about HTTP Cookies.
Does setting an HTTP cookie always require user consent?
No. Whether consent is required depends on the cookie's purpose rather than the fact that it is an HTTP cookie. In most EU jurisdictions, under the ePrivacy Directive and its national implementations, cookies that are strictly necessary to provide a service the user has requested are generally exempt from consent, while analytics, advertising, and non-essential functional cookies typically require prior consent. The classification of a given cookie depends on its actual function, which is a fact-specific assessment. Requirements also differ outside the EU, several US state frameworks, for example, generally rely on opt-out rather than opt-in, so the geographic scope matters when determining what is required.
Are HTTP cookies the only tracking technology that consent rules apply to?
No. Although the ePrivacy rules in the EU are often described in terms of cookies, they concern the storing of, or access to, information on a user's device more broadly. Similar technologies, such as tracking pixels, local storage, software development kits (SDKs), and device fingerprinting, can fall within the same rules even though they are not literally HTTP cookies. To the extent any of these technologies process personal data, the GDPR applies to that processing as well. Focusing only on HTTP cookies can therefore leave other in-scope technologies unaddressed.
How should HTTP cookies be classified for consent purposes?
Classification is generally driven by the cookie's purpose, not its technical format. A common approach is to categorize each cookie as strictly necessary, functional, analytics, or advertising, based on what it actually does. In most EU jurisdictions, strictly necessary cookies are generally exempt from consent, while the other categories typically require prior consent. Because classification depends on the specific function and context of each cookie, it usually involves both technical review and legal judgment; a technology tool can support this process but does not replace that judgment. This entry does not resolve borderline cases, which may be contested.
When in the page-loading process should non-essential HTTP cookies be set?
In most EU jurisdictions, where prior consent is required, non-essential cookies should generally not be set before the user has given a clear affirmative indication of consent. This typically means suppressing analytics and advertising cookies until consent is recorded, rather than setting them on page load and removing them later. Strictly necessary cookies may generally be set without waiting for consent. The precise timing implementation depends on how your consent management setup and tag or script loading are configured, which is outside the scope of this definition.
How can the attributes of an HTTP cookie affect compliance and record-keeping?
Attributes such as the cookie's name, purpose, provider (first-party or third-party), storage duration, and category are commonly documented as part of a cookie inventory and consent disclosure. Providing this information helps support the requirement that consent be informed. Retention periods in particular may be relevant, as unnecessarily long lifespans can attract scrutiny. This entry does not prescribe specific durations, and appropriate values depend on the cookie's purpose and applicable guidance, which can evolve.
What should happen to existing HTTP cookies when a user withdraws or declines consent?
Where consent is the basis for non-essential cookies, users should generally be able to withdraw consent as easily as they gave it, and declining should be a genuine option. In practice this typically means that cookies relying on that consent are no longer set going forward, and organizations often also delete or neutralize previously set cookies for that user. The exact technical handling, including which cookies can be removed and how, depends on your consent management platform and site architecture, which are beyond the scope of this definition. Consent logging or record-keeping of these choices may also be required.
Common misconceptions
All cookies require consent before they can be set.
Requirements depend on the cookie's purpose and the applicable regime. In the EU and UK, strictly necessary or essential cookies are generally exempt from consent, while analytics, advertising, and functional cookies typically require prior consent. Under some US state frameworks such as California's CCPA and CPRA, obligations often rely on an opt-out model rather than prior opt-in. Scope and enforcement positions vary by jurisdiction.
Cookies and the personal data derived from them are governed by a single set of rules.
In the EU, the ePrivacy Directive and its national implementations govern the placing of and access to information on a device, while the GDPR governs any subsequent processing of personal data. These are distinct regimes, and consent or compliance under one does not automatically satisfy the other.
Only files literally called cookies fall within cookie consent rules.
Similar technologies such as pixels, local storage, SDKs, and fingerprinting can fall within the same rules on storing or accessing information on a user's device in most EU jurisdictions, even though they are not technically HTTP cookies. Whether a specific technology is covered can depend on facts not addressed by a general definition.
Best practices
Inventory all cookies and similar technologies in use, including pixels, local storage, SDKs, and fingerprinting, and record their name, domain, first- or third-party status, duration, and purpose.
Classify each cookie by purpose (for example strictly necessary, functional, analytics, or advertising) rather than by technical type, since the purpose generally drives consent obligations under EU and UK law.
Distinguish the ePrivacy obligations for placing or accessing information on a device from the GDPR obligations for any resulting personal data processing, and address each rather than assuming one satisfies the other.
Tailor consent and disclosure mechanisms to the applicable jurisdiction, recognizing that the EU and UK generally expect prior opt-in for non-essential cookies while some US state laws rely on opt-out signals.
Where consent is relied upon in the EU, ensure it is obtained through a clear affirmative action and avoid pre-ticked boxes, implied consent from continued browsing, and cookie walls, which are widely considered non-compliant.
Treat consent management tools such as CMPs as support for compliance rather than a guarantee of it, and combine them with legal review and appropriate records of consent, revisiting the approach as regulatory guidance evolves.
