Skip to main content
Cookie Gate
Category: Tracking Technologies

Partitioned Cookies

Also known as: CHIPS, Cookies Having Independent Partitioned State, CHIPS, Partitioned attribute cookies
Simply put

Partitioned cookies are a browser privacy feature that keeps a third-party cookie tied to the specific top-level website where it was first set, so it cannot be read across different sites the user visits. This is intended to allow certain cross-site functionality to work while limiting the ability of third parties to track people from one website to another. The mechanism is enabled through a technical setting known as the Partitioned attribute, associated with the CHIPS (Cookies Having Independent Partitioned State) proposal.

Formal definition

Partitioned cookies, defined under the CHIPS (Cookies Having Independent Partitioned State) proposal, are cross-site cookies that a third party opts into by setting the Partitioned attribute. When set, the user agent partitions the cookie's storage by the top-level site: the cookie is only available in contexts whose top-level document is same-site with the top-level document under which the cookie was set, and it cannot be accessed from a different top-level site. This restricts a third-party cookie to the top-level site where it was initially established, which limits its use for cross-site tracking while preserving per-site third-party functionality. CHIPS originates as a Privacy Community Group proposal and a related IETF HTTP working group draft; support and behavior are browser-implementation-specific (initially associated with Chrome). This entry describes the technical mechanism only. It is a browser-level control and does not itself constitute or replace a legal basis for setting or accessing cookies; obligations under the ePrivacy Directive (and national implementations) for storing or accessing information on a device, and under the GDPR for any resulting processing of personal data, may still apply. Whether partitioned cookies fall within consent requirements depends on their purpose and applicable jurisdiction, and regulatory treatment of such technologies is not settled by the evidence here.

Why it matters

Partitioned cookies matter because they represent a shift in how browsers, rather than websites or regulators, constrain cross-site tracking at a technical level. For years, standard third-party cookies could be read across many different sites a user visited, enabling behavioral profiling and cross-site advertising. CHIPS narrows this by tying a third-party cookie to the single top-level site where it was set, so legitimate per-site functionality (such as embedded content or a widget that needs its own state on each host site) can continue while broad cross-site tracking through that cookie is limited. For privacy and compliance teams, this changes the practical risk profile of certain third-party integrations, though it does not change the legal analysis on its own.

Who it's relevant to

Web developers and engineering teams
Developers implementing embedded third-party content, widgets, or services that require per-site state are directly affected, because opting into the Partitioned attribute changes how and where those cookies can be read. Understanding that a partitioned cookie is scoped to a single top-level site is essential to avoid breaking functionality that previously relied on cross-site cookie access. Behavior is browser-implementation-specific, so testing across target browsers is advisable.
Privacy officers and data protection professionals
Privacy and DPO teams need to assess whether partitioned cookies still fall within consent requirements based on their purpose and the applicable jurisdiction. The Partitioned attribute may reduce cross-site tracking exposure, but it does not by itself satisfy obligations under the ePrivacy Directive (and national implementations) for storing or accessing information on a device, nor GDPR obligations for any resulting processing of personal data. This is a technical control that supports, but does not replace, a documented legal analysis.
Legal counsel and compliance teams
Counsel should be aware that the regulatory treatment of partitioned cookies is not settled by the available evidence and that requirements differ across jurisdictions such as the EU, the UK, and individual US states. Advising on whether a partitioned cookie requires consent (an opt-in model common in the EU) or falls under an opt-out framework requires examining the cookie's purpose and the relevant legal regime rather than relying on the technical mechanism alone.
Marketing and advertising compliance teams
Teams relying on third-party cookies for cross-site advertising and measurement should understand that partitioning is designed to limit cross-site tracking, which may affect the viability of certain measurement and targeting approaches that depend on reading a cookie across multiple sites. Planning for this constraint is relevant to how advertising technologies are configured, while consent and transparency obligations continue to apply depending on purpose and jurisdiction.

Inside CHIPS

CHIPS (Cookies Having Independent Partitioned State)
The browser mechanism that implements partitioned cookies, allowing a cookie set in a third-party context to be stored in a separate cookie jar keyed to the top-level site. This limits cross-site tracking by preventing the same third-party cookie from being shared across different top-level sites.
Partition key
The identifier, typically derived from the top-level site the user is visiting, that scopes a partitioned cookie. A third party embedded on site A and site B receives distinct, isolated cookie stores rather than a single shared one.
Partitioned attribute
The cookie attribute a developer sets (commonly alongside Secure) to opt a cookie into partitioned storage. Without this signal, the browser applies its default handling for third-party cookies, which varies by browser.
Consent implications
Partitioning is a technical control that constrains how cookies are shared, but it does not by itself determine the legal basis for setting them. Under the ePrivacy Directive and its national implementations, placing or accessing information on a user's device generally still requires prior consent unless the cookie is strictly necessary, and any resulting processing of personal data is separately governed by the GDPR.
Scope of applicability
Partitioned cookies are a browser-level feature and are one of several technologies (alongside pixels, local storage, SDKs, and fingerprinting) that may be used for cross-site functionality. Browser support and default behaviour differ between browsers and evolve over time.

Common questions

Answers to the questions practitioners most commonly ask about CHIPS.

Do partitioned cookies (CHIPS) remove the need for consent because they can't track users across sites?
No. Partitioning limits a cookie to the top-level site context in which it was set, which reduces cross-site tracking capability, but it does not by itself determine consent obligations. In most EU jurisdictions, the ePrivacy rules govern the storing of or access to information on a user's device regardless of whether the cookie is partitioned, and consent is generally required unless the cookie is strictly necessary. Whether a partitioned cookie is exempt depends on its purpose, not on its partitioned status. Any personal data processed via the cookie remains subject to the GDPR. You should assess partitioned cookies against the same consent framework you apply to other cookies.
Are partitioned cookies the same thing as third-party cookies just with a different name?
Not exactly. A partitioned cookie can still be set by a third-party domain, but its storage is keyed to the top-level site so it cannot be shared across different top-level sites. This differs from a conventional third-party cookie, whose shared storage across sites is what enables cross-site tracking. Partitioning changes the scope and isolation of the cookie rather than eliminating the third-party relationship. It is a technical mechanism affecting how the cookie behaves, and it does not change the legal categories or consent analysis that apply to the cookie's purpose.
How should partitioned cookies be represented in a consent management platform and cookie categorization?
Partitioned cookies should generally be categorized by their purpose, such as functional, analytics, or advertising, in the same way as non-partitioned cookies, rather than being treated as a separate exempt class. Whether a CMP surfaces the partitioned attribute in its cookie inventory or user-facing disclosures varies by tool. Because a CMP supports but does not replace legal judgment, you should confirm that your categorization reflects the actual function of each partitioned cookie and that consent is obtained where required. The precise disclosure expectations for partitioning are not settled and may depend on supervisory authority guidance in your jurisdiction.
Does setting the Partitioned attribute change how or when we need to obtain consent before the cookie is stored?
The timing of consent is generally driven by the ePrivacy requirement for prior consent before non-exempt storage or access, and this typically applies whether or not the Partitioned attribute is set. Adding the attribute affects the storage isolation of the cookie but does not create an exemption. In most EU jurisdictions you would still need to obtain valid consent before setting a non-essential partitioned cookie. The safest approach is to treat the presence of the attribute as irrelevant to the consent trigger and to rely on the cookie's purpose to decide whether prior consent is needed.
How does partitioning interact with cross-site functionality such as embedded content or single sign-on?
Because a partitioned cookie is isolated to the top-level site context, state set under one site is not available when the same embedded resource loads on a different site. This can affect features that historically relied on shared third-party cookie state, such as certain embeds or session sharing. Whether a given feature continues to work depends on how it is implemented and whether it depends on cross-site cookie access. You should test embedded content and authentication flows under partitioning, and coordinate with the relevant providers, since behavior may differ across browsers and evolving specifications.
Do we still need to log and keep records of consent for partitioned cookies?
Yes, where consent is the lawful basis for processing associated with the cookie, the record-keeping and consent-logging considerations that apply generally in the EU would apply to partitioned cookies as well. Partitioning does not remove any obligation to demonstrate that valid consent was obtained where it is required. If a partitioned cookie is strictly necessary and exempt from consent, then consent logging for that specific cookie would not arise for the same reason it would not for other essential cookies. Assess each partitioned cookie individually based on its purpose.

Common misconceptions

Partitioning a cookie removes the need to obtain consent for it.
Partitioning is a technical measure that limits cross-site sharing; it does not change the legal analysis. In most EU jurisdictions, the ePrivacy rules on storing or accessing information on a device still apply, so non-essential partitioned cookies typically require prior consent, and the GDPR still governs any personal data processed.
Partitioned cookies are the same as first-party cookies and therefore always exempt.
A partitioned cookie is still generally set in a third-party context; partitioning isolates its storage per top-level site rather than converting it into a first-party essential cookie. Whether consent is required depends on the cookie's purpose (for example analytics or advertising) rather than on whether it is partitioned.
Adopting partitioned cookies guarantees compliance with tracking rules everywhere.
Requirements differ across the EU, the UK, and individual US states, and enforcement positions evolve. Partitioning may help address certain cross-site tracking concerns but does not by itself guarantee compliance in any jurisdiction, and it does not replace legal judgement or a documented lawful basis.

Best practices

Classify each partitioned cookie by purpose (strictly necessary, functional, analytics, or advertising) and apply consent obligations based on that purpose rather than on the partitioning mechanism itself.
For non-essential partitioned cookies, obtain prior consent through your CMP where required in the EU and UK, and configure opt-out handling for applicable US state regimes, recognising that requirements differ by jurisdiction.
Set the Partitioned attribute deliberately and test behaviour across the browsers your audience uses, since default third-party cookie handling and support for partitioning vary between browsers and change over time.
Document the geographic and legal scope of your treatment of partitioned cookies, and confirm your consent records and logs capture them consistently with other cookies and similar technologies such as pixels, local storage, and SDKs.
Treat partitioning as a technical control that supports, but does not replace, a documented lawful basis and legal review; involve privacy or legal counsel before relying on it for compliance claims.
Monitor evolving browser behaviour and data protection authority guidance, and revisit your classification and consent configuration where interpretations remain contested or unresolved.