Category: Cookie Types

Third-Party Cookies

Also known as: cross-site cookies

Simply put

Third-party cookies are small text files placed on a user's device by a domain other than the website the user is actually visiting. They are commonly associated with cross-site tracking, advertising, and analytics, because the same third-party domain can recognize a user across many different websites. Because they typically serve purposes beyond what is strictly necessary to deliver a site, they generally require prior consent under EU rules, though obligations vary by jurisdiction.

Formal definition

A third-party cookie is a cookie set under a domain different from the top-level or first-party domain of the site the user is browsing, enabling the setting party to read and write state in a cross-site context. Functionally, this cross-site recognition underpins use cases such as ad targeting, conversion measurement, and cross-domain analytics. In the EU and UK, the ePrivacy Directive as implemented nationally governs the storing of and access to such cookies on a user's device and, for non-exempt purposes, generally requires prior, freely given, specific, informed, and unambiguous consent; any personal data subsequently processed also falls within the scope of the GDPR. These are separate legal requirements, and consent under one does not automatically satisfy the other. US state privacy regimes such as the CCPA/CPRA in California typically approach cross-site tracking through an opt-out model rather than opt-in, so applicable obligations depend on the relevant jurisdiction. The classification of a cookie as third-party turns on the domain that sets or accesses it rather than the file format, and similar cross-site tracking may also be achieved through pixels, SDKs, local storage, or fingerprinting, which fall within the same consent rules. Browser and platform restrictions on third-party cookies affect their technical availability but are distinct from, and do not replace, legal consent obligations.

Why it matters

Third-party cookies sit at the center of most cross-site tracking, advertising, and analytics activity, which makes them one of the most scrutinized technologies in cookie consent compliance. Because a single third-party domain can recognize a user across many unrelated websites, these cookies generally serve purposes that go beyond what is strictly necessary to deliver a site. In the EU and UK, that typically means they require prior, freely given, specific, informed, and unambiguous consent under the ePrivacy Directive as implemented nationally, before they are placed on or read from a user's device. Getting this wrong exposes organizations to regulatory risk and undermines the trust users place in a site.

Who it's relevant to

Privacy officers and data protection professionals

Third-party cookies are a primary focus of consent management because they typically require prior consent in most EU jurisdictions and involve the processing of personal data under the GDPR. These professionals need to inventory which third-party cookies and similar technologies a site uses, classify them by purpose, and ensure the correct consent basis is applied for the relevant jurisdiction.

Legal counsel and compliance teams

Because obligations vary by jurisdiction, generally opt-in in the EU and UK, but often opt-out under US state regimes such as the CCPA/CPRA in California, legal teams must map applicable requirements to each market. They also need to account for the separate ePrivacy and GDPR requirements when third-party cookies process personal data.

Web developers and technical implementers

Developers determine whether cookies are set as first-party or third-party based on the domain, and they configure tag management and consent mechanisms so that non-exempt third-party cookies are not placed before consent is obtained. They should also account for browser and platform restrictions on third-party cookies, which affect technical availability but do not substitute for consent.

Marketing and advertising compliance teams

Third-party cookies underpin ad targeting, conversion measurement, and cross-domain analytics, so marketing teams rely on them heavily while remaining subject to consent requirements. They need to understand that similar tracking via pixels, SDKs, local storage, or fingerprinting falls within the same rules, and that tooling supports but does not guarantee compliance.

Inside Third-Party Cookies

Cross-domain origin

Third-party cookies are set by a domain different from the one shown in the user's address bar, typically loaded through embedded content such as advertising tags, social media widgets, or analytics scripts served from an external provider.

Cross-site tracking capability

Because the same third-party domain can be present across many websites, these cookies can enable the third party to recognize a user across multiple sites, supporting behavioral profiling, ad targeting, and frequency capping.

Consent dependency under EU/UK law

Under the ePrivacy Directive as implemented in most EU jurisdictions (and the UK's PECR), placing or accessing third-party cookies that are not strictly necessary generally requires prior informed consent, since they typically serve advertising, analytics, or other non-essential purposes.

Associated personal data processing

Where third-party cookies process personal data such as identifiers or browsing behavior, the GDPR applies in addition to the ePrivacy rules, raising questions of lawful basis, controller relationships, and information duties that go beyond the act of storing the cookie itself.

Related tracking technologies

Similar cross-site functions can be achieved through pixels, tags, SDKs, local storage, and fingerprinting techniques, which generally fall within the same consent rules even though they are not literally cookies.

Browser and platform restrictions

Several browsers restrict or block third-party cookies by default, which affects how they function in practice; these technical measures are distinct from, and do not substitute for, legal compliance obligations.

Common questions

Answers to the questions practitioners most commonly ask about Third-Party Cookies.

Are third-party cookies being banned outright by law?

No. Third-party cookies are not prohibited by law as a category. What EU and UK rules generally require is valid prior consent before non-essential third-party cookies are placed or read on a user's device, under the ePrivacy Directive as nationally implemented, with any resulting personal data processing also governed by the GDPR. Separately, some browsers have moved to restrict or phase out third-party cookies as a technical default, but that is a commercial and technical decision by browser vendors rather than a legal ban. These two developments, regulatory consent requirements and browser-level restrictions, are distinct and should not be conflated.

Does blocking or deprecating third-party cookies mean I no longer have compliance obligations?

Not necessarily. The relevant rules generally attach to the placing of, or access to, information on a user's device and to the processing of any personal data that follows, rather than to the word 'cookie' specifically. Alternative technologies used for similar purposes, such as pixels, local storage, SDKs, server-side tracking, or fingerprinting techniques, typically fall within the same ePrivacy and GDPR framework in the EU and UK. Removing third-party cookies from your stack does not, by itself, remove consent, transparency, or record-keeping obligations if equivalent tracking continues by other means.

How should I identify and categorize the third-party cookies on my site?

A common approach is to run a cookie audit or scan to inventory the cookies and similar technologies present, then classify each according to purpose, for example strictly necessary, functional, analytics, or advertising. Strictly necessary cookies are generally treated as exempt from consent in EU and UK practice, whereas analytics and advertising cookies, which are frequently set by third parties, typically require prior consent. Categorization can be fact-specific and may require input from the third parties themselves, since a single cookie's purpose is not always evident from its name. This entry does not prescribe a specific tool, and any scan should be validated with legal and technical review.

When should third-party cookies actually fire relative to obtaining consent?

Under EU and UK rules, non-essential third-party cookies should generally not be set or read until the user has given valid consent through a clear affirmative action. In practice this often means suppressing third-party tags and scripts until a consent management platform (CMP) signals that the relevant purpose has been consented to. Loading such cookies on page load before any interaction is widely considered non-compliant in most EU jurisdictions. Requirements differ under some US state frameworks, which more often rely on an opt-out model rather than prior opt-in.

How do consent signals reach the third parties whose cookies I use?

Consent status is commonly communicated to downstream parties through a CMP, and in the advertising context often via a framework such as the IAB Transparency and Consent Framework (TCF), which encodes user choices in a standardized signal that participating vendors can read. Browser-level signals such as Global Privacy Control may also be relevant, particularly for opt-out obligations under certain US state laws. Implementing these mechanisms supports compliance but does not by itself guarantee it; you remain responsible for verifying that third parties honor the signals and for maintaining appropriate records of consent.

What records should I keep regarding consent for third-party cookies?

Organizations subject to the GDPR are generally expected to be able to demonstrate that valid consent was obtained, which typically involves logging what the user was shown, what they consented to, and when. For third-party cookies this can include retaining the consent state and any signal passed to vendors. The precise record-keeping expectations depend on the applicable regime and on guidance from the relevant data protection authority, which continues to evolve, so the specific retention period and format are outside the scope of this definition and should be determined with legal advice.

Common misconceptions

Third-party cookies are always unlawful and must be eliminated.

The relevant rules generally turn on purpose and consent, not on whether a cookie is first- or third-party. In most EU and UK contexts a non-essential third-party cookie may be used where valid prior consent is obtained; the party classification affects transparency and relationships more than outright legality.

If a website uses first-party cookies instead of third-party cookies, no consent is needed.

Consent obligations under EU and UK law depend on whether a cookie is strictly necessary, not on the first- versus third-party distinction. First-party analytics or advertising cookies typically still require consent, and re-badging third-party functions as first-party does not remove those requirements.

Browsers blocking third-party cookies means the compliance problem is solved.

Browser-level blocking is a technical default that varies by browser and can be circumvented by alternative techniques such as pixels, SDKs, or fingerprinting. It does not replace the need for a valid legal basis, appropriate consent where required, or proper record-keeping.

Best practices

Inventory all third-party cookies and equivalent technologies (pixels, tags, SDKs, local storage) on your properties, identifying the setting domain, purpose, and whether each is strictly necessary.

Where third-party cookies are non-essential, obtain prior consent through a clear affirmative action before they are set in EU and UK contexts, avoiding pre-ticked boxes, implied consent, or cookie walls that may be considered non-compliant.

Distinguish the ePrivacy/PECR obligation to obtain consent for storing or accessing the cookie from the separate GDPR obligations that apply to any personal data subsequently processed, and address both.

Clarify the roles and relationships between your organization and third-party providers, ensuring transparency information reflects who is placing cookies and for what purposes.

Adapt your approach to the applicable jurisdiction, recognizing that some US state frameworks rely on opt-out signals rather than the opt-in consent generally expected in the EU and UK, and confirm current scope before relying on any single model.

Maintain records of consent and configuration decisions, and treat CMPs and blocking technologies as tools that support compliance rather than guarantees of it, subject to ongoing legal review.