What is an online cookie?

An online cookie is a small piece of data that a website asks your browser to store on your device. Each time you come back, your browser sends the cookie to that website. The website can then remember you: what's in your basket, that you're logged in, or which language you chose.

Some cookies keep a website working. Others record what you do, so a website can see how its visitors use it or show you ads that match your interests. Websites often need your permission for the second kind, and many ask for it before they set any cookies.

What are cookies on websites used for?

Most of the cookies you meet on a website do one of three jobs.

• They keep your session going. A cookie keeps you logged in as you move from page to page, and keeps the items in your basket while you shop.
• They remember your preferences, so settings such as your language or a dark theme stay as you left them on your next visit.
• They track and measure. Cookies record which pages you view, so the website can see how it's used and advertisers can show you ads based on what you looked at.

The third job explains why adverts seem to follow you. You look at a pair of shoes in an online shop, and later see adverts for the same shoes on another website. Both sites embed content from the same advertising service, and its cookie lets that service learn what you did on the first site.

How does a cookie work?

A cookie travels with the pages you load. When your browser asks a website for a page, the website's server can send one or more cookies back with it. Your browser stores them and attaches them to every later request it makes to that website. That way, the server knows the request comes from the same browser.

A cookie holds a name and a value, often an ID. When you log in, for example, the website sends a cookie with a session ID that records you're signed in. Your browser then sends it back with every page you open.

How long a cookie lasts depends on how the website sets it:

• Session cookies have no expiry date. Your browser deletes them when the current session ends, and it's the browser that decides when that is.
• Persistent cookies carry an expiry date or a lifetime that the website sets. Your browser deletes them after that date, unless you delete them first.

First-party and third-party cookies

A first-party cookie is created by the website you visit, the one shown in your address bar. A third-party cookie is created by another site whose content the page embeds, such as an image or an advert. The difference decides who learns what you do and who gets the data.

First-party and third-party cookies compared

The same split matters if you run a website yourself. As a website owner, you can read the statistics of your own website in a tool such as Google Analytics. Its main cookie tells one visitor from another and lasts two years. The data a third-party cookie collects goes to the company that set it, for example a social network, and not to you.

Are third-party cookies going away?

Not in Chrome, for now. In 2021, Google planned to phase out third-party cookies in Chrome. It has since decided to keep its current approach, where you choose for yourself in Chrome's privacy and security settings. So third-party cookies still work in Chrome unless you block them, and Chrome's Incognito mode blocks them by default. Google has also decided to retire several of its Privacy Sandbox technologies, the tools it built to replace what third-party cookies do.

If you run a website, the UK consent rules apply to the third-party cookies on it, just as they do to your own.

Are cookies safe, and should you accept them?

Mostly, yes. Cookies are small pieces of text, and first-party cookies from the websites you visit are generally considered safe. The risk is to your privacy. A third-party service can combine what its cookies record on many websites into a detailed profile of what you do online.

When a website asks, you choose between accepting all cookies and rejecting the optional ones. Rejecting them doesn't stop the site from working, because the cookies it needs for your basket or your login need no consent.

Our advice: on websites you're unsure about, reject the optional cookies. Third-party services then learn less about what you do online.

You can clear your cookies or block third-party cookies, usually in your browser's privacy settings. In Chrome, for example, you can remove the cookies already stored, choose whether third-party cookies are allowed and set different rules for particular websites. Google gives the steps for each of these on its page about managing cookies in Chrome. Clearing all your cookies has a small cost, though. You may be signed out of websites that remember you, and your saved preferences can go too.

What UK law says about cookies on your website

In the UK, cookies fall under the Privacy and Electronic Communications Regulations (PECR). Under PECR, a website must not store information on a visitor's device, or read information stored there, unless the visitor consents or an exception applies. For consent to count, the visitor has clear and comprehensive information about the purpose and then agrees.

Some cookies need no consent. The regulations make five exceptions, and three of them cover cookies on websites. The Data (Use and Access) Act 2025 added the statistics and appearance exceptions:

• Strictly necessary cookies are the ones the service a visitor asked for needs in order to work. Examples are a cookie that keeps them logged in, remembers what they put in their basket or helps detect fraud.
• Statistics cookies only collect statistics on how your website is used, so you can improve it. Visitors must be told what they're for and get a simple, free way to object, and you may only share the data with someone who helps you improve the site.
• Appearance cookies only adapt how your website looks or works to a visitor's preferences. They come with the same conditions: clear information and a simple, free way to object.

Whether your analytics fit the statistics exception depends on how your tool is set up. It only applies when nobody is tracked, identified or profiled, nothing is used for advertising and the provider uses the data only for you. If you're not sure a tool such as Google Analytics meets these conditions, ask for consent for it. The statistics exception doesn't cover cookies for advertising, or for tracking and profiling visitors. Those cookies need consent, whether they're your own or a third party's. On your website, you ask for it with a cookie banner. Where your cookies collect personal data, UK GDPR applies as well.

What is a cookie policy?

A cookie policy is the page that tells visitors which cookies your website uses, what each one is for and how long it lasts. It gives them the clear information the rules ask for, and your banner links to it for visitors who want the details.

If your website sets cookies beyond the strictly necessary ones, you need to tell visitors about them. In practice, that means you need a cookie policy. Some websites put it in a section of their privacy policy instead of on a page of its own.

Adding cookie consent to your website

To ask for consent, you add a consent tool, also called a consent management platform. The tool shows your banner and keeps your policies in step with the cookies your site actually sets. With us, you can use Termly to manage cookie consent on your website.

Termly scans your website for cookies, generates your cookie banner, cookie policy and privacy policy, and keeps them up to date.

If you build your website with our Aida AI Website Builder, a consent banner is built in from the start. You don't need to install a separate plugin or consent tool.

If your website isn't built with Aida, start by finding out which cookies it sets today. Scan your website for cookies with Termly, then ask for consent wherever the UK rules require it.