Also known as: tracking cookie · cross-site cookie
A third-party cookie is a cookie set by a domain other than the one shown in the address bar, historically the primary mechanism allowing advertising networks to track individual users across unrelated websites.
First-party cookies, set by the site being visited, are what keep users logged in and are largely uncontroversial. Third-party cookies enabled a single ad network embedded across thousands of sites to assemble a browsing profile spanning all of them.
Browser vendors have progressively restricted or removed them. The important caveat is that deprecation shifts tracking rather than ending it: fingerprinting, first-party data pooling, and server-side identity matching all fill the gap, and several are harder for users and regulators to observe.
Browser Fingerprinting
Browser fingerprinting is a tracking technique that identifies a user by combining observable characteristics of their device and browser — screen resolution, installed fonts, graphics rendering behaviour, time zone — into a signature distinctive enough to recognise across sites.
Data Broker
A data broker is a company that collects personal information from public records, commercial transactions, apps, and online activity, then aggregates and sells it to other organisations — typically without any direct relationship with the individuals concerned.
CCPA / CPRA
The CCPA, as amended by the CPRA, is California's consumer privacy law, granting residents rights to know what personal information businesses collect about them, to delete it, to correct it, and to opt out of its sale or sharing.
Consent Management
Consent management is the process of obtaining, recording, and honouring users' choices about the processing of their personal data, most visibly through the cookie and tracking consent banners required by privacy law.
Metadata
Metadata is the information surrounding a communication rather than its content — who contacted whom, when, for how long, from where, and how frequently — which remains visible even when the content itself is encrypted.