Understanding Website Cookies (and Which Ones to Refuse)

Everyone clicks through cookie banners without reading them. Ten minutes understanding what the categories mean turns that into a decision you can make in one click, correctly, every time.

What a cookie is

A small text file a website asks your browser to store, and which your browser sends back on subsequent requests to that site. That is all — it is a way of letting a stateless protocol remember something.

Cookies are why you stay signed in, why a shopping basket survives a page reload, and why a site remembers your language.

First-party and third-party — the distinction that matters

First-party cookies

Set by the site you are actually visiting. Keep you signed in, hold your basket, remember preferences. Largely benign and mostly necessary. Blocking them breaks the web.

Third-party cookies

Set by a different domain whose content is embedded in the page — an ad network, an analytics service, a social widget.

Because the same third party is embedded across thousands of sites, it receives a signal from each one. That is how a profile of your browsing gets assembled across sites you never connected.

This is the category worth refusing. It is also the category consent banners exist for.

What the banner categories mean

• Strictly necessary — required for the site to function. Cannot be switched off, and legitimately so.
• Functional / preferences — remember your language, region, layout choices. Usually harmless.
• Analytics / performance — measure how the site is used. Sometimes first-party and self-hosted, often shared with a third party.
• Marketing / advertising / targeting — the cross-site tracking category. This is the one to decline.

A practical default

Reject all non-essential cookies, every time.

Sites remain functional. Strictly necessary cookies are unaffected, so you stay signed in and your basket still works. What you lose is being profiled by ad networks, which is not a loss.

Where the banner offers no clear reject button, open the preferences panel and turn off everything except strictly necessary. That the reject option is often hidden behind an extra click is a deliberate design choice, and a reasonable signal about the site's intentions.

Why the banners exist

Under the EU's GDPR and ePrivacy rules, the UK equivalents, and a growing set of similar laws, storing non-essential cookies requires informed consent given freely. Hence the banner.

The implementation quality varies enormously. Some are a clean two-button choice. Others bury refusal three levels deep behind a list of 800 "partners". The friction is intentional and tells you something.

The wider picture

Third-party cookies are being phased out in most browsers, which is genuine progress. But the tracking industry has replacements:

• Fingerprinting — identifying you from the combination of your device characteristics, with no cookie at all.
• First-party data — sites collecting directly and sharing server-to-server.
• Email-based identifiers — the reason so many sites now want your address before showing content.

So refusing cookies helps and is worth doing, but it is not a complete answer. See browser privacy basics for the rest.

Managing cookies on an iPhone

• Clear cookies periodically in your browser's settings. It signs you out of things, which is the cost.
• Use a private session for one-off visits to sites you do not want persisting anything.
• In Sqrl Browser, history and site data are stored on the device with no account and no sync, and you can clear them from the browser's own settings.
• Settings › Privacy & Security › Tracking — turn off app tracking requests. This covers the app equivalent of the same problem.