Short answer: A third-party cookie is one whose domain is different from the site in your address bar. It’s usually set by something the page embeds or calls. Firefox keeps them in a separate cookie jar for each site and Safari blocks them by default. Chrome allows them unless you block them or browse in Incognito, and Google says it will keep offering that choice.
What a third-party cookie is
MDN explains that a cookie belongs to a domain and a scheme, usually https. If they match the page you’re looking at, it’s a first-party cookie. If they don’t, it’s a third-party cookie, which MDN says is more accurately called a cross-site cookie.
Third-party cookies can be sent when you follow a link to another site, and when a page embeds parts of other sites, such as images or documents in an iframe. Those parts can set more third-party cookies of their own.
Our Google Analytics 4 guide shows a tag whose cookies stay first-party.
Why browsers limit them
Third-party cookies have honest uses: a sign-in shared by related sites, preferences, analytics across sites, and counting ad impressions. MDN warns that the same cookies can also follow people across the web with targeted ads and build a profile of their browsing.
MDN adds that laws such as the GDPR and the CCPA require companies to be open about the cookies they set. Our cookie banner guide and our privacy policy guide cover that side.
How each browser treats third-party cookies
| Browser | Third-party cookies by default | Can the user change it? |
|---|---|---|
| Chrome | Allowed, unless the user blocks them or browses in Incognito | Yes, for all sites or one site |
| Firefox | Kept in a separate cookie jar for each site, with Enhanced Tracking Protection on as it is by default | Yes, site by site |
| Safari | Blocked by its tracking prevention | Only by turning off cross-site tracking prevention |
| Edge | Blocks trackers from sites you haven’t visited and known harmful trackers | Yes, site by site |
From MDN’s guide to third-party cookies, read November 4, 2026.
WebKit describes Safari as the first mainstream browser to fully block third-party cookies by default. MDN adds that Brave blocks tracking cookies by default, and that browser extensions can block them too.
What Google decided for Chrome
Google’s latest update on its Privacy Sandbox says Chrome will keep its current approach of offering users a choice about third-party cookies. In Chrome’s settings, people can allow or block third-party cookies for every site or for one site.
The same update retires several technologies that were meant to replace third-party cookies, among them Topics, Protected Audience and the Attribution Reporting API. Google says it will keep supporting CHIPS and FedCM, which other browsers support too.
How to check the cookies on your site
- Open your site in a fresh browser window and list its cookies in the developer tools: Firefox’s Storage Inspector or Chrome’s Application panel.
- Mark as third-party every cookie whose domain isn’t yours.
- Check that cookies meant to work across sites carry SameSite=None together with the Secure attribute.
- Block third-party cookies in your browser’s settings and use your site, to see what breaks.
- For an embed that only needs its cookie on one site, add the Partitioned attribute.
- For a few related sites that must share a cookie, ask for access with the Storage Access API.
- Explain in your cookie notice and your privacy policy which cookies you set, third-party ones included.
Our Google consent mode guide and our Meta Pixel guide cover those two tags.
The cookies on our own site
On November 4, 2026 we opened our home page in a fresh browser three times and listed every cookie it left, without reading their values: twice with a New York time zone and once with a Madrid one.
With the New York time zone, where our notice works as an opt-out, the page left 11 cookies before any choice. Seven were first-party, under our own domain: our own measurement and the tags of Google, Meta and OpenAI. The other four were third-party, set on two OpenAI domains by Cloudflare’s bot and rate-limit tools.
With the Madrid time zone, where nothing runs until the visitor answers, the page left none. After “Accept all” it left 11, the same four third-party cookies among them. In New York, “Accept all” only added the cookie that stores the choice.
In New York, “Do Not Sell or Share” removed three cookies from our domain: Meta’s, Google Ads’ and one of OpenAI’s. It also added the one that stores the choice. The four third-party cookies stayed, because they belong to another domain.
Before you change your tags
- You know every cookie your site sets.
- You know which of them are third-party.
- Cross-site cookies carry SameSite=None and Secure.
- Your site still works with third-party cookies blocked.
- Embeds use partitioned cookies where they can.
- Your privacy policy explains the cookies you set.
RememberA cookie is third-party because of its domain, not because of who wrote the code. On our site, the cookies of Google and Meta are first-party.
Checking what a site leaves in its visitors’ browsers is part of our web design work.
Quick answers about third-party cookies
Is Chrome getting rid of third-party cookies?
No. Google’s latest update on its Privacy Sandbox says Chrome will keep its current approach of offering users a choice about third-party cookies. It also retired several technologies built to replace them, such as Topics and Protected Audience.
Is Google Analytics a third-party cookie?
Not on its own. On our site, Google Analytics sets its cookies under our own domain, which makes them first-party by MDN’s definition: the cookie’s domain and scheme match the address of the page you’re looking at.
What’s the difference between first-party and third-party cookies?
Chrome’s help puts it simply: first-party cookies are created by the site you visit, the one shown in the address bar. Third-party cookies are created by other sites whose content the page embeds, such as images, ads and text.
What is CHIPS?
Cookies Having Independent Partitioned State. Adding the Partitioned attribute keeps a cross-site cookie in a separate cookie jar for each top-level site, so an embed still works without sharing that cookie across sites. Google says it will keep supporting it.
Do third-party cookies need consent?
Laws such as the GDPR in the European Union and the CCPA in California require companies to be open about the cookies they set and the data they collect. MDN gives asking people to opt in, and letting them see and delete their data, as examples.
Sources
Read on November 4, 2026. MDN: Third-party cookies and Using HTTP cookies. Privacy Sandbox: Update on Plans for Privacy Sandbox Technologies. WebKit: Full Third-Party Cookie Blocking and More. Google Chrome Help: Delete, allow, and manage cookies in Chrome. Cloudflare: Cloudflare Cookies. Our case: the cookies our home page left in a fresh browser on November 4, 2026.