A cookie is a small file a website stores in your browser to remember something; the privacy problem comes from third-party cookies — set by advertising and analytics companies embedded across millions of sites — which stitch your browsing into one profile readable anywhere their code runs. The first kind is mostly benign and functional: it keeps you logged in, holds your cart, remembers preferences. The second kind built the surveillance-advertising economy, and its slow retirement — Google's multi-year, much-delayed phase-out of third-party cookies in Chrome, alongside the blocking Safari and Firefox have shipped for years — has not ended tracking; it has shifted it toward fingerprinting, logged-in identifiers, and alternative data pipelines.
What are the types?
- First-party cookies: set by the site you are visiting. Login sessions, carts, preferences, and — on the privacy ledger — also increasingly used for the site's own analytics and ad measurement, which regulation treats as first-party data collection.
- Third-party cookies: set by someone else on the page — the ad network in the corner of nearly every site. Historically the workhorse of cross-site tracking: one identifier, read across every site carrying the same network's code, building your interest graph.
- Tracking pixels and beacons: invisible image requests that report page views and email opens without storing anything — cookies in spirit, not mechanism.
- Local storage and SDK-collected identifiers: apps and sites storing IDs outside the cookie jar, partly to survive cookie deletion.
- Fingerprinting: identifying your browser by its characteristics with no stored token at all — the tracking that survives every cookie control, covered in our dedicated guide.
What happened to third-party cookies?
A decade of pressure: regulators in Europe subordinated them to consent under the GDPR's ePrivacy rules — hence the cookie banners; Safari blocked third-party cookies by default in 2020 (ITP), Firefox via Enhanced Tracking Protection for years before; Chrome, holding the majority share that mattered, announced its phase-out in 2020 and then repeatedly delayed it through regulatory and industry objections — by 2024-2025 Google had settled on a user-choice model rather than full deprecation, leaving the ecosystem to continue alongside opt-out mechanisms. The practical result: in Safari and Firefox the classic third-party cookie is largely dead, in Chrome it persists under growing friction, and the advertising industry has spent the transition building alternatives that do not need it.
Related stories: Browser fingerprinting explained: how sites recognize you without cookies · What a VPN actually protects — and the five things it doesn't.
What replaced it?
Partly logged-in walled gardens — platforms tracking you inside their apps where browser rules never applied; partly first-party data collection, where retailers and publishers do their own profiling; partly fingerprinting and IP-based inference; and partly "privacy-preserving" APIs of the kind Google proposed through the Privacy Sandbox project, whose on-device ad-interest design drew years of regulatory scrutiny and competition concerns. The net privacy change is real but modest: cross-site tracking got costlier and less accurate, not impossible, and the consent banners the GDPR produced became their own nuisance industry.
What can you actually do?
- Block third-party trackers in the browser: Firefox's Strict mode and Safari do this by default; Chrome users can add a reputable content blocker. This removes the classic cross-site cookie without breaking logins.
- Keep first-party cookies on unless you enjoy logging into everything — clearing them constantly mostly punishes you.
- Use browser profiles or containers to separate contexts — work, shopping, reading — so profiles cannot merge across your roles.
- Limit supercookies and storage abuse: modern browsers isolate and purge these automatically; keeping the browser current is the whole action there.
- Handle cookie banners minimally: reject where the choice is genuine; where a site makes refusal painful, decide whether the site is worth it — and note that the banner itself signals the site's data appetite.
- For app-based tracking, use the OS-level controls — Apple's App Tracking Transparency prompt and Android's ad-ID reset and deletion — which govern the identifiers cookies never touched.
Where is this heading?
Toward identity rather than cookies: logged-in ecosystems, first-party data, and — on the regulatory side — consent-or-pay models, Global Privacy Control signals, and state opt-out laws pressuring the same machinery from another angle. The tracker's job never disappeared; it fragmented. For readers, the durable defenses are structural — content blocking, profile separation, and minimizing the number of logged-in trackers you carry through daily life — because every one of them works across whichever tracking technology the industry ships next.