Types of cookies: first-party, third-party, session and persistent

Cookies are usually classified in three ways: by who sets them (first-party or third-party), by how long they last (session or persistent), and by what they are for (strictly necessary, preferences, analytics or marketing). The first two describe technical behavior. The third is what privacy law cares about most, because a cookie’s purpose decides whether you need consent before setting it.

What is a cookie, technically?

A cookie is a small piece of text that a website asks the browser to store and send back on later requests to the same site. Servers set cookies with the Set-Cookie HTTP header, and scripts on the page can set them through document.cookie.

Each cookie has a name, a value and attributes that control where and how long it lives:

Set-Cookie: session_id=8f2c1e; Path=/; Secure; HttpOnly; SameSite=Lax
Set-Cookie: lang=en; Max-Age=31536000; Path=/; Secure; SameSite=Lax

Domain and Path control which requests carry the cookie. Expires or Max-Age sets its lifetime. Secure limits it to HTTPS, HttpOnly hides it from JavaScript, and SameSite controls whether it is sent on cross-site requests.

What is the difference between first-party and third-party cookies?

A first-party cookie is set for the domain shown in the browser’s address bar. A third-party cookie is set for a different domain, usually by content embedded in the page, such as an ad, a video player or a social media widget.

If a visitor is on shop.example and an embedded ad from ads.example-network.com sets a cookie, that cookie is third-party. Because the same ad network is embedded on many sites, its cookie can recognize the same browser across all of them. That cross-site recognition is what made third-party cookies the backbone of behavioral advertising.

Two nuances matter in practice:

• First-party does not mean the data stays with you. Many analytics and advertising scripts run on your page and write cookies to your own domain. Those cookies are technically first-party, but the identifiers they hold are still sent to the vendor.
• Browser support is shifting. Safari and Firefox restrict third-party cookies by default, and Chrome’s plans have changed several times. Check the current status before building anything that depends on them.

What is the difference between session and persistent cookies?

A session cookie has no Expires or Max-Age attribute, so the browser deletes it when the session ends. A persistent cookie has an explicit expiry and survives browser restarts until that date or until the user clears it.

The browser, not your site, decides when a session ends. Some browsers restore session cookies when they reopen previous tabs, so a session cookie can live longer than you expect. Some browsers also shorten the lifetime of certain cookies set by JavaScript, regardless of the expiry you request.

Lifespan matters for compliance too. Regulators expect cookie durations to be proportionate to their purpose, and your cookie policy should state how long each cookie lasts.

What are the cookie categories by purpose?

Most consent banners group cookies into four purpose-based categories. Names vary, but the logic is consistent:

• Strictly necessary: needed to deliver a service the user explicitly asked for, such as staying logged in, keeping a cart or remembering a consent choice. See what counts as a strictly necessary cookie for the test.
• Preferences (or functional): remember choices that improve the experience, such as language, region or display settings.
• Analytics (or statistics): measure how visitors use the site, such as page views, traffic sources and conversion paths.
• Marketing (or advertising): build profiles, measure ad performance, retarget visitors or share data with ad platforms.

How do the different types of cookies compare?

Every cookie has a party, a lifespan and a purpose at once, such as a first-party, persistent analytics cookie. This table shows how each type relates to consent under EU rules.

Type	Classified by	Typical example	Consent needed under EU rules?
First-party	Setting domain	Login session on your own domain	Depends on purpose
Third-party	Setting domain	Ad network cookie from an embedded ad	Depends on purpose; in practice usually yes
Session	Lifespan	Shopping cart that clears when the browser closes	Depends on purpose
Persistent	Lifespan	Language preference kept for a year	Depends on purpose
Strictly necessary	Purpose	Authentication, load balancing, consent record	No, exempt
Preferences	Purpose	Remembered language or theme	Usually yes; narrow exceptions for settings the user actively chose
Analytics	Purpose	Visitor and page view measurement	Generally yes; some national regulators allow narrow exceptions
Marketing	Purpose	Retargeting and ad conversion cookies	Yes

The technical types never answer the consent question on their own. Only purpose does.

Does privacy law care about the cookie type or the purpose?

Purpose. Article 5(3) of the ePrivacy Directive applies to storing or accessing any information on a user’s device, and its exemptions are defined by purpose. Unless the storage is strictly necessary for a service the user requested, or used only to transmit a communication, you need prior consent.

Three consequences follow:

1. The rules are technology-neutral. localStorage, sessionStorage, IndexedDB, tracking pixels and device fingerprinting are covered just like cookies. For how the two EU laws interact, see ePrivacy Directive vs. GDPR.
2. GDPR applies on top when the data is personal. GDPR names cookie identifiers among the online identifiers that can make a person identifiable, so most tracking cookies involve personal data.
3. US laws use a different model. Under the CCPA and CPRA, advertising cookies can amount to “selling” or “sharing” personal information. Instead of collecting opt-in consent, you must offer a way to opt out and honor Global Privacy Control signals.

How do I find out which cookies my site uses?

Start with your browser’s developer tools, which list the cookies and other storage for each domain a page touches. That gives you a quick snapshot, but it misses cookies that only appear on certain pages, after login, or after a visitor consents.

A more reliable process:

1. Open the site in a clean private window and record everything set before any consent is given.
2. Accept all cookies, browse key pages and flows, and record what appears.
3. For each cookie, note its name, setting domain, lifespan and purpose.
4. Assign each one a purpose category and confirm nothing non-essential appeared before consent.
5. Repeat on a schedule, because new tags appear whenever marketing or product teams add tools.

Our guide on how to run a cookie audit covers this process in depth, and its output feeds directly into your cookie policy.

Bottom line

First-party versus third-party and session versus persistent describe how a cookie behaves. Purpose describes why it exists, and purpose decides whether you need consent. Inventory your cookies, classify each by purpose, and block anything non-essential until visitors agree. Tools like Cookiesh can automate cookie scanning and hold tagged scripts until visitors consent.

This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.