# Types of cookies: first-party, third-party, session and persistent

> Learn the main types of cookies, from first- and third-party to session and persistent, and why a cookie's purpose decides whether you need consent.

Source: https://www.cookiesh.eu/blog/types-of-cookies  
Published: 2026-03-12

## Key takeaways

- Cookies are classified by who sets them, how long they last, and what they are used for.
- First-party and third-party describe the domain that sets a cookie, not who ultimately receives the data.
- A session cookie has no expiry date and is deleted when the browser session ends; a persistent cookie lasts until a set date.
- Under EU rules, purpose decides whether a cookie needs consent, and the same rules cover localStorage, pixels and similar technologies.

Cookies are usually classified in three ways: by who sets them (first-party or third-party), by how long they last (session or persistent), and by what they are for (strictly necessary, preferences, analytics or marketing). The first two describe technical behavior. The third is what privacy law cares about most, because a cookie's purpose decides whether you need consent before setting it.

## What is a cookie, technically?

A cookie is a small piece of text that a website asks the browser to store and send back on later requests to the same site. Servers set cookies with the `Set-Cookie` HTTP header, and scripts on the page can set them through `document.cookie`.

Each cookie has a name, a value and attributes that control where and how long it lives:

```http
Set-Cookie: session_id=8f2c1e; Path=/; Secure; HttpOnly; SameSite=Lax
Set-Cookie: lang=en; Max-Age=31536000; Path=/; Secure; SameSite=Lax
```

`Domain` and `Path` control which requests carry the cookie. `Expires` or `Max-Age` sets its lifetime. `Secure` limits it to HTTPS, `HttpOnly` hides it from JavaScript, and `SameSite` controls whether it is sent on cross-site requests.
## What is the difference between first-party and third-party cookies?

A first-party cookie is set for the domain shown in the browser's address bar. A third-party cookie is set for a different domain, usually by content embedded in the page, such as an ad, a video player or a social media widget.

If a visitor is on `shop.example` and an embedded ad from `ads.example-network.com` sets a cookie, that cookie is third-party. Because the same ad network is embedded on many sites, its cookie can recognize the same browser across all of them. That cross-site recognition is what made third-party cookies the backbone of behavioral advertising.

Two nuances matter in practice:

- **First-party does not mean the data stays with you.** Many analytics and advertising scripts run on your page and write cookies to your own domain. Those cookies are technically first-party, but the identifiers they hold are still sent to the vendor.
- **Browser support is shifting.** Safari and Firefox restrict third-party cookies by default, and Chrome's plans have changed several times. Check the current status before building anything that depends on them.

## What is the difference between session and persistent cookies?

A session cookie has no `Expires` or `Max-Age` attribute, so the browser deletes it when the session ends. A persistent cookie has an explicit expiry and survives browser restarts until that date or until the user clears it.

The browser, not your site, decides when a session ends. Some browsers restore session cookies when they reopen previous tabs, so a session cookie can live longer than you expect. Some browsers also shorten the lifetime of certain cookies set by JavaScript, regardless of the expiry you request.

Lifespan matters for compliance too. Regulators expect cookie durations to be proportionate to their purpose, and your cookie policy should state how long each cookie lasts.
## What are the cookie categories by purpose?

Most consent banners group cookies into four purpose-based categories. Names vary, but the logic is consistent:

- **Strictly necessary:** needed to deliver a service the user explicitly asked for, such as staying logged in, keeping a cart or remembering a consent choice. See [what counts as a strictly necessary cookie](/blog/strictly-necessary-cookies) for the test.
- **Preferences (or functional):** remember choices that improve the experience, such as language, region or display settings.
- **Analytics (or statistics):** measure how visitors use the site, such as page views, traffic sources and conversion paths.
- **Marketing (or advertising):** build profiles, measure ad performance, retarget visitors or share data with ad platforms.
### How do the different types of cookies compare?

Every cookie has a party, a lifespan and a purpose at once, such as a first-party, persistent analytics cookie. This table shows how each type relates to consent under EU rules.

| Type | Classified by | Typical example | Consent needed under EU rules? |
|---|---|---|---|
| First-party | Setting domain | Login session on your own domain | Depends on purpose |
| Third-party | Setting domain | Ad network cookie from an embedded ad | Depends on purpose; in practice usually yes |
| Session | Lifespan | Shopping cart that clears when the browser closes | Depends on purpose |
| Persistent | Lifespan | Language preference kept for a year | Depends on purpose |
| Strictly necessary | Purpose | Authentication, load balancing, consent record | No, exempt |
| Preferences | Purpose | Remembered language or theme | Usually yes; narrow exceptions for settings the user actively chose |
| Analytics | Purpose | Visitor and page view measurement | Generally yes; some national regulators allow narrow exceptions |
| Marketing | Purpose | Retargeting and ad conversion cookies | Yes |

The technical types never answer the consent question on their own. Only purpose does.

## Does privacy law care about the cookie type or the purpose?

Purpose. Article 5(3) of the ePrivacy Directive applies to storing or accessing any information on a user's device, and its exemptions are defined by purpose. Unless the storage is strictly necessary for a service the user requested, or used only to transmit a communication, you need prior consent.

Three consequences follow:

1. **The rules are technology-neutral.** localStorage, sessionStorage, IndexedDB, tracking pixels and device fingerprinting are covered just like cookies. For how the two EU laws interact, see [ePrivacy Directive vs. GDPR](/blog/eprivacy-directive-vs-gdpr).
2. **GDPR applies on top when the data is personal.** GDPR names cookie identifiers among the online identifiers that can make a person identifiable, so most tracking cookies involve personal data.
3. **US laws use a different model.** Under the CCPA and CPRA, advertising cookies can amount to "selling" or "sharing" personal information. Instead of collecting opt-in consent, you must offer a way to opt out and honor Global Privacy Control signals.

## How do I find out which cookies my site uses?

Start with your browser's developer tools, which list the cookies and other storage for each domain a page touches. That gives you a quick snapshot, but it misses cookies that only appear on certain pages, after login, or after a visitor consents.

A more reliable process:

1. Open the site in a clean private window and record everything set before any consent is given.
2. Accept all cookies, browse key pages and flows, and record what appears.
3. For each cookie, note its name, setting domain, lifespan and purpose.
4. Assign each one a purpose category and confirm nothing non-essential appeared before consent.
5. Repeat on a schedule, because new tags appear whenever marketing or product teams add tools.

Our guide on [how to run a cookie audit](/blog/how-to-run-a-cookie-audit) covers this process in depth, and its output feeds directly into your [cookie policy](/blog/how-to-write-a-cookie-policy).

## Bottom line

First-party versus third-party and session versus persistent describe how a cookie behaves. Purpose describes why it exists, and purpose decides whether you need consent. Inventory your cookies, classify each by purpose, and block anything non-essential until visitors agree. Tools like Cookiesh can automate cookie scanning and hold tagged scripts until visitors consent.

*This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.*

## FAQ

### Are first-party cookies exempt from consent?

No. Being first-party does not exempt a cookie from consent. If a first-party cookie is used for analytics or advertising, EU rules generally require opt-in consent before it is set, just as they would for a third-party cookie.

### Is localStorage treated differently from cookies under EU law?

No. The ePrivacy Directive covers storing or accessing information on a user's device, whatever the technology. Data written to localStorage or IndexedDB for tracking needs consent in the same way a tracking cookie does.

### Do session cookies need consent?

It depends on what they do, not how long they last. A session cookie that keeps a shopping cart working is usually exempt, while a short-lived cookie used for advertising still needs consent.

### Are third-party cookies going away?

Safari and Firefox already restrict them by default, and Chrome's plans have changed several times, so check the current status. Either way, consent rules apply to whatever tracking technology replaces them.

## Sources

- [MDN: Using HTTP cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)
- [Directive 2002/58/EC (ePrivacy Directive), EUR-Lex](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [Regulation (EU) 2016/679 (GDPR), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)