First-party vs third-party cookies

The cookie scanner labels every cookie as first party or third party. It sounds simple, and mostly it is, but the label carries more meaning than people expect. This page explains the difference, the ways it gets blurry, and why the industry shift away from third-party cookies fixes less than the headlines suggest.

Definitions

The party of a cookie is about whose domain sets it, not who benefits from it.

• A first-party cookie is set on the domain the visitor is actually on. If you are browsing example.com and it stores a cookie on example.com, that is first party. Think of a session cookie that keeps you logged in, or one that remembers your language.
• A third-party cookie is set on a different domain than the one in the address bar. If example.com loads a widget from adnetwork.com and that widget sets a cookie on adnetwork.com, that is third party. The classic case is an advertising network that sets the same cookie across every site it appears on, so it can recognize you as you move between them.

The practical difference is reach. A first-party cookie sees you on one site. A third-party cookie can see you across every site that loads the same third party.

The same vendor in both guises

Here is the part that trips people up: the same company can show up as both a first-party and a third-party cookie, and the party label does not tell you how much tracking is happening.

Take a common analytics tool. It sets its main cookie as a first-party cookie on your domain, so in the scanner it shows up as first party. But that cookie exists to feed data to the analytics vendor, a third party, who collects it from every site that installs the tool. The cookie is first party by domain and third party by purpose. First party is not a synonym for private, and it never was.

This is exactly why the scanner reports party as one column among several, next to category, vendor, and the before-consent flag. Party alone does not tell you whether a cookie tracks you. You have to read it together with what the cookie is for.

Why third-party cookies are going away, and what that does not fix

Browsers have spent years restricting third-party cookies, and several block them by default now. That is real progress against one specific thing: cross-site tracking that relied on a shared third-party cookie following you from site to site. Kill the third-party cookie and that particular technique stops working.

It is worth being clear about what it does not touch:

• First-party tracking. A first-party cookie, or a first-party identifier a vendor collects, is unaffected. Sites and their vendors have leaned harder into first-party setups precisely because they survive the change.
• Fingerprinting. Identifying a browser by its combination of traits, screen, fonts, timezone, and more, needs no cookie at all, so blocking cookies does nothing to it.
• localStorage identifiers. An ID parked in localStorage is not a cookie and is not covered by third-party cookie blocking. It tracks a visitor just the same, which is why the scanner classifies storage keys right alongside cookies.

So a report with zero third-party cookies is not a clean bill of health. It can still be full of first-party tracking and storage-based identifiers. The scanner shows all of them so the third-party count is never mistaken for the whole story.

How the scanner labels party

The rule the scanner uses is mechanical and matches the browser's own: it compares the cookie's domain against the domain of the site being scanned. Same registrable domain, first party. Different domain, third party. Nothing about the vendor or the purpose enters into the party label; those live in the category and vendor columns instead.

For third-party domains, the report goes a step further and marks any that match a known tracker: a domain recognized as belonging to an advertising or analytics network. That flag is how you tell an ordinary third-party request, like a font or an image host, from one that is there to follow visitors. A third-party domain is just another domain. A known tracker is a third-party domain with a track record.

See it on your own site

The fastest way to make all of this concrete is to look at your own cookies. Run a scan on your site and read the party column next to the category and vendor columns. You will usually find the interesting cases are not the obvious third-party cookies, but the first-party ones quietly feeding a third party.