What a cookie is – and what it is not
Few words in data protection are used so often and explained so rarely. A cookie is neither a program nor a spy, but something far simpler – and that simplicity is exactly where the duty to ask comes from.
The term comes from the early days of the web and has nothing to do with baking. It refers to a "magic cookie" – in programming, a small package of data handed back unchanged, much like a cloakroom ticket: the ticket itself says nothing, it simply matches exactly one coat.
A note, not a program
A cookie is plain text. It cannot execute anything, start anything, or search anything. It can neither read the hard drive nor switch on the camera nor open another program. Picturing a cookie as malware overestimates it considerably.
The misunderstanding survives because cookies show up where things get uncomfortable: in advertising that follows people around. What causes that is not the technology of the note, however, but what is written on it and who is allowed to collect it again.
How a cookie is created and comes back
- The browser requests a pageAn ordinary request, the same as with any click.
- The server answers and encloses a noteAlongside the page comes one line: name, value, lifetime.
- The browser files the note awayFiled by address. A note from one site is invisible to other sites.
- On the next visit the note travels backWith no action and no prompt. The server sees the same identifier as the first time.
What is written on the note
A cookie consists of a handful of fields. They are quickly listed, and each one has consequences for how intrusive the cookie is.
- Name – the label, for example session or _ga. It often reveals what the cookie belongs to.
- Value – the actual content. Usually a long random string: the cloakroom ticket.
- Address – which website the note belongs to. Other sites cannot reach it.
- Lifetime – how long the note stays. From "until the window closes" to several years.
First party and third party
The most important difference concerns who is allowed to collect the note again. It decides whether a cookie stays within one website or leaves a trail right across the web.
Two origins, two reaches
How long a cookie stays
Lifetime is the second point at which harmless cookies part ways with intrusive ones. A note that disappears when the window closes cannot follow anyone for months.
Common lifetimes compared
What a cookie is not
- Not a virus. Text cannot execute itself and cannot spread.
- Not a name tag. A cookie normally holds a random identifier, not a name. The name sits on the server – the identifier merely leads to it.
- Not the only way to recognise someone. Local storage, pixels and fingerprinting do much the same. Looking only at cookies therefore helps little.
Why the question still has to be asked
The legal position does not hinge on whether a cookie is dangerous. It hinges on something far simpler: the device belongs to the person visiting. Placing something there or reading it out means reaching into someone else's equipment – and that requires permission, however small the string being stored.
There is one exception, and it is narrow: whatever is strictly necessary for the service explicitly requested may be stored without consent. A shop's basket falls under it. Measuring the success of an advertising campaign does not.
The question everything turns on
The cookie is not the problem. The questions are who may collect it again, and how long it stays.
Reading a website's cookie list therefore makes sense with all three details taken together: origin, purpose and lifetime. A first-party cookie for the language setting, valid for a year, is fundamentally different from an advertising network's third-party cookie with the same lifetime – even though both appear in the same table.