First-party vs third-party cookies: what the difference means for consent

A first-party cookie is set by the domain in the address bar; a third-party cookie is set by another domain whose content the page loads, an ad server or an embedded widget. The distinction decides which browser rules apply and who can read the cookie, and it has almost no bearing on whether you need consent. The ePrivacy rule covers storing or reading any information on the visitor's device, whoever does it and for whatever purpose, so Google Analytics' first-party _ga cookie needs consent just as a third-party advertising cookie does. Meanwhile Safari has blocked third-party cookies by default since 2020, Firefox isolates them since 2022, and Chrome decided in April 2025 to keep them and let users choose.

The technical difference

When a browser loads example.com, cookies set by example.com (or by scripts running on its pages) are first-party: they are sent back to example.com on later visits. If the page also loads an iframe or a pixel from ads.example-network.com, cookies set in that response belong to the network's domain and are sent back to it from every site that embeds its content. That is what makes them useful for tracking across sites, and what browsers now restrict.

Three things blur the line:

• A third-party script can set a first-party cookie. Google Analytics runs on your page and writes _ga under your domain. Meta's pixel writes _fbp under your domain. The data still goes to Google or Meta on every hit; only the storage is first-party.
• Server-side tagging and CNAME tricks make trackers look first-party. A tracker served from metrics.example.com that points to a vendor's servers is first-party for the browser and third-party in substance.
• Local storage and fingerprinting are not cookies at all and are covered by the same consent rule. The ICO's guidance lists cookies, tracking pixels, link decoration, local storage, device fingerprinting, scripts and tags as technologies the rules apply to.

What browsers do now

Safari. In March 2020 WebKit announced full third-party cookie blocking by default for all sites, calling Safari the first mainstream browser to do so, and capped script-writable storage (local storage, IndexedDB and similar) at seven days of Safari use without interaction with the site.

Firefox. Mozilla rolled out Total Cookie Protection by default to all desktop users worldwide in June 2022. It creates a separate "cookie jar" for each website, so a third party's cookies set while you visit site A are not available when you visit site B.

Chrome. After years of announced deprecation, Google said in July 2024 that it would not phase out third-party cookies and would instead let users choose, then on 22 April 2025 announced that it would keep its current approach to third-party cookie choice in Chrome and would not roll out a new standalone prompt; users continue to manage them in Chrome's privacy settings.

The result: the cross-site tracking cookie is dead in two of three major browsers and alive by default in the one with the largest share. Advertising has moved toward first-party data, server-side tagging and modeled measurement, which is why first-party cookies matter more, not less, for consent.

What the law looks at

Article 5(3) of the ePrivacy Directive does not mention first or third parties. It allows storing or accessing information on the device only with consent, except for what is strictly necessary for a service the user requested. The question is therefore the purpose of the cookie, not its domain:

Two consequences for a banner. First, the categories should be organised by purpose (necessary, functional, analytics, marketing), with first-party and third-party noted in the cookie table for transparency, not as a basis for exemption. Second, "we only use first-party cookies" is not a compliance statement; "we only use strictly necessary cookies" is.

What this means for blocking

Because the storage is often first-party, blocking is about scripts, not cookie domains. A banner that only suppresses third-party cookies would let Google Analytics and Meta Pixel run. The working approach is to stop the scripts themselves until consent: mark the tags, hold the embeds, intercept dynamically created trackers, as the script blocking guide explains. On refusal, nothing non-necessary runs, so no cookie of either party is written.

What this means for analytics

The decline of the third-party cookie did not touch analytics, which was first-party all along. What matters for analytics is whether the tool is used for the publisher only and produces anonymous statistics, which is the test for the French consent exemption, or whether it feeds a vendor's advertising systems, which is why Google Analytics 4 needs consent. Analytics without consent covers the conditions.

Reading your own site

A scan lists each cookie with its host and whether it is first-party, together with the script or iframe that set it; the cookie scanner does this on up to five pages without an account. The developer tools' Application tab shows the same thing live, with the domain column answering the party question and the purpose column left for you to fill in. That second column is the one the law cares about.