# First-party vs third-party cookies: what the difference means for consent

> A first-party cookie belongs to the site you are on, a third-party cookie to another domain. Consent rules apply to both: the law looks at purpose, not domain.

Source: https://cookiequiet.com/blog/first-party-vs-third-party-cookies
Published: 2026-10-20
Publisher: Cookiequiet

A first-party cookie is set by the domain in the address bar; a third-party cookie is set by another domain whose content the page loads, an ad server or an embedded widget. The distinction decides which browser rules apply and who can read the cookie, and it has almost no bearing on whether you need consent. The ePrivacy rule covers storing or reading any information on the visitor's device, whoever does it and for whatever purpose, so Google Analytics' first-party `_ga` cookie needs consent just as a third-party advertising cookie does. Meanwhile Safari has blocked third-party cookies by default since 2020, Firefox isolates them since 2022, and Chrome decided in April 2025 to keep them and let users choose.

## The technical difference

When a browser loads example.com, cookies set by example.com (or by scripts running on its pages) are first-party: they are sent back to example.com on later visits. If the page also loads an iframe or a pixel from ads.example-network.com, cookies set in that response belong to the network's domain and are sent back to it from every site that embeds its content. That is what makes them useful for tracking across sites, and what browsers now restrict.

Three things blur the line:

- **A third-party script can set a first-party cookie.** Google Analytics runs on your page and writes `_ga` under your domain. Meta's pixel writes `_fbp` under your domain. The data still goes to Google or Meta on every hit; only the storage is first-party.
- **Server-side tagging and CNAME tricks make trackers look first-party.** A tracker served from `metrics.example.com` that points to a vendor's servers is first-party for the browser and third-party in substance.
- **Local storage and fingerprinting are not cookies at all** and are covered by the same consent rule. The ICO's guidance lists cookies, tracking pixels, link decoration, local storage, device fingerprinting, scripts and tags as technologies the rules apply to.

## What browsers do now

**Safari.** In March 2020 WebKit announced full third-party cookie blocking by default for all sites, calling Safari the first mainstream browser to do so, and capped script-writable storage (local storage, IndexedDB and similar) at seven days of Safari use without interaction with the site.

**Firefox.** Mozilla rolled out Total Cookie Protection by default to all desktop users worldwide in June 2022. It creates a separate "cookie jar" for each website, so a third party's cookies set while you visit site A are not available when you visit site B.

**Chrome.** After years of announced deprecation, Google said in July 2024 that it would not phase out third-party cookies and would instead let users choose, then on 22 April 2025 announced that it would keep its current approach to third-party cookie choice in Chrome and would not roll out a new standalone prompt; users continue to manage them in Chrome's privacy settings.

The result: the cross-site tracking cookie is dead in two of three major browsers and alive by default in the one with the largest share. Advertising has moved toward first-party data, server-side tagging and modeled measurement, which is why first-party cookies matter more, not less, for consent.

## What the law looks at

Article 5(3) of the ePrivacy Directive does not mention first or third parties. It allows storing or accessing information on the device only with consent, except for what is strictly necessary for a service the user requested. The question is therefore the purpose of the cookie, not its domain:

| Cookie | Party | Purpose | Consent? |
|---|---|---|---|
| Session id, cart, CSRF token | First | Strictly necessary | No |
| The cookie storing the visitor's cookie choice | First | Strictly necessary | No |
| `_ga`, `_ga_*` (Google Analytics 4) | First | Analytics | Yes (with narrow national exemptions for configured, publisher-only tools) |
| `_fbp` (Meta Pixel) | First | Advertising | Yes |
| `_gcl_au` (Google Ads) | First | Advertising attribution | Yes |
| `IDE` (DoubleClick) | Third | Advertising | Yes |
| YouTube embed cookies | Third | Embedded content, advertising | Yes |
| Login cookie of an embedded payment form | Third | Strictly necessary for the payment the user requested | Generally no, if limited to that |

Two consequences for a banner. First, the categories should be organised by purpose (necessary, functional, analytics, marketing), with first-party and third-party noted in the cookie table for transparency, not as a basis for exemption. Second, "we only use first-party cookies" is not a compliance statement; "we only use strictly necessary cookies" is.

## What this means for blocking

Because the storage is often first-party, blocking is about scripts, not cookie domains. A banner that only suppresses third-party cookies would let Google Analytics and Meta Pixel run. The working approach is to stop the scripts themselves until consent: mark the tags, hold the embeds, intercept dynamically created trackers, as [the script blocking guide](/guides/block-scripts-until-consent) explains. On refusal, nothing non-necessary runs, so no cookie of either party is written.

## What this means for analytics

The decline of the third-party cookie did not touch analytics, which was first-party all along. What matters for analytics is whether the tool is used for the publisher only and produces anonymous statistics, which is the test for the French consent exemption, or whether it feeds a vendor's advertising systems, which is why Google Analytics 4 needs consent. [Analytics without consent](/blog/analytics-without-consent) covers the conditions.

## Reading your own site

A scan lists each cookie with its host and whether it is first-party, together with the script or iframe that set it; the [cookie scanner](/tools/cookie-scanner) does this on up to five pages without an account. The developer tools' Application tab shows the same thing live, with the domain column answering the party question and the purpose column left for you to fill in. That second column is the one the law cares about.

## Questions

### Are first-party cookies exempt from consent?

No. Only strictly necessary cookies are exempt, whatever their domain. A first-party analytics or advertising cookie, such as _ga or _fbp, needs consent like any other non-necessary cookie.

### If Chrome keeps third-party cookies, do I still need a banner?

Yes. The banner is required by the law on storing information on devices, not by browser behaviour, and most of what needs consent on a typical site is first-party storage written by third-party scripts. Chrome's April 2025 decision changes advertising technology, not your obligations.

### Does local storage need consent too?

Yes. The rule covers any information stored on or read from the device; the ICO explicitly lists local storage, pixels, link decoration and fingerprinting. Treat a local storage entry like a cookie: exempt only if strictly necessary.

## Sources

- [Directive 2002/58/EC (ePrivacy Directive), article 5(3)](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [WebKit, Full Third-Party Cookie Blocking and More (24 March 2020)](https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/)
- [Mozilla, Firefox rolls out Total Cookie Protection by default to all users worldwide (14 June 2022)](https://blog.mozilla.org/en/products/firefox/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/)
- [Google Privacy Sandbox, Next steps for Privacy Sandbox and tracking protections in Chrome (22 April 2025)](https://privacysandbox.google.com/blog/privacy-sandbox-next-steps)
- [ICO, Fact vs fiction: ICO debunks myths on storage and access technologies (11 September 2025)](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/09/fact-vs-fiction-ico-debunks-myths-on-storage-and-access-technologies)