First-party cookie

A first-party cookie belongs to the site you are visiting: a session identifier on shop.example, the cookie that records your consent choice, or the _ga cookie that Google Analytics writes on the site's own domain. Browsers treat first-party cookies as the normal case and do not block them by default, which is why most analytics vendors moved to first-party cookies when third-party cookies started disappearing.

Being first-party says nothing about whether consent is required. The ePrivacy Directive looks at the purpose, not the domain: a first-party analytics or advertising cookie still needs prior consent unless it is strictly necessary for a service the visitor requested. A first-party identifier that a script sends to an advertising platform in a request is also a form of data sharing, and in California that transfer can count as sharing for cross-context behavioral advertising.

In practice, first-party cookies cover most of the necessary category (login, cart, security, consent storage) and much of analytics. The scan behind a consent banner should list them with their purpose and lifetime, since they are often the ones a site owner forgets to document. See first-party versus third-party cookies for the browser side of the story.