SameSite attribute
SameSite is a cookie attribute that tells the browser whether to send the cookie with requests coming from other sites, with the values Strict, Lax and None.A server sets it in the Set-Cookie header, for example Set-Cookie: id=a3fWa; SameSite=Lax. According to MDN, Strict sends the cookie only for requests that originate from the site that set it. Lax also sends it on cross-site requests when they are top-level navigations, meaning the address bar changes, and use a safe method such as GET, but not with images, scripts, fetch calls or iframes loaded by another site. None sends it with all requests, same-site and cross-site, and requires the Secure attribute. Some browsers, Chrome among them, treat a cookie without the attribute as Lax.
The attribute was designed as a defense against cross-site request forgery, but it also defines which cookies can work as third-party cookies. An advertising or embed cookie has to be set with SameSite=None; Secure to be sent when its domain is loaded inside another site. Seeing SameSite=None in a scan is therefore a hint that a cookie is meant for cross-site use.
SameSite says nothing about consent. A Strict analytics cookie still needs consent in the EU, and a None cookie for a payment provider's fraud check may be strictly necessary. The newer Partitioned attribute, which stores a cross-site cookie separately for each top-level site, narrows tracking further. See cookie for the other attributes.