Part of:A marketing team's guide to third-party cookies
First-party vs. third-party cookies: What's the difference?
First-party cookies track user engagement, while third-party cookies are central to many marketing and sales strategies. Yet the two types are more similar than one might think.
Website cookies serve a necessary function on the modern internet, but they remain largely misunderstood and have gained a bad reputation.
Websites can put small packets of data, called cookies, on a user's computer. These packets store information from a user's session on a given website so the website and its owners can retrieve that data later. This information can help companies and their advertising partners offer personalized user experiences. In addition to sites and site owners, third parties can access certain data for uses like targeted advertising.
What are cookies?
Cookies primarily help websites track users' visits and activity, so users likely experience them in practice every day. For example, if a user visits a website to check the weather by ZIP code, that site can populate the ZIP code automatically when the user visits next. Or if someone shops online and browses for certain items, they might receive targeted ads for that product or related products as they visit other websites on the same browser.
While cookies have several subsets, they essentially roll into two main categories: first-party and third-party. Both types contain the same information and perform the same function: tracking data. From a technical standpoint, they have no real difference. However, the ways that domains create and use each type differ.
What are first-party cookies?
A website's publisher or owner adds a line of JavaScript code that creates a first-party cookie for that domain. This type of cookie is meant to enable a more positive UX, as the browser collects key data points to improve future visits. Collected data includes which pages a user visited, items left in a shopping cart or personal information a user voluntarily submits, like login credentials or location details. For this reason, first-party cookies generally have a more positive reputation than other types.
What are third-party cookies?
As the name suggests, third-party cookies come from servers or domains different from the one a user is visiting. Third parties place them -- most commonly for advertising purposes -- onto the user's device through websites with scripts or tags that load the third party's code.
Also known as persistent cookies, these data packets remain on a website until an administrator takes them down, although users can disable cookie tracking on browsers they use. In addition to advertising, third parties use this data for services such as live chat, pop-ups from a different domain or buttons from social media platforms.
First-party and third-party cookies track user activity, but they do so for different purposes.
Do second-party cookies exist?
Data from first and third parties is more prevalent than second-party data, which tends to fall under the radar.
Second-party cookies include first-party data that one company creates and transfers to another as part of a data-sharing partnership, typically for advertising. For example, an airline can share first-party user data, such as name, email and site activity, with a car rental partner so the rental company can advertise its offerings to airline customers for the destination they searched.
However, many experts debate the validity of second-party cookies as they share first-party data.
Differences between first-party and third-party cookies
While first-party and third-party cookies are the same file type, marketers should know how they differ.
Both types contain the same information and perform the same function: tracking data.
Creation and use. First-party cookies originate on the site a user visits to track engagement, like visits, clicks, pages viewed, personal data voluntarily submitted in site forms or items in a shopping cart. A domain or company separate from the domain the user is visiting generates third-party cookies. Marketing teams use this data for advertising or enabling certain third-party vendors' services.
While cookies won't necessarily infect a computer with malware, users should know which type a website uses. Most websites have a banner or some form of pop-up to notify users of their use of this data and the company's policies. Users can review those policies, control tracking on websites they visit and manage cookies stored on browsers.
Good vs. bad. Third-party cookies get a particularly bad rap, as marketers mainly use them for advertising. As a result, many organizations have turned or plan to turn away from this data.
The future of first-party and third-party cookies
Regulators and consumers have applied pressure to protect online privacy, and many employees within large tech organizations have blocked third-party cookies on their websites. Apple's Safari and Mozilla's Firefox browsers already block them by default, and in June 2021, Google announced its plans to phase out third-party cookies on Chrome. Those plans faced several delays.
While Google began to phase out third-party cookies in early 2024 for a small percentage of users, Google abandoned the plan. Instead, it plans to let consumers make a more informed choice about this tracking. It will still offer its Privacy Sandbox APIs, initially designed as an alternative to cookies.
Still, advertisers and publishers should explore alternative marketing strategies, as vendors and consumers alike still actively move away from third-party cookies.
Editor's note: This article was first published in 2022 and updated to reflect changes in Google's cookie deprecation timeline.
Griffin LaFleur is a MarketingOps and RevOps professional working for Swing Education. Throughout his career, Griffin has also worked at agencies and independently as a B2B sales and marketing consultant.
