Understanding Tracking Cookies And How They Work

Last updated: October 2026

Tracking cookies are small text files that websites save in your browser. At their simplest, a cookie is a short note a site leaves for itself. It might say that you are signed in, that you prefer dark mode, or that you looked at running shoes on Tuesday. The next time you visit, your browser sends that note back, and the site picks up where you left off.

That basic idea is helpful, and the web would feel broken without it. Shopping carts, signed in accounts and language choices all rely on cookies. The privacy question starts when cookies are used to follow you from site to site, build a picture of your interests, and share that picture with advertisers and data companies you have never heard of.

This guide explains the main cookie types in plain words, who tracks what and why, and how to check, clear and block cookies in Chrome, Firefox, Safari and Edge. None of the steps below will break your browser. A few sites may ask you to sign in again or reset your preferences after you clear cookies, and that is normal.

What Information Do Tracking Cookies Collect?

A cookie itself is just a name, a value and an expiry date. The value is often a random looking ID number. On its own that number means little. It becomes powerful when a company matches it to everything you do while carrying that ID, visit after visit.

Companies use tracking cookies to market products and services and to measure how sites are used. Depending on the site and the trackers on it, a cookie can be linked to:

• Your IP address and rough geographic location
• The pages you visited, how long you stayed and what you clicked
• Your searches on that site and the products you viewed
• Items you bought, or added to a cart and left behind
• Your device type, browser, screen size and language
• Referring site, meaning where you came from before you arrived

Cookies do not usually contain your name or email address by themselves. That changes if you create an account. Once you sign in, the site can tie the cookie ID to your profile, and the browsing history attached to that ID stops being anonymous in any practical sense.

How Do Tracking Cookies Work?

The process is simple, and it happens in seconds. First, you visit a page. Second, the page tells your browser to save one or more cookies. Third, your browser sends those cookies back on later requests to the same domain. Fourth, if the page includes adverts, videos, like buttons or analytics code from other companies, those companies can set and read their own cookies too.

Say you are planning to start a small business. You visit sites about suppliers, lease prices in your town and basic marketing. Later, on a news site that has nothing to do with business, you see adverts for card readers and shop fittings. That is not magic and it is not your phone listening to you. The ad network recognised your cookie ID on both sets of sites and bid to show you an advert matched to your recent browsing.

Advertisers like this system because it raises conversion rates. Instead of showing the same advert to everyone, they can show a reminder to people who already looked at a product. Site owners like it because relevant adverts pay more than random ones. The cost is paid in data about you, often without a clear moment where you agreed to that trade.

The Main Cookie Types, in Plain Words

People often talk about cookies as if they are all the same. They are not. The type matters far more than the name, because it tells you who set the cookie and how long it will stay on your device.

First-party cookies

First-party cookies are set by the site you are actually visiting. If you are on a news site and that site saves a cookie under its own domain, that is first-party. These cookies remember sign ins, carts, preferences and security checks. Most browsers allow them by default because blocking all of them makes many sites hard to use. They can still be used for analytics on that one site, but they do not follow you across the wider web by themselves.

Third-party cookies

Third-party cookies are set by a different domain from the site in your address bar. They usually arrive through embedded adverts, videos, social buttons, comment systems and analytics tools. Because the same ad or analytics company appears on thousands of sites, its cookie can build a cross-site history. This is the type most privacy settings focus on, and the type all four major browsers now restrict in some way.

Session cookies

Session cookies are temporary. They live only while the browser session is open and are deleted when you close the browser. Sites use them for tasks that should not be remembered, such as keeping items in a cart during one visit or moving through a multi step form. If a site forgets you the moment you close the tab, a session cookie was probably doing the work.

Persistent cookies

Persistent cookies have an expiry date set in the future, sometimes weeks, months or years ahead. They survive closing the browser. That is how a site can greet you as signed in next week, remember your city for weather, or keep showing you adverts for a sofa you viewed last month. Persistent cookies are not bad by nature. The question is who set them, what they record, and whether you were given a real choice.

Supercookies

Supercookie is not an official technical name. It is a plain label for tracking that is harder to find and harder to delete than a normal cookie. In the past this has included identifiers stored in unusual browser places, Flash based storage, and network level identifiers added by an internet provider. Deleting your normal cookies may not remove them, which is why privacy writers single them out.

You do not need to panic about supercookies, and most everyday tracking is still plain third-party tracking. The honest takeaway is narrower. Clearing cookies helps a lot, but it is not a invisibility cloak, and a browser with built in tracking protection gives you a stronger starting point.

Who Tracks What, and Why?

It helps to separate the actors, because their motives differ. The site you visit usually wants to keep you signed in, understand which articles or products work, and earn money from adverts or sales. Analytics companies count visits and show site owners where readers come from and where they leave. Ad networks and advertisers want to target adverts and prove those adverts led to sales. Social networks use embedded buttons and pixels to link browsing to accounts, even for people who never click the button. Data brokers combine information from many sources and sell audience segments, such as people likely to move house or buy a car.

Some tracking also has a defensive purpose. Banks and email providers use cookies and device signals to spot a sign in that looks stolen, and to remember a device you marked as trusted. That is one reason a total block on every cookie can cause extra security checks. A balanced setup blocks cross-site tracking while allowing the first-party cookies a site needs to work for you.

Are Tracking Cookies Dangerous?

Cookies are not viruses, and a cookie cannot install software or read files from your computer by itself. A tracking cookie is not the same thing as adware, which changes your browser or floods you with adverts, and it is not a trojan, which is harmful software disguised as something useful. Keeping those categories separate matters, because the fix for unwanted tracking is browser settings, while the fix for malware is removal.

The real risks are quieter. A detailed browsing profile can reveal health worries, money problems, political interests and family plans. Profiles can be shared, sold, leaked or used to charge different people different prices. Cookies can also be stolen by malware or by a badly secured site, and a stolen sign in cookie can let an attacker skip your password. If your concern is not adverts but a person tracking your device itself, read a device focused guide such as how to detect spyware on iPhone instead, because that is a different problem with different signs.

How to Check the Cookies a Site Has Set

You do not need special software to look. In Chrome and Edge, open Settings, go to Privacy and security in Chrome or Privacy, search, and services and then Cookies in Edge, and open the option to see all site data and permissions, or all cookies and site data. You can search for a site name and see how much data it and its partners have stored, then delete that one site without touching the rest.

In Firefox, open Settings, then Privacy and Security, then scroll to Cookies and Site Data and choose Manage Data. A searchable list shows each site, how many cookies it holds and when it was last used. In Safari on a Mac, open Safari Settings, then Privacy, then Manage Website Data to see and remove data site by site. On iPhone, go to Settings, then Safari, then Advanced, then Website Data.

Checking once is eye opening for most people. Sort by the sites you barely recognise. Embedded trackers often store more than the site you thought you were visiting.

How to Clear Cookies

Clearing cookies signs you out of most sites and resets preferences, so do it when you have your passwords handy. Using one of the top password managers makes that reset much less painful, because you are not relying on staying signed in forever to avoid forgetting a password.

On desktop Chrome, Firefox and Edge, pressing Control plus Shift plus Delete opens the clear data window. Choose Cookies, pick All time if you want a full reset, and clear. In Safari on a Mac, use Manage Website Data under Privacy and choose Remove All. On iPhone Safari, go to Settings, then Safari, then Clear History and Website Data. On Android Chrome, go to Settings, then Privacy and security, then Delete browsing data, and tick Cookies and site data.

How to Block Tracking Cookies in Each Browser

Browser defaults have improved a lot, and choosing a browser with strong defaults is half the job. Our roundup of the top secure browsers compares those defaults. Whatever you use now, the steps below reflect the current settings layout for each browser.

Google Chrome

• Open the three dot menu and choose Settings.
• Choose Privacy and security, then Third-party cookies.
• Select Block third-party cookies. Sites you use will still set first-party cookies.
• Turn on Send a Do Not Track request if you wish, knowing many sites ignore it.
• Use See all site data and permissions on the same page to review or remove a single site.

Mozilla Firefox

• Open the menu button and choose Settings.
• Choose Privacy and Security.
• Under Enhanced Tracking Protection, choose Strict for the simplest strong setting, or Custom if you want to choose yourself.
• With Custom, set Cookies to All cross-site cookies.
• If a trusted site breaks, use the shield icon in the address bar to allow tracking for that site only.

Safari

• On a Mac, open Safari, then Settings, then Privacy.
• Make sure Prevent cross-site tracking is ticked. Safari also limits many first-party tracking cookies automatically.
• Choose Block all cookies only if you accept that many sites will stop working as expected.
• On iPhone or iPad, go to Settings, then Safari, then Privacy and Security, and check Prevent Cross-Site Tracking and Block All Cookies there.

Microsoft Edge

• Open the three dot menu and choose Settings.
• Choose Privacy, search, and services, and set Tracking prevention to Balanced or Strict.
• Choose Cookies and site permissions, then Manage and delete cookies and site data.
• Turn on Block third-party cookies.
• Use See all cookies and site data to remove cookies for one site.

Habits That Help Beyond the Settings

On consent banners, choose Reject all or the strictest option when it is offered, rather than accepting to make the box go away. Use a private window for one off searches you do not want linked to your main profile, knowing it deletes session cookies on close but does not hide you from your network provider. Be careful with free privacy extensions, because an extension can see a lot of your browsing, and install only well reviewed tools from the official store. Finally, review permissions and tracking as part of a wider routine to stay safe from spying, rather than treating cookies as the whole privacy picture.

Conclusion

Tracking cookies allow sites and advertisers to remember you, measure visits and personalise adverts. First-party and session cookies are often useful and low risk. Third-party and persistent cookies deserve more scrutiny, because they can follow you for a long time across many sites. Check what is stored, clear cookies when you want a reset, block third-party cookies in your browser, and reject optional tracking on banners. Those four moves will not make you invisible online, but they will cut the amount of quiet tracking in your daily browsing by a large margin.