First-Party vs Third-Party Cookies: What Your Banner Actually Controls
A site owner opened the cookie list in the banner and counted 40 entries. Most of them were third-party, set by ad networks and analytics providers the owner had never heard of. The owner asked a reasonable question: if the banner controls all of these, why are there so many, and if it does not control them, what is the banner for?
The answer starts with who sets the cookie. A first-party cookie is set by the domain the visitor is on. A third-party cookie is set by a different domain, usually an ad network or a tracking provider whose script is running on the page. The banner governs both, but it governs them through different mechanisms, and the browser is already doing some of the work for one of them.
The test is who sets it
The test is the domain in the cookie, not the name of the company. If the visitor is on example.com and the cookie's domain is example.com, it is first-party. If the domain is an ad network, it is third-party, even if the script that set it was loaded by example.com. Open the browser's cookie list on any page and the split is visible in seconds.
First-party cookies are the site's own memory: login sessions, shopping carts, preferences, and the consent record itself. Third-party cookies are the cross-site memory: the identifier that lets an ad network recognize the same visitor on a hundred different sites. That difference is why the rules treat them differently, and why the banner's job is different for each.
What Safari and Firefox already do
Safari and Firefox block third-party cookies by default. Chrome, with about 67 percent of the browser market, does not. Google reversed its plan to deprecate third-party cookies in July 2024 and confirmed the decision in April 2025, so the Chrome position is now a settled one: third-party cookies stay, and the choice sits with the user in the browser settings.
The practical result is a split audience. A visitor on Safari never sees the third-party cookie at all, whatever the banner says. A visitor on Chrome sees it unless the banner blocks it. The banner has to handle both, and the test has to run in both browsers, because a banner that works in Chrome and fails in Safari is a banner that works for only part of the audience.
The 2026 change in the UK
The UK Data (Use and Access) Act 2025 changes one corner of this picture. From February 5 2026, some first-party analytics cookies are exempt from the prior-consent requirement in the UK, on the grounds that they are low risk and the site needs them to function. The exemption is narrow: it covers first-party analytics only, not third-party cookies, not advertising, and not anything that identifies the visitor across sites.
The exemption does not remove the banner. It removes one item from the banner's workload, and only for UK visitors, and only for analytics that stays first-party. A site that reads the exemption as a reason to drop consent for everything has read it wrong, and the ICO has been clear about that. The agency's 2025 check of the top 1,000 UK sites found 95 percent compliant, which is a high bar, and the remaining 5 percent were not saved by a broad reading of the exemption.
Keep reading: how reject-all parity works on the banner, how consent is re-checked on single-page-app route changes, and what the banner has to do in mobile apps cover the nearby cases in this series.
Frequently asked questions
How do I tell a first-party cookie from a third-party one?
Look at the domain in the cookie, not the company name. If the visitor is on example.com and the cookie's domain is example.com, it is first-party. If the domain is an ad network or another site, it is third-party, even if the script that set it was loaded by example.com.
Do Safari and Firefox block third-party cookies?
Yes, both block them by default. Chrome does not, and Google confirmed in April 2025 that it will keep third-party cookies. That leaves a split audience, so test the banner in more than one browser.
What changed for first-party analytics in the UK in 2026?
The UK Data (Use and Access) Act 2025 exempts some first-party analytics cookies from the prior-consent requirement from February 5 2026. The exemption is narrow: first-party analytics only, not third-party cookies, not advertising, and not anything that identifies the visitor across sites.
Does my banner need to list every third-party cookie?
It needs to list the purposes and the vendors, and the visitor has to be able to refuse them. Listing every individual cookie is not required, but the categories have to be honest. A vendor that sets cookies under the strictly necessary label when it is actually an ad network is a mislabel, and audits catch it.