WebBuilding

Foundations

HTTP cookie

Summary

An HTTP cookie is a small piece of data that a website sends to a browser, which stores it and sends it back with later requests, so the site can remember logins, shopping carts and settings. Lou Montulli created cookies at Netscape in 1994, starting from another Netscape team's need for shopping cart functionality, and the IETF standardized them in RFC 2109 (1997), RFC 2965 (2000) and RFC 6265 (2011). Safari and Firefox restrict third-party cookies by default, while Google, after years of delays, said in April 2025 that Chrome would keep letting users choose, and Chrome still allows them by default. Under a 2009 amendment to the EU's ePrivacy Directive, cookies that are not strictly necessary need the visitor's consent.

Web Building Encyclopedia · Foundations · Last reviewed October 22, 2026 · 12 min read

An HTTP cookie is a small piece of data that a server sends to a web browser. The browser can store it and send it back to the same server with later requests.1 Cookies exist because HTTP is stateless by default: each request stands on its own, and the server has no built-in memory of the ones before it.1

MDN Web Docs, Mozilla’s developer reference, lists three main uses:1

  • Session management. Keeping a visitor signed in, or holding the contents of a shopping cart.
  • Personalization. Remembering settings such as the display language or a dark theme.
  • Tracking. Recording and analyzing what a visitor does.

The exchange uses two HTTP headers, lines of text that travel with each request and response. The server sends a Set-Cookie header with a name and a value, one header per cookie. The browser then returns its stored cookies for that server in a Cookie header on later requests.12 Scripts on the page can also read and write cookies through document.cookie in JavaScript, unless the cookie forbids it.1

Optional attributes after the value control each cookie:

  • Expires and Max-Age set how long the cookie lasts, as a date or as a number of seconds. If both are present, Max-Age wins.2 A cookie with neither is a session cookie, deleted when the session ends, though the browser decides when that is and session restore can keep it alive.1
  • Domain and Path limit which addresses receive the cookie. Without Domain, the cookie goes back only to the server that set it.2 MDN warns that Path is not a security measure.1
  • Secure, HttpOnly, SameSite and Partitioned add security and privacy limits, covered below.

Cookies are small by design. RFC 6265, the current standard, asks browsers to support at least 4,096 bytes per cookie, 50 cookies per domain and 3,000 cookies in total.2 Because they ride along with every request, MDN recommends browser storage such as localStorage or IndexedDB for data the server does not need to see.1

Invention at Netscape in 1994

Lou Montulli created the cookie in 1994 as a 23-year-old engineer at Netscape, the company behind the Netscape Navigator browser.3 In a 2013 account, Montulli wrote that around July 1994 he met with another group at Netscape that was building a shopping server and needed shopping cart functionality. HTTP fetched a document and disconnected, so a server had no way to link one request to the next.4

His design let a site send an identifier that only that site would get back, which he then widened into a general memory for websites.4 A popular alternative at the time was to give every browser a unique ID. Montulli opposed it, writing that “the unique identifier could be used to track a user at every website.”4 Quartz reported that the team rejected a permanent ID for that reason.3

David Kristol, who later led the cookie standards work, records that the first public version of Netscape’s browser, the 0.9 beta of September 1994, already supported cookies, though that was not well known at the time. His account says only that the mechanism was introduced at the request of one of Netscape’s customers. Montulli wrote the original specification and chose the name.5 The specification itself gives no particular reason for the name.6

That document, titled “Persistent Client State: HTTP Cookies,” described a Set-Cookie header with a NAME=VALUE pair and optional expires, domain, path and secure fields. It asked browsers to keep at least 300 cookies, 20 per server and 4 KB per cookie.6 Montulli filed a patent on the method on October 6, 1995. It was granted on June 30, 1998, as US Patent 5,774,670, assigned to Netscape Communications.7

Standards: RFC 2109 to RFC 6265 and its revision

Work on a formal standard began in April 1995 on the www-talk mailing list. Kristol, of Bell Laboratories, submitted an Internet Draft with his own Session-ID proposal, later renamed State-Info, in August 1995, and in December 1995 he agreed to lead a state management subgroup of the IETF‘s HTTP working group.5

  • RFC 2109 (February 1997). Written by Kristol, then at Bell Laboratories, Lucent Technologies, and Montulli of Netscape, it was the first standards-track cookie specification. It calls itself “an amalgam of Kristol’s State-Info proposal and Netscape’s Cookie proposal.” Its format differed from Netscape’s but could work alongside it.8
  • RFC 2965 (October 2000). The same two authors, with Montulli now at Epinions.com, replaced RFC 2109. It added new Set-Cookie2 and Cookie2 headers.9 A companion document, RFC 2964, “Use of HTTP State Management,” was published the same month.5
  • RFC 6265 (April 2011). Written by Adam Barth of the University of California, Berkeley, it defines the Cookie and Set-Cookie headers that browsers use today. It replaced RFC 2965, moved RFC 2109 and RFC 2965 to Historic status and deprecated Set-Cookie2 and Cookie2. Its abstract notes that cookies have security and privacy weaknesses but are widely used.2

A revision of RFC 6265, known as 6265bis, has been in progress for years. Its editors are Steven Bingler, Mike West of Google and John Wilander of Apple. It would obsolete RFC 6265 and replaces earlier drafts on SameSite and cookie prefixes.10

The Internet Engineering Steering Group approved the draft on December 2, 2025, and sent it to the RFC Editor the same day.11 As of October 22, 2026, it has not been published as an RFC. The latest version is draft 22 of December 1, 2025, and the RFC Editor has listed it as blocked, pending final approval, since October 19, 2026.1011

First-party and third-party cookies

A cookie is first-party when its domain and scheme match the page shown in the browser’s address bar. It is third-party when they differ, as when a sign-in widget hosted on one domain is embedded on several other sites.12 Third-party cookies have legitimate uses, including staying signed in across related sites, sharing preferences, cross-site analytics and counting ad impressions.12

They also make cross-site tracking possible. RFC 6265 singles out third-party cookies as particularly worrisome: a third party such as an advertising network embedded on many sites can follow the same browser from one to the next.2

That use appeared early. Montulli wrote that ad companies such as DoubleClick used third-party cookies to follow browsers across the sites that carried their ads, and that by 1996 users were objecting.4 He told Quartz that the team became aware of this in 1996. Netscape chose to give users control over cookies instead of blocking third-party ones.3 Montulli reasoned that blocking would push advertisers toward less visible tracking methods.4

The standards group took a stricter line. In February 1996 it identified third-party cookies, which it called unverifiable transactions, as a privacy threat.5 RFC 2109 let a browser set or send a cookie during such a transaction only under narrow conditions, and any option to override that had to be off by default.8 Kristol wrote that advertising networks protested, and that browser vendors “were unwilling to change the third-party default to ‘off.'”5

In 2022, Montulli told AFP that he supports phasing out third-party cookies but warned against getting rid of cookies altogether. He argued that ad tracking is possible only when many websites work together with an ad network.13

Security attributes: Secure, HttpOnly and SameSite

Because cookies often hold the proof that a visitor is signed in, a stolen cookie can let someone else act as that visitor. Several attributes limit the risk.

  • Secure. The cookie is sent only over HTTPS, and an insecure http: page cannot set it.1 RFC 6265 notes that this protects a cookie’s confidentiality but not its integrity against an active attacker.2
  • HttpOnly. Scripts on the page cannot read the cookie. MDN says this helps against cross-site scripting (XSS), in which an attacker’s script runs inside a trusted page, and that session cookies should use it.1
  • SameSite. This controls whether the cookie travels with cross-site requests. Strict sends it only on requests from its own site. Lax also sends it when a visitor follows a link to the site from elsewhere. None sends it everywhere, including inside third-party frames.1 A cookie marked None must also be marked Secure.14

SameSite is a defense against cross-site request forgery (CSRF), an attack in which another site causes the browser to send a request that carries the victim’s cookies. RFC 6265 warns that cookies “encourage developers to rely on ambient authority for authentication,” the weakness behind CSRF.2

Chrome changed the default in 2020. Starting with Chrome 80, it treats a cookie with no SameSite attribute as Lax and rejects SameSite=None cookies that are not Secure. The rollout began the week of February 17, 2020, was paused on April 3 because of COVID-19, resumed on July 14 and was aimed at all Chrome 80 and later users from August 11, 2020.15 MDN notes that only some browsers use Lax as the default when the attribute is missing.14

Two newer features tighten things further. Cookie prefixes are names the browser enforces: a cookie named with __Secure- must be Secure, and one named with __Host- must also have Path=/ and no Domain, which locks it to a single host.1 The Partitioned attribute, from the proposal called CHIPS (Cookies Having Independent Partitioned State), stores a third-party cookie in a separate jar for each top-level site, so it cannot be shared across sites. It requires Secure.1412

Browsers restrict third-party cookies

Each major web browser now limits third-party cookies in some way, but their defaults differ.

Safari

Apple’s WebKit team announced Intelligent Tracking Prevention (ITP) on June 5, 2017. A machine learning model on the device classifies domains that can track users across sites, and their cookies and data are purged if the user has not interacted with them for 30 days.16 On March 24, 2020, WebKit announced full third-party cookie blocking by default in Safari 13.1 and iOS and iPadOS 13.4, calling Safari “the first mainstream browser to fully block third-party cookies by default” and noting that only Tor Browser had done so before. Sites that need cross-site cookies can ask through the Storage Access API.17

Firefox

On September 3, 2019, Mozilla turned on Enhanced Tracking Protection for all Firefox users. It blocks known third-party tracking cookies using the Disconnect list and had been on for new users since June 2019.18 On June 14, 2022, Mozilla announced that Total Cookie Protection was becoming the default for all Firefox desktop users worldwide. It gives each website its own cookie jar, so a tracker sees only what happens on a single site.19

Chrome

Google’s plans for Chrome changed several times. All of the steps below come from Google’s own announcements:

  • January 14, 2020. Justin Schuh, Chrome’s engineering director, announced a plan to make third-party cookies obsolete within two years.20
  • June 24, 2021. Google moved the end to a three-month phase-out finishing in late 2023.21
  • July 27, 2022. The start moved to the second half of 2024.22
  • January 4, 2024. Under a plan announced on December 14, 2023, Chrome was to start a test that blocks third-party cookies by default for a randomly chosen 1% of users worldwide.23
  • April 23, 2024. Google said it would not finish the phase-out in late 2024 and envisioned starting it early the next year, saying the UK’s Competition and Markets Authority (CMA) needed time to review the evidence.24 The CMA had opened an investigation on January 7, 2021, and accepted binding commitments from Google on February 11, 2022.25
  • July 22, 2024. Google proposed that, instead of deprecating third-party cookies, Chrome would offer a new experience letting people make a choice that applies across their browsing.26
  • April 22, 2025. Google said it would keep its current approach and “will not be rolling out a new standalone prompt for third-party cookies.” Users can still choose in Chrome’s settings, and Incognito mode blocks third-party cookies by default.27
  • October 17, 2025. The CMA released Google from its commitments, saying its competition concerns no longer arose.25 The same day, Google said it would retire most Privacy Sandbox technologies, its proposed replacements for cookie-based ad tracking, including Topics, Protected Audience and Attribution Reporting, citing low adoption. It kept CHIPS, FedCM and Private State Tokens.28

As of October 2026, Chrome does not block third-party cookies by default, except in Incognito mode or when a user turns blocking on.12 Google’s status page, last updated August 14, 2026, lists CHIPS and the Storage Access API as continuing and Topics, Protected Audience and Related Website Sets as being deprecated and removed.29

Cookies and the law

This section is general information about how several laws treat cookies, not legal advice.

The EU ePrivacy Directive

The EU’s ePrivacy Directive, Directive 2002/58/EC, was adopted on July 12, 2002.30 Its recitals called cookies “a legitimate and useful tool” and said users should be able to refuse them. Article 5(3) at first allowed storing or reading information on a user’s device if the user was given clear and comprehensive information and offered the right to refuse.30

Directive 2009/136/EC, adopted on November 25, 2009, rewrote Article 5(3). Storing information on a user’s device, or reading it, became allowed only if the user has given consent after receiving clear and comprehensive information. Two exceptions remain: storage needed only to carry a communication, and storage strictly necessary for a service the user explicitly asked for. Member states had until May 25, 2011, to adopt the change.31

Consent under the GDPR

The GDPR supplies the meaning of consent. Its recitals list cookie identifiers among the online identifiers that can be linked to a person, and state: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent.”32 In the Planet49 case, decided on October 1, 2019, the EU Court of Justice ruled that a pre-ticked checkbox is not valid cookie consent, that the rule applies whether or not the stored data is personal data, and that users must be told how long cookies last and whether third parties can access them.33

Changes are under discussion. On October 21, 2026, the Council of the EU agreed its position on a package of simplifications. It keeps the cookie rules in the ePrivacy Directive but adds purposes that would not need consent, such as providing a service, audience measurement and device security, with the stated aim of reducing the number of cookie banners. Talks with the European Parliament start once Parliament adopts its own position, so the current rules still apply.34

California: the CCPA

California’s Consumer Privacy Act of 2018 (CCPA) was amended by Proposition 24, approved by voters in November 2020, and its new protections took effect on January 1, 2023.35 The statute’s definition of a unique identifier includes cookies, beacons, pixel tags, mobile ad identifiers and similar technology.36

The CCPA gives consumers a right to opt out: they can tell a business to stop selling or sharing their personal information, and “sharing” means sharing for cross-context behavioral advertising, ads targeted using activity across other sites.3635 A business that sells or shares must offer a “Do Not Sell or Share My Personal Information” link, and the Attorney General says the Global Privacy Control browser signal must be honored as a valid opt-out request.35

The law covers for-profit businesses that do business in California and meet one threshold: annual gross revenue above a set amount, buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing it.36 The Attorney General’s page gives the revenue figure as $25 million, while the California Privacy Protection Agency lists the inflation-adjusted figure as $26,625,000 from January 1, 2025.3537

Timeline

  1. The Council of the EU agrees a position that keeps the cookie rules in the ePrivacy Directive but adds consent exemptions34
  2. The IESG approves the 6265bis revision of the cookie standard and sends it to the RFC Editor11
  3. Google says it will retire most Privacy Sandbox technologies and keep offering third-party cookie choice in Chrome28
  4. Google says Chrome will keep its current third-party cookie approach and not add a standalone prompt27
  5. Chrome's test of blocking third-party cookies for 1% of users is set to begin23
  6. Mozilla announces Total Cookie Protection is becoming the default for all Firefox desktop users worldwide19
  7. Safari 13.1 blocks all third-party cookies by default17
  8. Chrome 80 begins treating cookies without SameSite as Lax15
  9. Google announces a plan to phase out third-party cookies in Chrome within two years20
  10. Firefox blocks known third-party tracking cookies by default for all users18
  11. WebKit announces Intelligent Tracking Prevention for Safari16
  12. RFC 6265 replaces RFC 2965 and moves RFC 2109 and RFC 2965 to Historic status2
  13. Directive 2009/136/EC makes consent the rule for cookies in the EU31
  14. RFC 2109, the first standards-track cookie specification, is published8
  15. Around this month, Lou Montulli meets a Netscape team that needs shopping cart functionality, the problem cookies were designed to solve4

What it means for your website

This is general information, not legal advice. If your site has visitors in the EU or California, check the rules with the regulator’s own guidance or a lawyer.

  • List the cookies your site sets. A plain WordPress site sets login cookies such as wordpress_logged_in_ only for signed-in users, plus comment cookies that last a little under a year.38 Since WordPress 4.9.6 of May 17, 2018, commenters choose whether to save their details with a checkbox.39 We build on WordPress every week, and the list should also cover what plugins, analytics and ad tags add.
  • Protect login cookies. Ask your developer to set Secure, HttpOnly and an explicit SameSite value on any cookie that keeps someone signed in.1 Secure only works on a site served over HTTPS, so an SSL certificate comes first.
  • Do not depend on third-party cookies. Safari and Firefox restrict them by default, and Chrome users can block them.12 Embedded widgets and cross-site tracking can fail for many visitors.
  • EU visitors: consent comes first. Under the ePrivacy Directive, cookies that are not strictly necessary, such as most analytics and ad cookies, need consent before they are set.31 The EU Court of Justice has ruled that pre-ticked boxes are not valid consent and that visitors must be told how long cookies last and whether third parties can read them.33 Google’s EU user consent policy also requires sites that use its products to get consent for cookies from visitors in the EEA, the UK and Switzerland where the law requires it.40 Our page on websites and Google Ads covers the tags involved.
  • California visitors: offer the opt-out. If your business meets a CCPA threshold and sells data or shares it for cross-site ads, the Attorney General says it needs a “Do Not Sell or Share” link and must honor Global Privacy Control signals.35 Our guide to website laws in the US covers other rules.

See also

References

  1. Using HTTP cookies. MDN Web Docs. accessed October 22, 2026.
  2. RFC 6265: HTTP State Management Mechanism (Adam Barth). Internet Engineering Task Force, RFC Editor. 2011-04. accessed October 22, 2026.
  3. The inventor of the digital cookie has some regrets (Nicolás Rivero). Quartz. 2021-04-25. accessed October 22, 2026.
  4. The reasoning behind Web Cookies. Lou Montulli, montulli.blogspot.com. 2013-05-14. accessed October 22, 2026.
  5. HTTP Cookies: Standards, Privacy, and Politics (David M. Kristol). arXiv, Cornell University. 2001-05-09. accessed October 22, 2026.
  6. Persistent Client State: HTTP Cookies (Netscape preliminary specification, copy hosted by the curl project). curl. accessed October 22, 2026.
  7. US Patent 5,774,670: Persistent client state in a hypertext transfer protocol based client-server system (Lou Montulli). Google Patents. 1998-06-30. accessed October 22, 2026.
  8. RFC 2109: HTTP State Management Mechanism (David M. Kristol and Lou Montulli). Internet Engineering Task Force, RFC Editor. 1997-02. accessed October 22, 2026.
  9. RFC 2965: HTTP State Management Mechanism (David M. Kristol and Lou Montulli). Internet Engineering Task Force, RFC Editor. 2000-10. accessed October 22, 2026.
  10. Cookies: HTTP State Management Mechanism (draft-ietf-httpbis-rfc6265bis). IETF Datatracker. accessed October 22, 2026.
  11. History for draft-ietf-httpbis-rfc6265bis. IETF Datatracker. accessed October 22, 2026.
  12. Third-party cookies. MDN Web Docs. accessed October 22, 2026.
  13. Web Tracking Cookies Meant to Protect Privacy: Inventor (AFP). SecurityWeek. 2022-01-28. accessed October 22, 2026.
  14. Set-Cookie header. MDN Web Docs. accessed October 22, 2026.
  15. SameSite Updates. The Chromium Projects. accessed October 22, 2026.
  16. Intelligent Tracking Prevention (John Wilander). WebKit blog. 2017-06-05. accessed October 22, 2026.
  17. Full Third-Party Cookie Blocking and More (John Wilander). WebKit blog. 2020-03-24. accessed October 22, 2026.
  18. Today's Firefox Blocks Third-Party Tracking Cookies and Cryptomining by Default (Marissa Wood). The Mozilla Blog. 2019-09-03. accessed October 22, 2026.
  19. Firefox rolls out Total Cookie Protection by default to more users worldwide. The Mozilla Blog. 2022-06-14. accessed October 22, 2026.
  20. Building a more private web: A path towards making third party cookies obsolete (Justin Schuh). Chromium Blog, Google. 2020-01-14. accessed October 22, 2026.
  21. An updated timeline for Privacy Sandbox milestones (Vinay Goel). Google, The Keyword. 2021-06-24. accessed October 22, 2026.
  22. Expanding testing for the Privacy Sandbox for the Web (Anthony Chavez). Google, The Keyword. 2022-07-27. accessed October 22, 2026.
  23. The next step toward phasing out third-party cookies in Chrome (Anthony Chavez). Google, The Keyword. 2023-12-14. accessed October 22, 2026.
  24. Update on the plan for phase-out of third-party cookies on Chrome. Privacy Sandbox blog, Google. 2024-04-23. accessed October 22, 2026.
  25. Investigation into Google's 'Privacy Sandbox' browser changes. Competition and Markets Authority, GOV.UK. accessed October 22, 2026.
  26. A new path for Privacy Sandbox on the web (Anthony Chavez). Privacy Sandbox blog, Google. 2024-07-22. accessed October 22, 2026.
  27. Next steps for Privacy Sandbox and tracking protections in Chrome (Anthony Chavez). Privacy Sandbox blog, Google. 2025-04-22. accessed October 22, 2026.
  28. Update on plans for Privacy Sandbox technologies (Anthony Chavez). Privacy Sandbox blog, Google. 2025-10-17. accessed October 22, 2026.
  29. Privacy Sandbox feature status. Privacy Sandbox, Google. 2026-08-14. accessed October 22, 2026.
  30. Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector. EUR-Lex, Publications Office of the European Union. 2002-07-12. accessed October 22, 2026.
  31. Directive 2009/136/EC amending Directives 2002/22/EC and 2002/58/EC and Regulation (EC) No 2006/2004. EUR-Lex, Publications Office of the European Union. 2009-11-25. accessed October 22, 2026.
  32. Regulation (EU) 2016/679 (General Data Protection Regulation). EUR-Lex, Publications Office of the European Union. 2016-04-27. accessed October 22, 2026.
  33. Judgment in Case C-673/17, Bundesverband der Verbraucherzentralen v Planet49 GmbH. Court of Justice of the European Union, via EUR-Lex. 2019-10-01. accessed October 22, 2026.
  34. Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules. Council of the European Union. 2026-10-21. accessed October 22, 2026.
  35. California Consumer Privacy Act (CCPA). California Department of Justice, Office of the Attorney General. 2026-08-28. accessed October 22, 2026.
  36. California Consumer Privacy Act of 2018 (Civil Code 1798.100 to 1798.199.100, as amended). California Privacy Protection Agency. 2024-07-15. accessed October 22, 2026.
  37. Updated Monetary Thresholds in CCPA. California Privacy Protection Agency. accessed October 22, 2026.
  38. Cookies. Advanced Administration Handbook, WordPress.org. accessed October 22, 2026.
  39. WordPress 4.9.6 Privacy and Maintenance Release. WordPress.org News. 2018-05-17. accessed October 22, 2026.
  40. EU user consent policy. Google. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].