Fundamentals

Tracking Cookies: What They Are, How They Work, and Their Limits

By Daniel Sardá · Published on October 21, 2026

7 min read1,351 words

Tracking cookies can recognize a browser and connect part of its activity. Understanding how they work helps you decide what to accept, block, or delete.

You visit an online store, look at a pair of sneakers, and later see similar ads on other websites. It is easy to blame it all on “cookies,” as though they were tiny programs watching every move. The actual mechanism is more limited—and more interesting: a cookie is data that a browser stores and can return to a server in later requests.

When that data is used to recognize a browser and connect its activity over time, it is a tracking cookie. Not every cookie serves that purpose, and not every form of tracking depends on cookies. Understanding the distinction makes it easier to assess their benefits, their risks to privacy, and the available choices without falling for false promises of anonymity.

Key idea: A cookie does not monitor anyone on its own. It stores information that, combined with servers, scripts, and other data, may be used to recognize a browser and connect activity.

From the website to the browser: what happens in practice

Web pages need to retain some state from one request to the next. Without that, a site could forget that a user signed in, which language they chose, or what they added to a cart. HTTP cookies provide one way to maintain that continuity: the server sends information to the browser, which stores it and later returns it when particular scope rules apply. MDN explains this exchange and its different uses.

Tracking begins when the information functions as a relatively stable identifier. Suppose an online store includes an outside measurement or advertising service. That third party may assign an identifier to the browser. If the same service is embedded on other sites, it can recognize the browser again and associate multiple visits with that identifier. This creates a sequence of activity that may support measurement, personalization, or advertising.

This does not mean that the cookie contains a person’s name or a complete record of everything they have done. In principle, it makes it possible to recognize a browser within a certain scope. Connecting that identifier to a person’s civil identity requires additional information, such as an account or a purchase.

Three classifications that should not be confused

Cookies are often sorted into categories that answer different questions. Mixing them up leads to conclusions such as that every persistent cookie is for advertising or that every third-party cookie is malicious.

• First-party or third-party cookies: These terms indicate the relationship between the site being visited and the origin that sets or receives the cookie. A first-party cookie is set in the context of the site being visited; a third-party cookie comes from another domain embedded in the page. The latter design can make recognition across sites easier, but its purpose is not determined by its origin alone.
• Session or persistent cookies: These describe how long cookies remain. Session cookies usually disappear when the session ends; persistent cookies may remain until an expiry date or until the user deletes them. Duration alone does not reveal their purpose.
• Functional, analytics, or advertising cookies: These express a purpose. A cookie may support sign-in, remember preferences, measure how a page is used, or help select ads. Those functions can overlap and should be assessed with information about the specific context.

The categories intersect. A first-party cookie may be used for analytics; a persistent one may remember a preference; and a third-party service may perform a necessary function, such as processing a transaction. The relevant question is not only “what kind of cookie is it?” but also who uses it, how long it lasts, what it is for, and what data it is combined with.

Key distinction: “Third-party,” “persistent,” and “advertising” are not three names for the same thing. They refer, respectively, to origin, duration, and purpose.

What is observed is not the same as what is inferred

A tracking system may record that an identifier visited certain pages, clicked a link, or returned several times. From that behavior, it may infer interests, habits, or a likely intention to buy. The Spanish Data Protection Agency notes that cookies can provide information about visits, preferences, and browsing habits.

But an inference is not a confirmed biographical fact. Visiting a page about an illness does not show that the visitor has it; looking at a product does not prove they will buy it. There may also be shared devices, passing interests, or mistaken classifications. Profiles are estimates built from partial signals, even when those estimates can affect the ads or content a person sees.

This difference matters because the privacy debate is not limited to whether a company knows someone’s name. A profile can guide decisions about an identifier without disclosing a civil identity. At the same time, calling every form of technical recognition “personal identification” would overstate what each cookie reveals by itself.

Privacy, choice, and responsibility

Advertising and measurement can fund services, help organizations understand audiences, and make some offers more relevant. Recognizing that economic value does not require accepting opaque practices. A meaningful choice requires a clear explanation of the purposes involved, the third parties involved, and the reasonable consequences of accepting or rejecting them.

In the Spanish and European context, the Spanish Data Protection Agency maintains that consent must be freely given and informed, and that accepting and rejecting should be presented with equivalent prominence. That standard belongs to a specific legal context, not a universal legal rule. As a broader editorial principle, however, it points to a question of autonomy: users need enough information to decide, and businesses are responsible for not hiding material choices behind confusing text or manipulative interfaces.

Key idea: The commercial usefulness of a practice does not remove the duty to explain it clearly; nor does the fact that it involves tracking, by itself, settle what each user should do.

What you can control—and what remains beyond it

Browsers allow users to delete cookies, limit how long they last, block cookies from certain sites, or restrict third-party cookies. Many sites also provide controls that separate necessary, preference, analytics, and advertising cookies. Adjusting these controls can reduce cookie-based recognition, but it is worth anticipating the costs: being signed out, empty carts, or lost preferences.

The right measure depends on the goal. Someone who wants to reduce ad personalization may reject nonessential categories; someone who shares a device may prefer to delete data; and someone who needs to keep sessions active may have reasons to retain functional cookies. No setting maximizes privacy, convenience, and compatibility at the same time.

In addition, blocking cookies is not the same as eliminating all tracking. The U.S. Federal Trade Commission lists other technologies, including pixels, advertising identifiers, and fingerprinting. A pixel can report that a page loaded; fingerprinting combines characteristics of a browser or device in an attempt to distinguish it. Link parameters and redirects may also be involved. Deleting a cookie does not erase those signals.

Practical caution: Rejecting or deleting cookies reduces some forms of tracking, but it does not make a browser anonymous or neutralize every other technique.

A better decision starts with a better question

Asking whether “cookies are good or bad” puts very different functions and risks under one label. It is more useful to ask what information is stored, who may receive it, what it is used for, how long it lasts, and what happens if it is rejected. Those questions distinguish a cookie that keeps a session active from one that helps connect visits across several sites.

Tracking cookies are one part of a broader infrastructure, not an all-powerful observer or an irrelevant detail. Understanding their scope makes it possible to use controls with realistic expectations and to demand clear explanations from those who collect and combine data. Digital autonomy does not mean accepting everything or reflexively blocking everything; it means being able to choose with knowledge of the benefits, costs, and limits of each option.