Cybersecurity glossary
What is a Third-Party Cookie?
Learn what a third-party cookie is, how cross-site embeds use cookies for tracking and SSO, why browsers block or partition them, and what product teams should do instead.
Definition
A third-party cookie is a cookie used in a cross-site context—typically set or sent by a different site than the one in the browser’s address bar—often through embedded content such as iframes, pixels, or third-party scripts.
Why third-party cookies matter
For years, embedded scripts and iframes could set cookies that followed users across unrelated sites. That powered advertising attribution and also quiet cross-site identity linking. Third-party cookies became a privacy flashpoint, and major browsers now block, partition, or phase them out.
Engineering teams feel the change in broken widgets, SSO popups, and measurement pipelines. Security teams care because cross-site cookie behavior also intersects with CSRF, clickjacking-adjacent embeds, and confused-deputy session issues.
How third-party cookies arise
A page on shop.example can embed content from tracker.example. Cookies for tracker.example in that embed are third-party relative to the top-level visit.
User visits a first-party site
The address bar shows the site the user chose to open.
Page embeds cross-site content
An iframe, pixel, or script loads from another site.
Embed sets or reads its cookie
The embedded site attempts to use cookies in a third-party context.
Browser applies privacy policy
The cookie may be allowed, partitioned, or blocked depending on browser rules and attributes.
Cross-site recognition succeeds or fails
Tracking or embed state continues only if the browser permits that storage access.
Common product uses
Advertising and attribution
Recognize users across publisher sites for ads and conversion measurement.
Embedded SSO and widgets
Keep a vendor session inside an iframe on many customer domains.
Fraud and bot signals
Share limited device or reputation state across merchant checkouts.
Social and chat embeds
Remember widget login state when the host site differs from the vendor.
Browser restrictions overview
| Control | Effect | Product impact |
|---|---|---|
| Third-party cookie blocking | Cross-site cookies may not be stored or sent | Legacy embeds and trackers break without redesign |
| Partitioned storage | Embed cookies keyed by top-level site | State works per host site, not globally across the web |
| SameSite defaults | Cross-site sending limited unless explicitly configured | Requires SameSite=None; Secure for intentional cross-site cookies |
| Storage Access API | User-gated access to unpartitioned cookies in embeds | Possible for known user flows with prompts or heuristics |
Migration checklist
- Inventory every cross-site iframe, pixel, and credentialed third-party request.
- Test critical journeys with third-party cookies disabled in each major browser.
- Move authentication to top-level redirects or first-party session patterns where possible.
- Avoid building new features that require global third-party cookie identity.
- For embeds that truly need cookies, evaluate partitioned cookies or Storage Access carefully.
- Separate security session design from advertising identity requirements.
- Update privacy notices to match actual cookie and measurement behavior.
- Monitor vendor roadmaps; many SDKs still assume legacy third-party cookie access.
Security angle beyond privacy
Even when allowed, third-party cookies expand trust boundaries: your users’ browsers send vendor state while they browse your origin. Supply-chain risk, malicious embeds, and over-broad SameSite=None cookies can create unexpected authenticated cross-site requests. Prefer least privilege for any remaining cross-site credentialed flows.
The practical takeaway
A third-party cookie is used when a site other than the one in the address bar sets or reads cookies through embeds or cross-site requests. Browsers are actively restricting that behavior to reduce cross-site tracking.
Design for a web where global third-party cookies are unreliable: keep sessions first-party, rebuild embeds accordingly, and treat any remaining cross-site cookie use as an explicit, reviewed exception.
Related security terms
First-Party Cookie
Cookies belonging to the site the user is actively visiting.
SameSite Cookie
Attribute that governs cross-site cookie inclusion behavior.
Cookie
Baseline HTTP cookie model for all party contexts.
Cross-Origin Resource Sharing (CORS)
Related cross-origin request controls that often interact with credentialed calls.
Frequently asked questions
What is a third-party cookie in simple terms?
It is a cookie from a site other than the one shown in your address bar—commonly set by an ad, analytics, or social widget embedded in the page.
Why are browsers blocking third-party cookies?
Because they enabled cross-site tracking: the same embedder could recognize a user as they browsed many unrelated websites.
Do blocked third-party cookies break logins?
They can break flows that depended on cross-site cookie access, such as some SSO embeds, payment widgets, or legacy analytics. Modern designs use first-party sessions, redirects, or Storage Access APIs where appropriate.
Is SameSite=None enough to keep third-party cookies working?
SameSite=None; Secure is often required for cross-site sending, but browsers may still block or partition third-party cookies under privacy policies regardless of SameSite.
What is a partitioned third-party cookie?
Some browsers store embedded cookies in a jar keyed by the top-level site, so an embed on site A cannot freely reuse the same identifier on site B.
Are all third-party cookies used for advertising?
No. They also appear in federated login, fraud detection, chat widgets, and CDNs. Intent varies; the cross-site capability is what browsers constrain.
What should product teams do as third-party cookies disappear?
Inventory cross-site cookie dependencies, migrate auth to redirect-based or first-party patterns, prefer privacy-preserving measurement APIs, and test in browsers with third-party cookies disabled.
References
Explore authoritative guidance and frameworks related to third-party cookie.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.