Cookies, Sessions, and Tracking

You have almost certainly clicked a banner that says "This site uses cookies." It sounds technical and slightly ominous, but the thing behind it is small and simple. A cookie is a little note a website asks your browser to hold on to, and then show back the next time you visit.

Here is the catch that makes cookies both essential and controversial: the exact same mechanism that keeps Olivia logged in to her email also lets companies follow her from site to site. One tool, two faces. This page separates the necessary face from the worrying one.

What Is a Cookie?

The web has a quirk: a website forgets you the instant a page finishes loading. Each click is treated as a fresh request from a stranger. So if a site wants to remember anything about you between one click and the next, it needs to hand you something to carry.

That something is a cookie — a small piece of data the site stores in your browser and receives back on each visit. The site says "hold this," your browser tucks it away, and every time you go back, the browser shows it again. That is the whole mechanism.

A cookie is just stored text. It cannot think, run, or act on its own. It is closer to a sticky note than to a program — and that distinction matters, as we'll see in a moment.

The Necessary Use: Sessions

Back in Chapter 2 we met the idea of a login token — the wristband a site gives you after you prove who you are, so you don't have to re-enter your password on every page. That token has to live somewhere in your browser, and the usual place it lives is a cookie.

A cookie used this way is called a session cookie: it holds the proof that you are currently logged in. When Olivia signs in to her email and then clicks through twenty messages without typing her password again, a session cookie is doing that work quietly in the background.

Think of it like a coat-check ticket. You hand over your coat, you get a small ticket, and you show that ticket to reclaim your own coat later. The session cookie is that ticket: it lets the site recognize you as the person who already logged in. Without it, you'd be sent back to the login screen on every single click.

The Tracking Use

Now the other face. Because a cookie is just a note that gets shown back, it can also be used to remember not who you are but where you've been.

The key idea is the third-party cookie — a cookie set not by the site you're looking at, but by another company whose content is embedded in that site, like an ad or a "share" button. The same company's content sits on thousands of sites. So its cookie gets shown back on each one, and it can stitch together a picture of the pages you visit across the whole web.

That picture is a profile, usually built to target advertising. Going back to the coat-check ticket: it's handy for reclaiming your own coat, but imagine the same ticket system quietly noted every shop, café, and building you entered all day. That is the tracking use — the same ticket, turned into a log of your movements.

Security or Privacy?

Cookies sit on the line between two worries that are related but not the same, so it's worth naming which is which.

A stolen session cookie is a security problem. If an attacker copies the cookie that proves Olivia is logged in, they can show that same proof and the site will treat them as Olivia — no password needed. Someone is acting as you.

A tracking cookie is mainly a privacy problem. Nobody is logging in as you; instead, your behavior is being watched and recorded across sites. The harm is being profiled, not being impersonated. Both are real, and keeping them apart will make later topics about identity and privacy much clearer.