Browser cookies are one of the oldest and most misunderstood pieces of web technology in everyday use. Every time you log into a website, add something to a shopping cart, or get served an ad for something you searched last Tuesday, a cookie is almost certainly involved. Yet most people click "Accept all" without any real sense of what they're agreeing to.
What a cookie actually is
A cookie is a small text file that a website sends to your browser, which your browser then stores on your device. That's it. There's no code inside it. It can't run a program or install software. It's just a string of text, typically a handful of characters that identify you, or your session, to the website that created it.
When you revisit that site, your browser automatically sends the cookie back. The server reads it and says, in effect: "I know this device." That's how a shopping site remembers your cart between visits, and how your email provider keeps you logged in without asking for your password every five minutes.
The name comes from an older computing concept called a "magic cookie," a token passed between programs to carry context. Web developer Lou Montulli borrowed the idea in 1994 while working at Netscape, and cookies have been a core part of the web ever since.
The different types of cookies
Not all cookies behave the same way. There are four main varieties worth knowing about.
- Session cookies exist only while your browser tab is open. Close the window and they're gone. These are what keep you logged in as you move between pages on the same site.
- Persistent cookies have an expiry date set by the website, sometimes hours, sometimes years. They survive after you close the browser, which is how "remember me" works.
- First-party cookies are set by the website you're actually visiting. They're generally considered fine because they serve a function you've requested.
- Third-party cookies are set by a different domain, typically an advertising or analytics company whose code runs invisibly on the page. These are the ones that follow you around the internet.
Third-party cookies are the contentious ones. An ad network like Google's can place a third-party cookie on one site and read it back on thousands of others, building a detailed picture of your browsing habits without you ever visiting their platform directly.
What information a cookie can actually contain
A cookie holds whatever the website decides to put in it, within a size limit of 4 kilobytes. In practice, most cookies just store a random unique identifier, a session ID, that acts like a locker number. The actual data (your name, your cart, your preferences) lives on the website's server. The cookie is just the key.
Some cookies store small pieces of data directly: your preferred language, whether you've dismissed a banner, or a timestamp of your last visit. They don't typically store passwords in plaintext, and a legitimate site never puts your credit card number in one.
What makes third-party tracking cookies powerful isn't what's in any single cookie. It's the profile built on a server somewhere by correlating thousands of those session IDs over time. Your individual cookie is a key; the door it opens is a dossier.
How browsers handle cookies in 2026
The cookie landscape has shifted significantly over the past few years. Safari began blocking third-party cookies by default back in 2020, and Firefox followed. Google spent years promising to phase them out of Chrome before pulling back on a full deprecation plan in 2024, opting instead for a set of privacy-preserving advertising tools called the Privacy Sandbox. Third-party cookies still run in Chrome, but the regulatory and competitive pressure to move away from them continues to build.
Australia's Privacy Act reforms, which have been in progress for several years, place increasing obligations on organisations that collect personal data through tracking technologies. Cookies used to build advertising profiles fall squarely into that territory. Understanding what cookies are is becoming less of a technical curiosity and more of a practical legal matter for any Australian running a website.
If you want to see what's sitting in your own browser right now, open developer tools (F12 in most browsers), navigate to the Application or Storage tab, and select Cookies. You'll see every cookie set for the current site, its value, its expiry date, and whether it's marked as "HttpOnly" or "Secure." HttpOnly means JavaScript on the page can't read it, which reduces a particular class of attack. Secure means it's only sent over an encrypted HTTPS connection.
How cookies relate to broader online security
Cookies themselves aren't a security threat, but they can become one if handled carelessly. Session hijacking is the attack where someone intercepts or steals a valid session cookie and uses it to impersonate you on a site. This is why encrypting your connection matters so much. If a cookie travels over plain HTTP, anyone on the same network can read it.
Cross-site scripting (XSS) attacks work by injecting malicious JavaScript into a page, which then reads cookies that weren't protected with the HttpOnly flag. A well-configured site defends against this at the server level.
These risks connect directly to the broader topic of cybersecurity, which covers how individuals and organisations defend against the full range of digital threats. Cookies are a small but non-trivial part of that picture. A stolen session cookie bypasses passwords entirely, including two-factor authentication, once the session is already authenticated. Understanding two-factor authentication and how it works is one layer of protection, but it doesn't make you immune if your session gets hijacked after login.
What you can actually do about cookies
You have more control than most people realise. Every major browser lets you block third-party cookies, clear all cookies on a schedule, or whitelist specific sites while blocking trackers everywhere else.
Clearing cookies regularly logs you out of everything and wipes any site preferences you haven't formally saved, which is mildly inconvenient. A more surgical approach is to block third-party cookies in your browser settings and install an extension like uBlock Origin, which filters tracking scripts before they even run. Browser developer tools let you inspect and delete individual cookies if you want to be more selective.
The "cookie banners" you see on nearly every website are largely a product of European privacy regulation (the GDPR), which requires sites to get consent before placing non-essential cookies. Australian law is less prescriptive on this point right now, but the trajectory is toward stricter requirements. The practical effect in the short term is a lot of consent banners, not all of them honest: some "Reject all" buttons are buried five menus deep by design.
Cookies aren't going away. But knowing what they are and where your browser stores them puts you in a far stronger position to decide what you're comfortable accepting.