javascriptcookiessession-cookiessetcookie

Understanding the concept and existence of third-party client-side cookies


I have been researching types of cookies and have a question regarding client-side cookies. I understand that cookies created via JavaScript are tied to the domain they are created on, and are referred to as client-side 1st party cookies. This mechanism also applies to cookies set by external domains like Google Analytics, categorizing them as 1st party client-side cookies. What eludes me is the concept of third-party client-side cookies. From the term “third-party”, I assume that the domain specified in the cookie is different from the domain being browsed. When creating such a cookie in JavaScript using document.cookie, I believe one would need to explicitly set a different domain using the domain attribute. However, I think the browser would reject this, and even if the cookie is created, it wouldn’t be stored in the browser. My question is, while third-party client-side cookies exist as a concept, do they actually exist in practice, or is my understanding correct that they do not?


Solution

  • Firstly, all cookies are client-side. That's basically the definition of a cookie, and the reason for their existence.

    Third-party cookies work like this:

    1. Origin site (www.example.com) loads an ad script from the ad server origin (ads.example.com).
    2. Ad script may be initialized with some data, like an advertiser ID, information from the page, etc. Then, it can send this data off to the ad server (ads.example.com) for logging and building a history.
    3. Ad server (ads.example.com) may send back a cookie for future requests to ads.example.com, and that cookie might contain some sort of client ID.

    Now, so far this only affects www.example.com. But what if other-site.example.com wants to also have ads?

    1. other-site.example.com loads the same ad script from ads.example.com.
    2. The ad script can associate this new site's identity with the previous site because requests it makes can have a cookie for ads.example.com.
    3. Ad server (ads.example.com) now knows data from two sites, and builds this profile on the user.

    Basically, through cooperation, a user can be tracked from site to site to site.

    Now, using cookies in this way is rapidly changing. Due to a bunch of hype and hoopla, it's now considered a legal liability for ad networks (and others) to track people in this way. Browsers are disabling third-party cookie capability by default.

    Note that preventing third-party cookies doesn't actually prevent bad actors from sharing data and tracking you from site to site. There are at least a dozen alternative methods.