I have been researching types of cookies and have a question regarding client-side cookies. I understand that cookies created via JavaScript are tied to the domain they are created on, and are referred to as client-side 1st party cookies. This mechanism also applies to cookies set by external domains like Google Analytics, categorizing them as 1st party client-side cookies. What eludes me is the concept of third-party client-side cookies. From the term “third-party”, I assume that the domain specified in the cookie is different from the domain being browsed. When creating such a cookie in JavaScript using document.cookie, I believe one would need to explicitly set a different domain using the domain attribute. However, I think the browser would reject this, and even if the cookie is created, it wouldn’t be stored in the browser. My question is, while third-party client-side cookies exist as a concept, do they actually exist in practice, or is my understanding correct that they do not?
Firstly, all cookies are client-side. That's basically the definition of a cookie, and the reason for their existence.
Third-party cookies work like this:
www.example.com
) loads an ad script from the ad server origin (ads.example.com
).ads.example.com
) for logging and building a history.ads.example.com
) may send back a cookie for future requests to ads.example.com
, and that cookie might contain some sort of client ID.Now, so far this only affects www.example.com
. But what if other-site.example.com
wants to also have ads?
other-site.example.com
loads the same ad script from ads.example.com
.ads.example.com
.ads.example.com
) now knows data from two sites, and builds this profile on the user.Basically, through cooperation, a user can be tracked from site to site to site.
Now, using cookies in this way is rapidly changing. Due to a bunch of hype and hoopla, it's now considered a legal liability for ad networks (and others) to track people in this way. Browsers are disabling third-party cookie capability by default.
Note that preventing third-party cookies doesn't actually prevent bad actors from sharing data and tracking you from site to site. There are at least a dozen alternative methods.