What Are Cookies & How to Manage Them?

What Are Cookies? 

A browser or internet cookie is like a tiny piece of glitter that attaches itself to you when you visit a website. It helps the website remember who you are and what you did there, such as what items you added to your shopping cart or what preferences you set.  

Like real glitter, though, it can get messy and hard to get rid of, almost like it’s multiplying. And while some cookies are harmless and useful, others can track your online behavior and share it with third parties.

Session vs Persistent

A session cookie is temporary — it’s “destroyed” as soon as you leave a webpage or close a browser. These types of cookies allow a website to remember a visitor as they move between pages in a website. For example, adding an item to a cart while you’re on the website. Clicking away from the cart doesn’t completely empty the cart, which wouldn’t be possible without a session cookie.  

A persistent cookie, on the other hand, is a “stored” cookie. It’s stored on your computer even after you’ve closed your browser, keeping track of your preferences and other information. When you log in to a website and check the button to “Remember this computer,” you’re permitting a persistent cookie so you don’t have to type your username every single time you log in.   

Necessary vs Non-essential

Necessary, or essential, cookies might sound self-explanatory, but they’re essentially cookies that are needed for the website to operate its most basic functions. They include logging in, adding items to a cart, billing, etc.  

Non-essential cookies, sometimes called “effective” cookies, are those that are not needed for the website to function. These break down into further categories, such as analytics (used to collect data that measures behaviors en masse) and marketing or targeting (used to enable advertisers to show relevant ads to visitors).  

First-Party Cookies vs Third-Party Cookies

A first-party cookie is exactly what it sounds like “first-party.” The cookie is created by the website you’re currently visiting, saving your preferences for that same website. The best example is saving your shopping cart so that when you come back, you remember what you were attempting to buy.  

Third-party cookies are created by different websites than the one you’re currently visiting. The biggest examples here are ads — a brand wants to advertise its product, so it adds a code from an ad network to its website. That code then plops a cookie onto your browser from the brand’s website. The cookie, although on the brand’s website, is coming from a third-party.  

How Data Privacy Impacts Cookies 

When we talk about data privacy in the context of cookies, we’re typically talking about third-party cookies. First-party cookies usually aren’t an issue because they’re used by the website to improve the user experience.  

Third-party cookies, especially in the context of targeting and, to an extent, analytics, is the biggest topic at hand. It all stems from consent: Is it okay to collect someone’s data and share it with others if you don’t have their okay?  

Most data privacy laws, like the General Data Protection Regulation (GDPR) and the California Privacy Rights Act (CPRA), say “No.” These laws, among many others, require some form of consent, whether that’s opt in or opt out.  

Opt-In vs Opt-Out Consent

Opt-in consent is consent that requires users to take an action that grants businesses permission to collect and use their data. The action could be clicking a button, checking a box, or something else that is a proactive step. In other words, websites cannot collect or use someone’s data without them agreeing to it first.  

Opt-out consent is when a user must clearly say “No” to data collection in order for a business to stop collecting and using data. This means that businesses can assume consent until they receive notice from a consumer otherwise. Businesses, however, are required to clearly inform consumers about data collection, which is why websites that use an opt-out model for consent have cookie notices on their sites. And opting out must be easy to do for consumers.  

Tracking It All With Consent Management

Without some form of consent management, there would be no way to track a users’ opt-in or opt-out response or even if or when they change their response. Consent management is the practice of requesting, recording, and acting upon a user’s preferences when it comes to collecting their data.  

Whether and what types of cookies users consent to must be recorded, and your company must act upon their response. You also need to do it in a way that ensures you’re compliant with that person’s local regulations and stores it for verifiable proof of consent. Plus, with Global Privacy Controls, consent management must also take into consideration browser-based consent so that you’re not tracking someone’s data when they’ve already opted out of data collection via their browser.  

Cookie Banners

Cookie Banners are pop-ups that show the first time you visit a website, letting you know about the website’s use of cookies, asking for your consent, or both. These banners are a core concept in consent management, and they typically take the form of a notice that can either go away on its own or goes away once you take an action, such as either accepting or rejecting cookies.  

Cookie banners will have different language and terms depending on the applicable law (which is based on the jurisdiction of the user, typically depending on their geolocation). Some may ask a user to select which cookies they consent to, and some may include a link to a cookie notice. 

Consent Optimization

Before diving into cookie notices, it’s important to take a moment to address consent optimization. Consent optimization is a tricky subject — it would be easy to attempt to design your cookie banners in such a way that a user wants to click yes. This would include making your “accept” button stand out more than your “reject” button, pre-ticking boxes, and requiring multiple steps so it’s harder for users to deny consent.  

But all these approaches are known as “Dark Patterns,” which are design choices that are meant to manipulate users to provide consent, which is often unlawful and could cost you the trust of your users. If you must optimize anything, focus on making your language clear, transparent, and in plain language.   

Cookie Notices

Cookie notices inform users about the usage and storage of cookies on their browsers and computers. Notices will usually explain that the company or website uses cookies to improve its site experience, implement personalization, remember user preferences, and more.  

Cookie notices might also include options for visitors to accept or deny all cookies, reject non-essential cookies, or customize their preferences based on a list of cookie categories provided. It may also link out to the company’s cookie policy or privacy policy, which will further break down the cookie types, functions, and data retention policy.