Third-party cookie

The distinction is contextual, not a property of the cookie. The same cookie is first-party when the visitor is on that site and third-party when it is set through an embed elsewhere.

A visitor on a news site loading an advertisement from another domain: the advertiser's cookie is third-party.

That same advertiser's own website sets the same cookie as a first-party cookie.

What made tracking possible was embedding: one identifier, recognised across every site carrying the same embed.

A cookie set in the third-party context is also stored separately from the one the same domain sets as first party in browsers that partition, so the two can coexist with different values.

Safari's Intelligent Tracking Prevention has blocked third-party cookies by default since 2020.

Firefox's Total Cookie Protection partitions them: a third party gets a separate cookie jar per site, so the same embed on two sites sees two unrelated identifiers.

Chrome has restricted them for a share of users and shipped the CHIPS partitioning mechanism, while the full deprecation timeline has changed repeatedly.

Partitioning rather than blocking is the direction of travel: the cookie still works within one site, and it no longer links behaviour across sites.

Embedded payment forms, single sign-on frames, chat widgets and video players that need state within one site: `Partitioned` cookies, the CHIPS mechanism, provide exactly that.

Federated login: the Federated Credential Management interface replaces the iframe-and-cookie pattern with a browser-mediated flow.

Cross-site analytics attribution: the Attribution Reporting proposals provide aggregated measurement without an identifier.

Each replacement deliberately does less than a third-party cookie did, because the capability being removed is exactly the one that enabled tracking.

The browser's Application panel lists cookies by the domain that set them; anything not on the page's own domain is third-party in that context.

The network panel filtered by domain shows which embedded origins are contacted, which is the same list from the other direction.

Loading the page in a browser that blocks them by default shows what breaks, which is the practical test.

Check which of them are set before any consent is given, since that is a compliance question independent of whether browsers still allow them.

Compare across browsers. A feature that works in one and silently fails in another is almost always a third-party cookie meeting a different default, and testing in a single browser will never show it.