What is Third-party cookie?
A third-party cookie is set by a domain different from the site the visitor is on — an advertising or analytics network embedded in the page. Because the same network appears on many sites, it could read its own cookie everywhere and build a cross-site profile. Safari and Firefox block them by default, and Chrome has been curtailing them for years.
First-party versus third-party
Both are cookies. The difference is who set them:
| Set by | Readable by | Used for | |
|---|---|---|---|
| First-party | The site you are visiting | That site only | Login sessions, preferences, carts |
| Third-party | An embedded domain | That domain, on every site it appears | Cross-site profiling, ad targeting |
The cross-site reach is the whole point of the third-party version, and the reason it became the industry’s default identity mechanism.
The long deprecation
Safari’s Intelligent Tracking Prevention began blocking third-party cookies by default in 2017; Firefox followed in 2019. Chrome announced an end date, moved it repeatedly, and in 2025 shifted to leaving the choice with users rather than removing them outright.
The practical position for a site owner is unchanged either way: a substantial and growing share of visitors already block them, so any measurement that depends on them has been silently incomplete for years.
What replaced it, and why that matters
The advertising industry’s response was not to stop identifying people but to find other ways: hashed email identity graphs, server-side collection through first-party domains, and fingerprinting. Each reconstructs cross-site identity without a third-party cookie.
Analytics does not need any of that. Counting your own audience on your own site never required cross-site identity in the first place — the third-party cookie was there to serve advertising, and measurement inherited it by accident. Tools built without it, like cookieless analytics, lose nothing that a site owner actually reads.