What Is a Web Cookie?

A web cookie is a small piece of data that a website instructs the browser to store and send back with every subsequent request to the same site. Cookies exist because HTTP itself is stateless — without them, a server could not tell whether two requests came from the same visitor, so there would be no logged-in sessions, no shopping carts, no remembered preferences. The same memory that makes the web usable, however, also makes visitors traceable, which is why the cookie sits at the center of two decades of privacy regulation and engineering debate.

The Taxonomy That Matters

The distinctions that decide a cookie's privacy impact are scope and origin. Session cookies vanish when the browser closes; persistent cookies survive with an expiry date, which is what makes long-term recognition possible. First-party cookies belong to the site being visited and mostly power legitimate state — logins, carts, settings. Third-party cookies are set by other domains embedded in the page, and they built the cross-site tracking economy: an advertising domain present on thousands of sites can recognize the same browser everywhere it goes. That model is in decline — browsers ship increasingly aggressive restrictions, and third-party cookies face deprecation — with the practical consequence that tracking techniques have shifted toward browser fingerprinting and other identifiers that need no stored state at all.

Cookies and the Law

European rules attack the cookie from two directions. The ePrivacy rules require consent before storing or reading anything on a user's device that is not strictly necessary for the requested service — the legal root of the consent banner — while the GDPR governs the personal data that cookie-based identifiers collect once set. The "strictly necessary" carve-out is narrower than most integrations assume: a session cookie for a cart qualifies; an analytics or advertising cookie does not. The compliance cost lands on the operator, who must inventory every cookie their site and its embedded third parties set, justify each, and gate the rest behind consent — an audit in which unnoticed third-party scripts are routinely the unpleasant surprise.

Building With Fewer Cookies

Each cookie an embedded component sets adds consent burden, banner complexity, and audit surface, so cookie-free design in third-party tooling is a direct compliance relief. Verification illustrates the choice concretely: some ecosystems have historically tied bot detection to cookie-based recognition of returning visitors, while CaptchaFox demonstrates the alternative — verifying sessions through transiently processed signals with no cookies or persistent identifiers, keeping the widget entirely out of the consent equation. The general test for any component follows: if it stores state in the visitor's browser, ask what that state is for and whether the function survives without it. Surprisingly often, it does.