What are cookies and how do they work? A complete guide
Cookies are small text files that a website stores in the visitor's browser. On every subsequent visit the browser sends them back to the server - that is how a site "remembers" that you are still the same user. Without cookies there would be no shopping carts, no login sessions and no remembered language settings.
How does a cookie technically work?
The server attaches a Set-Cookie header to its HTTP response with a name, a value and a lifetime. The browser stores the entry and adds it to every subsequent request sent to the same domain. A cookie can also be set by JavaScript running on the page - which is exactly what most analytics and advertising tools do.
Types of cookies
- First-party cookies - set by the domain you are visiting. Usually essential: the login session, the cart, a security token.
- Third-party cookies - set by other domains whose resources the page loads (e.g. ad scripts). Cross-site tracking is built on these.
- Session cookies - disappear when you close the browser.
- Persistent cookies - carry an expiry date and can live for months.
For compliance the split by purpose matters more: necessary, functional, analytics and marketing. These are exactly the categories a visitor consents to in a cookie banner.
What the law says: GDPR and ePrivacy
Storing and reading information on a user's device is regulated by the ePrivacy rules (implemented in each EU member state), and the processing of personal data by the GDPR. The principle is simple: any cookie that is not strictly necessary requires prior, freely given and informed consent. The CJEU's Planet49 judgment settled that pre-ticked checkboxes are not consent, and the EDPB guidelines add that rejecting must be as easy as accepting.
Ignoring these rules is not just a fine risk - it erodes trust. Data protection authorities across the EU routinely sanction websites for banners with a hidden "reject" button and for firing analytics scripts before the user decides.
What does this mean for a site owner?
- Audit your cookies - check what your site actually stores (a cookie scanner helps).
- Block scripts before consent - marketing tools may only start after "Accept" is clicked.
- Show an honest banner - "Accept" and "Reject" side by side on the first layer.
- Keep proof of consent - the GDPR requires you to demonstrate consent (accountability).
A consent management platform (CMP) such as CookieFox does all of this automatically: it scans your site, blocks scripts until consent, renders a compliant banner and keeps a consent register. Create a free account and deploy a compliant banner in minutes.
Want to know exactly what valid consent looks like? Read our GDPR cookie consent guide.