What Is a Cookie?

A cookie is a small piece of data a website stores in your browser and reads back on later requests, so a site can remember you between page loads. Cookies come in two lifespans, session and persistent, and two origins, first-party and third-party. They also carry safety flags such as Secure, HttpOnly, and SameSite. Most cookies keep a site working; a smaller set follows you across sites, which is what privacy rules target.

What does a cookie actually do?

A cookie gives a website a memory.

The web's underlying protocol, HTTP, is stateless: each page request arrives knowing nothing about the last. Without a cookie, a site would forget you the moment you clicked to the next page, and you would log in again on every screen.

MDN's cookie documentation calls a cookie "a small piece of data a server sends to a user's web browser," which the browser then sends back with later requests. That round trip is the whole mechanism.

Cookies do three common jobs. They keep you signed in and hold your cart during a session. They remember settings like language or a dismissed pop-up. And, as third-party cookies, they track behavior across sites for analytics or ads.

Session cookies vs persistent cookies

Cookies split first by how long they live. A session cookie has no set expiry and vanishes when the browsing session ends. A persistent cookie carries an expiry and survives until that date, which is how a site keeps you signed in across visits.

Cookie lifespan	How long it lasts
Session	No Max-Age or Expires set; deleted when the session ends
Persistent	Deleted at the Expires date, or after the Max-Age period

The distinction is practical. A "remember me" checkbox sets a persistent cookie instead of a session one. It is why closing the browser sometimes logs you out, and sometimes does not.

First-party vs third-party cookies

Cookies also split by who sets them.

A first-party cookie is set by the site in your address bar, and it does the ordinary work of logins, carts, and preferences. A third-party cookie is set by content embedded from another domain, such as an ad or analytics script inside the page.

That second kind is the privacy flashpoint. The same third-party script sits on many sites, so its cookie can recognize you as you move between them. That is how cross-site tracking and retargeting work.

The consent rules you have seen exist mainly for these trackers, not for a login cookie.

One widely repeated claim is worth correcting. Google decided in 2025 to keep third-party cookies in Chrome rather than remove them. It also chose, in its Privacy Sandbox update of April 2025, not to add a new choice prompt. Users still manage them in Chrome's existing settings, so the often-forecast death of the third-party cookie in Chrome has not happened.

A pattern we repeatedly see on older Malaysian business sites is a pile of unused third-party cookies. Analytics and ad tools added them over the years, and nobody removed them. Each one is a script that still loads, still tracks, and still needs disclosing.

How are cookies kept secure?

A cookie is protected by attributes the server sets on it. Three carry most of the weight, and a careful site uses all three on anything sensitive.

• Secure sends the cookie only over an encrypted HTTPS connection.
• HttpOnly hides the cookie from JavaScript, which blunts a common theft technique.
• SameSite limits whether the cookie rides along on requests from other sites.

A cookie is data, not code, so it cannot itself carry a virus. The real risk is a session cookie being stolen and reused, which these flags and two-factor login exist to stop.

Frequently asked questions

Are cookies dangerous?

Not in themselves. A cookie is a small text value, not a program, so it cannot run or infect anything. The genuine risk is a session cookie being stolen and reused to impersonate you, which the Secure and HttpOnly flags exist to prevent. Third-party tracking cookies raise a privacy question rather than a security one.

What happens if I clear my cookies?

Clearing cookies signs you out of sites and resets saved preferences. The memory those cookies held is simply gone, but your accounts and data are untouched. You log in again, and any "remember this device" choice starts over. It is a safe, routine step, and a good first fix when a site misbehaves after an update.

Do I need a cookie banner for my Malaysian website?

No specific Malaysian law requires a cookie banner. Malaysia's PDPA requires a privacy notice and consent for data that identifies a person, which is a broader duty than a pop-up. The full picture sits in the PDPA duties for your site, including when a banner still makes sense.

Are third-party cookies going away?

In Chrome, not for now. Google decided in 2025 to keep them and not to add a new prompt, so the long-forecast removal has not landed. The wider direction of the web still favors less cross-site tracking. A site that leans on third-party cookies for measurement is wise to plan for first-party analytics over time.

What is the difference between a cookie and the browser cache?

A cookie stores small identifying data that is sent back to the server to remember you. The browser cache stores copies of files, like images and scripts, to load pages faster. Cookies are about identity; the cache is about speed. Clearing one does not clear the other.

Getting cookies right on your site

Storming Solutions builds and maintains Malaysian business websites from Kuala Lumpur. Cookie hygiene is part of that groundwork: secure flags on session cookies, an honest account of what your trackers collect, and no leftover scripts quietly gathering data.

We think a decorative cookie notice that blocks nothing is worse than none, because it advertises a standard the site is not meeting.

Not sure what your site currently sets, or whether it needs a notice or a banner? Start with our web development service, or message us on WhatsApp. Pair it with the cookie banner guide for the compliance side.