[5.1.6] Cookies
Cookies on the Web: What They Are and How They Are Used
A practical guide for IGCSE learners
A cookie is a small piece of text that a website asks a browser to store. When the user visits that site again, the browser returns the same text back to the web server with subsequent requests to the same domain. Cookies allow websites to remember state across separate page loads and even across separate visits. For example, a cookie can keep a user signed in, remember shopping basket contents, or store language preferences. Cookies are not programs and cannot run like software. They are simple key–value data items with optional settings that control how long they last and when they are sent.
At IGCSE level, you should be able to explain the difference between session cookies and persistent cookies, describe common uses of cookies, and recognise how browsers and websites control cookie behaviour. You should also be aware of privacy considerations and why consent messages appear on many sites.
Where Cookies Fit in the Web Journey
From request to response to storage
When a browser requests a page, the web server can include instructions in the response headers to set one or more cookies. The browser saves those cookies according to their properties. On later requests to the same site, the browser automatically includes the relevant cookies in the request headers so that the server can identify the session or apply preferences. This process is automatic and happens for many everyday sites. The user can view and manage cookies using browser settings.
On the first visit, the browser has nothing stored for the site. The server may send a cookie that identifies a temporary session so that the basket or form progress can be tracked while the user moves through pages.
On a later visit, the browser includes existing cookies in the request. The server reads them to restore preferences such as language or to recognise a signed-in account without asking for details again.
If cookies have expired or the user has cleared them, the server will treat the visit like a first visit. Features that depend on cookies may require the user to sign in again or reselect preferences.
Types of Cookies: Session and Persistent
How lifetime and scope change behaviour
Cookies differ mainly by lifetime. A session cookie lasts only while the browser session is open. Once the user closes the browser, the session cookie is removed. A persistent cookie has an expiry date; the browser will store it on the device until that date or until the user deletes it. Both kinds can store similar data, such as an anonymous identifier, but they suit different purposes.
An online shop uses a session cookie to link the current basket to the user while browsing. Closing the browser clears the cookie, so the basket may reset on the next visit.
A news site stores a persistent cookie that remembers the chosen text size and theme. The preference remains for weeks or months, so the user enjoys a consistent experience.
A website sets a cookie that expires after a few minutes to protect sensitive actions. If the user waits too long, the site asks for confirmation again, improving security.
Common Uses of Cookies
Why websites rely on them
- Session management: keeping a user signed in, tracking a basket, remembering multi-step form progress.
- Personalisation: language choice, theme, layout preferences, content recommendations.
- Analytics: understanding how many unique visitors access a site and which pages are popular, usually with anonymised identifiers.
- Security: detecting unusual sign-in locations, helping to prevent the reuse of old authentication tokens.
- Consent storage: recording that the user has accepted or rejected categories of optional cookies so the site does not ask repeatedly.
Scope, Path and Same-Site Behaviour
Which requests include a cookie
Cookies are linked to a domain and an optional path. The browser sends a cookie only when a request matches those rules. Modern browsers also apply SameSite policies that control whether a cookie is sent with requests that originate from a different site. This helps reduce cross-site request forgery risks and limits tracking across multiple sites.
With strict behaviour, the cookie is sent only when the user is already on the site. Links from other sites do not include the cookie, improving privacy and security.
With lax behaviour, the cookie can be sent for top-level navigation, such as when the user follows a link to the site, but not for background requests from other pages.
When a page on Site A loads content from Site B, the browser may withhold certain cookies to protect the user. This prevents unwanted tracking and reduces some attack risks.
First-Party and Third-Party Contexts
Who sets the cookie and who receives it
A first-party cookie is set by the site the user is visiting. A third-party cookie is set by content from another domain that the page loads, such as an embedded video or advertisement. Browser makers increasingly restrict third-party cookies for privacy reasons. Many sites now implement alternative methods for essential features without cross-site tracking.
The site sets a cookie named theme that stores light or dark. Only that site reads it, improving the experience without cross-site tracking.
An embedded third-party script attempts to set cookies. The browser may restrict or block these unless the user has allowed them and the site follows modern privacy rules.
After the user accepts optional cookies, the site stores a consent cookie. On future visits the banner is not shown again and optional analytics may be enabled.
Privacy, Transparency and User Control
Why you often see consent messages
Cookies can influence privacy because they identify a browser to a website and can be used to recognise repeat visits. Regulations in many regions require websites to inform users about cookies and to gain consent for optional categories, such as marketing cookies. Users can control cookies by clearing them, blocking third-party cookies, or choosing private browsing modes. However, blocking all cookies may reduce functionality on sites that rely on them for essential features such as secure sign-in.
Key Terms and Definitions
| Term | Definition |
|---|---|
| Cookie | Small text data stored by the browser and returned to the server for matching requests. |
| Session cookie | Cookie that lasts only until the browser session ends. |
| Persistent cookie | Cookie with an expiry date that remains until that date or manual deletion. |
| First-party cookie | Set by the website being visited and sent to that same domain. |
| Third-party cookie | Set by a different domain whose content is embedded in the page; often restricted for privacy. |
| SameSite | Policy that limits whether cookies are sent with cross-site requests to improve security and privacy. |
| Consent cookie | Records the user choice about optional cookies so the site remembers that preference. |
Key Takeaways
- Cookies are small text data that help websites remember state, such as sign-in or preferences.
- Session cookies end when the browser closes, while persistent cookies remain until their expiry or deletion.
- First-party cookies support core features on the site being visited; third-party cookies are increasingly restricted for privacy.
- SameSite policies and browser controls reduce unwanted cross-site tracking and protect security.
- Users can manage or clear cookies, but blocking all cookies may reduce functionality on some sites.