Technology

What actually happens when you accept cookies

By Leandro Bruzaferro · · 6 min read
person wearing long-sleeve top working on laptop
SharePostLinkedInFacebook

The banner appears on nearly every site, the button is pressed without reading, and the transaction stays obscure on both sides. Most people could not say what a cookie is, what accepting one permits, or what declining actually prevents. The mechanism is small enough to describe exactly, and describing it exactly turns the click into a real choice.

A cookie is a short piece of text that a site asks your browser to keep, and which the browser then sends back on every later request to that same site. That is the entire mechanism. There is no code in it and nothing runs; it is a label the browser carries on your behalf.

The label matters because HTTP has no memory. Each request arrives as if it were the first. A cookie holding a random identifier is what lets a site recognise that this request and the previous one came from the same browser, which is how a shopping basket survives a page change and how you stay logged in.

Four attributes decide how a cookie behaves, and they are set by whoever creates it.

Attribute What it controls Why it matters to you
Domain Which site receives the cookie back Decides first-party or third-party
Max-Age How long the browser keeps it Session cookies die when you close the tab; others last months
SameSite Whether it travels on requests from other sites The main brake on cross-site tracking
HttpOnly Whether page scripts can read it Keeps a login cookie away from injected scripts

None of that is exotic, and none of it is what the banner is about.

The distinction the banner exists for

A first-party cookie is set by the site in your address bar. A third-party cookie is set by a different domain whose content is embedded in the page: an advert, an analytics tag, an embedded video, a font.

The difference is consequential. A first-party cookie identifies you to one site. A third-party cookie is sent back to the same outside domain from every site that embeds it, which lets that domain observe a sequence of visits across sites it does not own. That sequence, not the cookie, is the product. It is the raw material for the industry described in how data brokers work.

Computerphile traces the same mechanism request by request. (Follow the Cookie Trail, Computerphile)

What the law asks for

Under the European rules and their UK equivalent, storage that is not strictly necessary to deliver the service you asked for requires consent that is prior, informed and specific. Three words carry the weight.

Prior means before the storage happens, not while it happens. A banner that sets analytics cookies as the page loads and asks afterwards has already done the thing it is asking about.

Informed means the purposes are stated in terms a reader can evaluate, which is why the better banners name categories rather than saying “to improve your experience”.

Specific means consent to analytics is not consent to advertising. This is why refusing should be as easy as accepting, and why a banner offering only “Accept” is not asking a question.

Brazil’s LGPD arrives at a similar place by a different route, requiring a lawful basis and a genuine choice for non-essential processing.

What each button actually changes

On a site wired correctly, the buttons move a small set of signals. Google’s consent framework, which most advertising and analytics tags now read, carries four.

Signal Accept Essential only
Advertising storage Granted Denied
Advertising personalisation Granted Denied
Advertising user data Granted Denied
Analytics storage Granted Denied

Denied does not mean the advert disappears. It means the tag stops writing and reading identifiers, so it serves something untargeted and counts you without recognising you. The page still works; the memory is what goes.

Two practical consequences follow. The choice is stored per browser, so it does not travel to your phone. And it is stored in a cookie, so clearing cookies clears the record of having refused, and the banner returns.

What accepting does not change

This is the part the banner never explains, and it is the part worth knowing.

Refusing cookies does not make you anonymous. Every request still carries your IP address, your browser and operating system version, your language, and your screen dimensions. Combined, those form a fingerprint distinctive enough to recognise many visitors with no stored identifier at all, which is why fingerprinting is regulated as tracking in its own right rather than treated as a loophole.

Refusing also does not touch server logs, which record the request regardless, or first-party analytics measured without cookies, or anything you type into a form and send.

And the cookie question is separate from the account question. Once you are signed in, the site knows who you are because you told it, not because of a stored label — the distinction that matters when you read about what a VPN actually hides, or about how passkeys replace the password without touching any of this.

Where this was heading, and where it went instead

For four years the expectation was that Chrome would remove third-party cookies, as Safari and Firefox had already done by default, and that a set of replacement interfaces called the Privacy Sandbox would take over the advertising functions.

Neither happened. Google confirmed in April 2025 that it would not introduce a separate prompt to phase third-party cookies out, leaving the controls inside Chrome’s existing settings. In October 2025 it went further and announced it was retiring most of the Privacy Sandbox technologies themselves, naming Topics, Protected Audience, Attribution Reporting, Private Aggregation, IP Protection and several others, citing low adoption and ecosystem feedback about their expected value.

So third-party cookies remain in Chrome, the proposed replacement has largely been withdrawn, and the consent requirements are exactly as they were. The banner is not a transitional artefact waiting for a technical fix to arrive. On present evidence it is the permanent interface.

What to do with this

Read the buttons rather than the paragraph. A banner where refusing takes one click is asking honestly; one where it takes three is applying friction deliberately, and the friction is the message.

Expect the choice to be per-browser and to reset when you clear your cookies. Expect refusal to reduce what is stored about you rather than to make you invisible.

And treat the banner as the smaller half of the subject. The identifier it governs is one input among many, and the parts it does not cover are the parts nobody puts a button on.

Sources