Types of Cookies: A Complete Guide to Every Cookie on Your Website

Every website runs on cookies, but they are not all the same. Some keep your cart from emptying when you click to the next page. Others follow visitors across the internet and feed ad platforms. Privacy laws treat those two very differently, and so do the plaintiffs’ firms sending demand letters.

Our consent platform runs on more than 8,000 websites, so we see the full range every day. This guide walks through the main types of cookies, how risky each one is, what it is used for, and when you need consent before it runs. Use the risk chart to get oriented, then jump to the cookie types that show up on your own site.

Scan My Website for Cookies Browse the Cookie Database

Why Cookie Type Actually Matters

A cookie is a small text file a website stores in the visitor’s browser. That part is simple. What makes cookies confusing is that people sort them three different ways, and every cookie fits into all three at once.

By purpose: strictly necessary, preference, analytics, marketing and social media cookies. This is the sorting that privacy laws care about most, because purpose decides whether you need consent.

By who sets it: first-party cookies come from your own domain. Third-party cookies come from someone else’s domain, like an ad network or a social platform.

By how long it lasts: session cookies disappear when the browser closes. Persistent cookies stay until they expire or someone deletes them.

So a single Meta Pixel cookie is a marketing cookie, a persistent cookie, and in many setups a first-party cookie that feeds a third-party platform. Getting the type right is how you decide whether it can run on page load, whether it waits for consent, and whether it belongs on your site at all.

Cookie Risk Chart: From Low Risk to High Risk

Quick picks: what are you checking?

Setting up a consent banner? Start with strictly necessary and marketing cookies, since that line decides what runs before consent.
Got a demand letter? Look at pixels and trackers and third-party cookies first.
Cleaning up analytics? Read analytics and persistent cookies.
Launching in the EU? Every type below except strictly necessary needs consent there.

The Most Common Types of Cookies and What They’re Used For

Strictly Necessary Cookies

Low risk

These are the cookies your site cannot work without. They keep someone logged in, hold items in a shopping cart, protect forms from fraud, balance traffic across servers and remember the visitor’s cookie choices. Because the visitor asked for the service they support, EU law exempts them from consent.

The catch is that “necessary” is a narrow label. Analytics, A/B testing and advertising are not strictly necessary, even if the business depends on them.

• Logins
• Shopping carts
• Security
• Load balancing
• Saving consent choices

Consent: not required in the EU or US, but list them in your cookie notice.

Examples from our cookie database: PHPSESSID, cf_clearance, CookieConsent, __stripe_sid

Preference Cookies

Moderate risk

Also called functional cookies, these remember choices that make a site more comfortable: language, region, currency, dark mode, a chat window left open. Some regulators treat a cookie as exempt when it only stores a setting the visitor chose on purpose. Many functional cookies come from third-party tools like chat widgets and video players, and those often collect more than a simple setting.

• Language and region
• Display settings
• Embedded video and chat

Consent: generally required in the EU unless the cookie only stores a choice the visitor made. Not required in the US for basic preferences.

Examples from our cookie database: YSC, lidc, messagesutk

Analytics Cookies

Elevated risk

Analytics or performance cookies count visits, track which pages people read and measure how long they stay. Google Analytics is the best-known example: its main _ga cookie lasts two years by default. Analytics feels harmless, but when the data goes to an outside provider that can use it for its own purposes, it starts to look like sharing. Session replay and heatmap tools, which can record clicks and form entries, sit at the risky end of this group.

• Traffic reports
• Page performance
• Heatmaps
• Session replay

Consent: required in most of the EU. In the US, opt-out rights may apply, and session replay is a common target in California wiretapping claims.

Examples from our cookie database: _gid, _clck, hubspotutk, __utma

Run the Cookie Scanner See a Patrol Report

Marketing Cookies

High risk

Marketing or advertising cookies exist to target and measure ads. They build interest profiles, retarget visitors who left without buying and tell ad platforms which clicks became sales. Meta’s _fbp cookie, for example, lasts 90 days. These are the cookies privacy laws were written for, and they drive most consent requirements, opt-out rights and lawsuits.

• Retargeting
• Conversion tracking
• Audience building
• Cross-site ads

Consent: required before they run in the EU. In US states with privacy laws, visitors must be able to opt out of the sale or sharing of their data, including through Global Privacy Control.

Examples from our cookie database: _fbp, _gcl_au, IDE, _uetvid

Social Media Cookies

High risk

Share buttons, embedded posts, social logins and pixels from Meta, LinkedIn, TikTok and others set these cookies. They let the platform recognize its own logged-in users on your site, which is exactly why they are useful for ads and exactly why regulators watch them. A visitor does not have to click the share button for the platform to learn they were there.

• Share buttons
• Embedded posts
• Social login
• Ad attribution

Consent: required in the EU. In the US, treat them like marketing cookies, with opt-out support and careful placement on sensitive pages.

Examples from our cookie database: fr, _uit, YSC

First-Party Cookies

Moderate risk

A first-party cookie is set by the domain in the visitor’s address bar. Your login cookie is first-party. So is the Google Analytics cookie, because the script writes it under your domain. That is why “first-party” does not mean “safe”: many ad and analytics tools now set first-party cookies on purpose, and some route data through your own subdomain to get around browser blocking. Safari limits cookies set by scripts to seven days for this reason.

• Logins
• Site settings
• Analytics IDs
• Server-side tagging

Consent: depends on purpose, not on the domain. A first-party marketing cookie still needs consent in the EU.

Examples from our cookie database: _gid, _gcl_au, hubspotutk, _clck

Third-Party Cookies

High risk

Third-party cookies come from a domain other than the one the visitor is on. An ad network that appears on thousands of sites can read its own cookie on each of them and stitch a browsing history together. Safari blocks them by default and Firefox isolates them per site, but Chrome still allows them, so they remain a large share of tracking on the web.

• Ad networks
• Cross-site tracking
• Embedded widgets

Consent: required in the EU. Under US state laws, sharing data with ad networks usually triggers opt-out rights, and undisclosed third parties are central to many wiretapping claims.

Examples from our cookie database: IDE, MUID, fr, test_cookie

Block Cookies Until Consent Talk to a Privacy Expert

Session Cookies

Low risk

Session cookies have no expiration date. They live in browser memory and are deleted when the visitor closes the browser. Most strictly necessary cookies are session cookies, which is why this type tends to be low risk. Lifetime alone does not decide anything, though: a session cookie that sends data to an ad platform still needs to follow the rules for marketing cookies.

• Login sessions
• Checkout steps
• Form progress

Consent: follows the cookie’s purpose. Necessary session cookies are exempt.

Examples from our cookie database: PHPSESSID, YSC, INGRESSCOOKIE

Persistent Cookies

Moderate risk

Persistent cookies have an expiration date and survive after the browser closes. They remember returning visitors, keep people logged in for weeks and connect today’s visit to last month’s. That memory is useful and also what makes tracking possible, so regulators look at how long they last. France’s CNIL recommends a maximum lifetime of 13 months for tracking cookies.

• “Remember me” logins
• Returning-visitor counts
• Ad frequency caps

Consent: follows the cookie’s purpose. Keep lifetimes as short as the job requires and list them in your cookie notice.

Examples from our cookie database: _gcl_au, _uetvid, hubspotutk, __utma

Tracking Pixels and Cookie-Like Trackers

High risk

Not every tracker is a cookie. Pixels are tiny invisible images or scripts that report a visit to another server. Local storage, device fingerprinting and server-side tags do similar jobs without a traditional cookie. Privacy laws generally cover them the same way, since EU rules apply to any storing of or access to information on a device, and US claims focus on what data was sent and to whom. Pixels on checkout, health or video pages are behind a large share of recent privacy lawsuits.

• Meta and TikTok pixels
• Local storage
• Fingerprinting
• Server-side tags

Consent: treat them like marketing cookies. A banner that only controls cookies but lets pixels fire is one of the most common gaps we find.

Examples from our cookie database: _fbp, _uetsid, _gcl_aw

Tips for Auditing the Cookies on Your Website

Scan before you trust your banner. Load your site in a clean browser, do not click anything, and see what fires, or let our cookie scanner do it for you. Cookies or pixels that run before a choice is made are the first thing regulators and plaintiffs check.

Test the reject button, not just accept. After a visitor rejects, marketing and analytics tags should stay off. Re-scan after clicking reject to confirm.

Check your Global Privacy Control handling. Visitors in many US states can send an opt-out signal from their browser. Your site should honor it automatically.

Scan on a schedule. Marketing teams add tags, vendors update scripts and plugins change. A site that passed in March can fail in June.

How Long Cookies Last

Your cookie notice should list how long each cookie lasts, and the real lifetimes on your site should match what the notice says. A cookie that claims to expire in 30 days but actually lasts two years is a common finding in audits and an easy one to fix.

Look Up Specific Cookies in Our Cookie Database

Found a cookie name in your browser or a scan report and not sure what it does? We have written a guide for each of these 44 common cookies, sorted by type. The full list, with what each one does, is in our cookie database.

Manage Every Type of Cookie with Captain Compliance

Captain Compliance finds the cookies and trackers on your site, sorts them by type, blocks the ones that need consent until visitors agree, honors Global Privacy Control, and keeps a record of every choice.