What are Third-Party Cookies?

Cookies have come under fire from those concerned about data pro­tec­tion. Their criticism is primarily aimed at third-party cookies, which are used by ad­vert­isers or ad servers to track user behaviour, and generate virtual user profiles. If you've ever seen an ad that exactly matched your recent web activity, it's no co­in­cid­ence. Third-party cookies have probably “tracked” you and in­ter­preted an interest in something from your surfing history. This per­son­al­ised ad­vert­ising is one of the most effective tools of online marketing, but also one of the most con­tro­ver­sial. However, before you form a final opinion about third-party cookies, you need to un­der­stand them properly.

Third-party cookies are those that do not originate from the website operator, but from a third party – such as an ad­vert­iser. If you visit a website for the first time, the web server usually generates a so-called first-party cookie, which stores all the necessary settings and inputs of the user. When you return to the site, this first-party cookie is read to retrieve settings and other in­form­a­tion such as log-in in­form­a­tion. This improves usability.

Third-party cookies, on the other hand, are hosted by an ad­vert­iser­'s server (“ad server”) and primarily record the user's behaviour and path on the internet in order to sub­sequently create a user profile. On the basis of this user profile, it is then possible to display personal adverts to the user. Third-party cookies are powerful online marketing tools and are fre­quently referred to as “tracking cookies” and “targeting cookies”.

Imagine you are visiting an online shop for the first time that you have found using a search engine. The website contains ad­vert­ise­ments for holiday providers that are hosted by an external web server.

1. First of all, webpages will inform you about the use of cookies by means of a text display. These are intended to improve user friend­li­ness. Cookies also collect user-relevant in­form­a­tion from ad­vert­isers. You’ll mostly have to accept the ex­plan­a­tion to use the website, and your web browser will generate two cookies: a first-party cookie from the website operator, and a third-party cookie from the ad­vert­ising ad server. From this point onwards, both cookies collect in­form­a­tion about your behaviour on the website.
    
2. The website for this example is an online fashion shop where you can browse for the products you want. Say you’re par­tic­u­larly in­ter­ested in brown leather bags, and therefore load several product pages that offer this type of bag. So that you can compare them easily, you put a few bags in your shopping cart - which the first-party cookie stores so that the shopping cart doesn't empty itself, even if you're not logged in. The third party cookie also collects this in­form­a­tion because it is in­ter­ested in what kind of product you might want to buy.
    
3. There is an advert on the website for a holiday, but seeing as you’ve just come back from a trip, you’re not really in­ter­ested, and do not click on it.
    
4. You’re not quite satisfied with the selection of bags on the website, and open a new browser window to visit another online shop.
    
5. This online shopalso informs you about the use of cookies and generates a first-party cookie. In addition, ads from the same ad­vert­iser appear here. The third-party cookie from this provider is already there. These adverts also show a holiday deal.
    
6. You actually want to look for brown leather bags. It occurs to you that you also need a new winter jacket, and so you visit some product pages of this other product type. Both cookies will record this.
    
7. You have decided to buy a winter jacket, but not a bag. The third-party cookie remembers this, and the ad server in­ter­prets it in such a way that you are still in­ter­ested in pur­chas­ing a brown leather bag.
    
8. You close the browser windows of both shops. The session is over and the cookies are “shut down”, but will not disappear from your hard drive (unless you have set your browser to delete them after each session)
    
9. A few hours later, when you want to check your e-mails, you notice ads for exactly the same leather bags you were looking at, where before your holiday, you saw travel deals. Now, the ads will advertise brown leather bags because the ad server “knows” that you are in­ter­ested in this type of product. This works by the ad server reading its third-party cookie, which is still stored on your computer.
    
10. Based on this cookie, the server sees that you a) looked at brown leather bags and winter jackets, that you b) spent quite some time on the product pages of brown leather bags, and that you c) finally only bought a winter jacket, but not a bag. The ad server decides that you’ll get targeted ad­vert­ising for brown leather bags because the ad server assumes that you will click on these ads rather than on ads for travel agencies. With just one click, the ad­vert­iser and possibly also the website operator could earn money from your online behaviour.

Third-party cookies collect the following relevant data in par­tic­u­lar:

• Personal data such as age, gender, and location (if readable)
• Visited website via which the cookie was generated
• Subpages visited on the visited website
• Time spent on the page and its subpages

If this data is collected across websites, an in­di­vidu­al user profile can be created that enables personal ad­vert­ising. Online marketing uses third-party cookies in par­tic­u­lar for targeting, tracking, and re­track­ing.

Cookies are usually only helpful for users in the form of first-party cookies, as these are primarily re­spons­ible for user comfort. Third-party cookies are powerful tools, es­pe­cially for ad­vert­isers, with which they can generate targeted ad­vert­ising. The ad­vant­ages and dis­ad­vant­ages of third-party cookies for the parties involved can be sum­mar­ised as follows:

There are several ways to limit or even prevent the use of third-party cookies. Most web browsers have options to help you better protect your privacy. While first-party cookies are usually harmless and should remain activated to maintain your ease of use on the web, there are many more un­der­stand­able reasons to crit­ic­ally evaluate and con­sciously manage third-party cookies.

This short video shows you how to delete cookies from the Chrome browser:

If you have installed an AdBlocker, which directly blocks ad­vert­ise­ments from most common ad servers, this usually also prevents ad servers like these from gen­er­at­ing third-party cookies. However, you should be aware that these programs disrupt or make many websites in­ac­cess­ible.

Because users were rarely informed about the existence of third-party cookies in the past, ad­vert­isers quickly found them­selves cri­ti­cised for col­lect­ing data unnoticed and un­so­li­cited. The EU’s General Data Pro­tec­tion Reg­u­la­tion (GDPR) demands website operators to inform visitors about the use and purpose of cookies on their websites. The planned EU ePrivacy Reg­u­la­tion will probably lead to further re­stric­tions; ad­vert­isers will then find it in­creas­ingly difficult to record data unnoticed and un­au­thor­ised by third-party cookies - provided that third-party cookies still exist in their present form.

This is how most website operators are doing things at the moment. From easily over­looked hints in the sidebar to full screen pop-ups, you'll find many different text hints as you click from site to site. However, the privacy state­ments rarely provide settings for in­di­vidu­al third-party cookies and their ad servers, so you'll need to resort to other options such as your browser settings.