Search code examples
cookiesthird-party-cookies

Identify third party cookies in chrome


In the process of making a website GDPR compliant i need to identify and categorize cookies used on that website. Now i came across the issue to differentiate between first and third party cookies.

I was not able to find the information how to do that. So my question is: how can i find out if a cookie is a third-party-cookie with help of the developer tools of chrome and relative to the current website open.

enter image description here

Thanks a lot!


Solution

  • OK user3507003.

    I am going to try to answer your question, even though I am not an expert on cookies. I am very interested in the topic however, so as I say, I am going to try to answer your question.

    I am going to include background information on the subject as I try to answer your question, as the intent, purpose, and history of website cookies is short and sometimes confusingly often changing. You might like to skip to the TL;DR section near the end, for some reason I felt like pressing computer keyboard buttons for more than an hour and fifteen minutes this morning. I also just like thinking about the idea of "party cookies".

    Being sure to define what is meant by "cookie": A 'cookie' is a small piece of data that is sent by a website server as part of the HTTP/S protocol as part of a response for a browser request for a webpage, then is stored locally by the browser, then is sent along with subsequent browser requests for website pages. What can make that confusing is when you ask your browser to ask a webserver for a web page, the request for the webpage can sometimes involve more than one HTTP request and to different servers for different parts of the webpage. Depending on cookie data property values different cookies could sometimes be sent with those different HTTP requests for webpage parts.

    That explanation does not explain the difference between first party and third party cookies. It covers both indiscriminately. My US market-leading internet search engine (Google) results ((which should be largely unbiased by account histories except somewhat anonymized cookie data)) for "are there other types of cookies than party cookies" confirms that some websites talk about 'session', 'persistent', and 'third-party' cookies. That distinction is likely not directly relevant to your question, but it might be useful to know.

    To be clear, what I think you are asking, and what I am trying to answer, is how you can tell the difference between third party cookies and first party cookies in the context of the developer tool storage inspector, as you have shown in a screenshot of that.

    In your screenshot, on the left is an expandable view of the types of data storage that your browser (Chrome) supports, including "Local Storage" and "Cookies", among other types of storage. You have expanded the 'Cookies' section and selected the first item in the 'Cookies' list, and the inspector is showing a list of more than eighteen different cookies, starting with an 'ads_prefs' cookie.

    The list on the right, starting with the 'ads_prefs' cookie is a list of cookies that were set by the selected website server in the list on the left. This is where my experience with cookies is less than sure, but I think you are confused that there are now two website domains involved with each cookie in the data you are seeing as in your screenshot.

    The list of website domains on the left shows website domain servers that have set cookies as part of the most recent webpage request of your browser. All of the website domain servers that are not the domain of your original webpage request are third party servers with respect to your requested webpage. Those requests to third party servers are often pixel image trackers, advertising brokers, that sort of thing.

    The cookies set by any website servers that are not the website domain server for your initial request (the first domain in the Cookie section view list on the left) are, I believe, considered "third party cookies".

    The list of cookies on the right has a "Domain" column. What this should mean is that the Chrome browser is conformant to an HTTP/S cookie specification that allows webpage responses to set cookies for your browser that are intended for other webserver domains, and not the server that set the cookie. That "Domain" cookie property name does complicate the vocabulary around first party and third party servers and cookies, but once you understand the context as centered around a browser's webpage request, consistent disambiguation would be excessive.

    TL;DR

    The cookies set by the first-listed first party server as intended for other webpage domain servers are considered 'first party cookies' (with central respect to your first browser request for a webpage), even though they can involve another website domain as an intended recipient. All of the other cookies set by other servers (that were not the domain webserver for your initial browser webpage request) are 'third party cookies'.

    Disclaimer: I could be wrong about some or all of that.