First party and third party
Why it matters This is the trick at the heart of web tracking. Once you see how one hidden embed on many different sites can recognise you on all of them, the rest of this course clicks into place.
Go back to the cloakroom. Now imagine three different shops that all use the same cloakroom company, with the same attendant at each door. The shops cannot see each other's tickets, but the cloakroom company sees you at all three, and knows it is the same coat each time.
First party: the site you meant to visit, the one shown in your address bar.
Third party: any other site whose content is loaded inside the page: an advert, a "like" button, a video player, an analytics script. A cookie that belongs to such a site is called a third-party cookie.
Embed: content from another site placed inside a page, such as an advert box, a map or a video. Loading it sends a request to that other site, from your browser.
The demo: one ad, three shops
Here is a practice world with three shops. Each one shows a small advert from adco.example.
| Step | Address bar | Request to adco.example | What adco.example learns |
|---|---|---|---|
| 1 | shopa.example/boots | No cookie yet. Reply: Set-Cookie: uid=u-7731 | A new visitor, now labelled u-7731, looking at boots |
| 2 | shopb.example/tents | Cookie: uid=u-7731, referrer shopb.example | u-7731 is also shopping for tents |
| 3 | shopc.example/maps | Cookie: uid=u-7731, referrer shopc.example | u-7731 likes boots, tents and maps: probably planning a hike |
Notice that no rule was broken. The browser sent adco.example's cookie only to adco.example, exactly as the last lesson said. The trick is that adco.example was present on all three sites, so it saw its own ticket three times, each time from a different shop.
The three shops never shared anything with each other. They did not have to. Each one added the same embed, and the embed did the joining. Multiply this by thousands of sites and you get a browsing profile.
First-party cookies are usually fine
The cookie that keeps you logged in to shopa.example, set by shopa.example and sent only to it, is a first-party cookie. It is how the site works. The privacy concern is mostly about the third party that sits on many sites at once.
A common misconception
"A cookie can only be seen by the site I am on." The site you are on cannot read adco.example's cookie, true. But adco.example can, and it is on many sites. Third parties are not limited to adverts either: like buttons, comment boxes and embedded videos can all play the same role.
Try it
Open your browser's developer tools (DevTools): press F12, or Ctrl+Shift+I on Windows and Linux, or Cmd+Option+I on a Mac. In Safari, first switch on "Show features for web developers" in Settings, Advanced. DevTools is a built-in panel that shows what a page is doing. Looking is always safe: nothing you see there is sent anywhere.
- Open a large news or shopping site, then open DevTools.
- In Chrome or Edge, click Application, then Cookies in the left list. In Firefox, click Storage, then Cookies. In Safari, click Storage.
- Look at the list of site names. The one matching the address bar is the first party. Each different name is a third party whose content is on this page.
- Click the Network tab and reload. Look at the Domain column (right-click the column headers to add it if missing). Count how many different domains the page contacted.
Your browser may already block many of these, so you might see fewer third-party cookies than requests. The lesson "What browsers do now", later in this module, explains why that differs between browsers.
Recap
- The first party is the site in your address bar; third parties are embedded inside it.
- Each cookie still goes only to its owner, but a third party embedded everywhere sees its own cookie everywhere.
- That is how one embed joins your visits to many sites into one profile.
- First-party cookies keep sites working; most tracking concern is about third parties.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.