Partitioned cookies (CHIPS)
Why it matters Partitioning is the single idea that breaks the "one ad, three shops" trick while keeping embedded chat boxes, maps and videos working. It is how modern browsers protect you without breaking the web.
Go back to the cloakroom company that works at three shops. Now imagine each shop insists on its own separate ticket book. The cloakroom company still gives you a ticket at every shop, but the ticket from shop A is useless at shop B. It can remember your coat within one shop, but it can no longer say "this is the same person who was at shop A".
Partitioning: keeping a separate store of cookies (and other data) for each site you visit directly, so an embed gets a different jar on every site.
Top-level site: the site in your address bar. Partitioned storage is filed under it: "adco.example, while you are on shopa.example" is a different jar from "adco.example, while you are on shopb.example".
The demo again, with partitioning
| Address bar | Jar used for adco.example | Cookie adco.example sees |
|---|---|---|
shopa.example | adco.example inside shopa.example | uid=u-7731 |
shopb.example | adco.example inside shopb.example | uid=u-1904 (a new one) |
shopc.example | adco.example inside shopc.example | uid=u-3388 (another new one) |
adco.example now sees three strangers. Each label works fine inside its own shop, so an embedded chat box can still remember your conversation on shopa.example. What is lost is the ability to join the shops together.
CHIPS and the Partitioned attribute
Browsers take two routes to get here. Some partition or block third-party cookies by default. Others keep ordinary third-party cookies but let an embed ask for a partitioned one. That second route is called CHIPS.
CHIPS: Cookies Having Independent Partitioned State: a standard that lets an embedded site mark a cookie as partitioned, so the browser keeps a separate copy for each top-level site.
Set-Cookie: chat=c-12; Secure; SameSite=None; Path=/; PartitionedThe Partitioned attribute says "file me under the current top-level site". It must be used together with Secure. A well-behaved chat widget or embedded payment form can use it to keep working without becoming a cross-site tracker.
Chrome supports CHIPS. Firefox and Safari already keep embedded cookies apart, or block them, by default (checked October 2026). The next lesson compares the browsers in more detail.
A common misconception
"Partitioned means deleted." Partitioned cookies still exist and still work; they just cannot be used to recognise you across different sites. Clearing data is a separate step.
Recap
- Partitioning gives an embed a separate cookie jar for each top-level site.
- The embed still works on each site, but cannot join your visits across sites.
- CHIPS lets an embed request a partitioned cookie with the Partitioned attribute (plus Secure).
- Partitioned is not deleted: the data stays, filed under the site you were on.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.