What Is a Cookie on a Website? What It Does and Whether to Accept

A cookie on a website is a small text file that the site asks your browser to store on your computer or phone. It holds a little piece of information about you and your visit — nothing more exotic than that. The next time you return to the site, your browser sends it back, and the site uses it to recognise you: you stay logged in, the items stay in your shopping cart, and your language and display preferences are just as you left them.

That is the short answer. They are not programs, they cannot install anything, and they are not viruses. But they come in different types, they are also used to track people across the web for advertising, and the “Accept all cookies” banner you see everywhere deserves a more thoughtful answer than a blind click. Here is how it all works.

What a Cookie Actually Is

A cookie is a short line of text — usually a name, a value (often a random-looking code), and some settings such as when it expires and which website it belongs to. Your browser stores thousands of these files, sorted by website, and manages them automatically.

A helpful way to picture it is a cloakroom ticket. When you hand over your coat, you get a ticket with a number. The ticket is not valuable in itself and it does not contain your coat — it simply lets the staff match you with your belongings when you come back. A cookie works the same way: the website keeps the real information (your account, your cart, your history) on its own computers, and the one on your device is just the ticket that says “this browser belongs to that record.”

Because the ticket is tied to one website’s address, one site’s files cannot be read by a completely different site through your browser’s normal rules. If you are unsure how web addresses themselves work, our guide to what a URL is explains the parts of an address in plain terms — a cookie is always attached to one of those addresses.

What Cookies Remember

Different sites store different things, but the common jobs are:

• Sign-ins. The most useful one of all confirms you have already logged in, so you are not asked for your password on every single page.
• Shopping carts. An online shop remembers what you added even if you leave and come back days later.
• Preferences. Language, region, currency, text size, dark mode, and similar choices you make once and expect the site to keep.
• A record of your visit. Analytics cookies count visits and show site owners which pages people read, where they clicked, and where they left.
• Advertising information. Some note which products you viewed so that adverts for similar products can follow you to other websites.

Notice that these files generally do not store your name, address, or card number directly. Those details live in your account on the site’s own systems. They mostly carry an ID number that points to them.

Session Cookies and Persistent Cookies

They are often described by how long they live, and the difference matters:

Session cookies last only while the browser tab is open. They are deleted as soon as you close the browser. A banking site, for example, typically uses the session kind so that your login disappears the moment you finish — a deliberate safety feature.

Persistent cookies have an expiry date set by the website, which might be a day, a month, or much longer. They survive closing the browser; that is how a shop can greet you next week with your cart still full and your preferences intact. When people talk about clearing them, they mostly mean deleting these stored files.

Neither type is automatically good or bad. A long-lived one that keeps you signed in to your email is convenient; a long-lived tracking one that follows you around the internet for months is the privacy trade-off discussed below.

First-Party and Third-Party Cookies

The other important distinction is who placed it:

First-party cookies come from the website you are actually visiting. If you are reading a news site and it stores one to remember your region, that is first-party. These are mostly the helpful kind: logins, carts, and settings.

Third-party cookies come from a different company whose content is embedded in the page — an advertiser, a video player, or a social-media button. Because the same advertising company appears on thousands of websites, it can recognise your browser across all of them and build a picture of your interests. That is how you can look at a pair of shoes once and then see adverts for those shoes for a week.

This cross-site tracking is why third-party cookies have become controversial, why privacy laws in many places require websites to ask your permission, and why modern browsers increasingly block them by default or let you block them yourself.

Are Cookies Dangerous?

Themselves, they are not dangerous in the way malware is: each one is plain text, it cannot run code, spread to other files, install software, or read documents stored elsewhere on your device, and none has ever been a virus.

The real concerns are about privacy and account safety, and they are more modest:

• Tracking. Third-party ones can reveal a lot about your browsing habits to companies you have never dealt with directly.
• Stolen session cookies. If malicious software gets onto a device, it can steal the one that keeps you logged in and impersonate you — which is one more reason to keep your device and browser updated and to log out of sensitive accounts on shared computers.
• Over-sharing on shared machines. On a public or borrowed computer, stored ones can leave you signed in for the next user. Using a private browsing window, which deletes them when closed, avoids this.

In short: the file is harmless; what companies do with the information is the part worth thinking about.

Should You Accept All, Reject All, or Something in Between?

The honest answer is “something in between,” and it takes only a few seconds:

• For a site to work at all, the essential ones (login, cart, security) are needed, and most sites are allowed to use those without asking. Blocking every single one in your browser usually breaks sign-ins and shopping rather than protecting you.
• When a banner offers a choice, “reject all” or “only essential” is a perfectly good default. The site will still work; you are mainly refusing the advertising and tracking extras.
• “Accept all” is a reasonable choice too if you simply want the smoothest experience on a site you trust and use daily — just know you are also accepting the tracking that comes with it.
• Be suspicious of banners with no real reject option or ones that make rejecting deliberately confusing. That design, often called a dark pattern, is itself a sign of how the site treats its visitors.

Your browser also gives you standing controls: most major browsers let you block third-party ones while keeping first-party ones, which is a sensible middle setting for everyday browsing.

How to See and Clear Cookies

Every major browser keeps them under its privacy settings, usually labelled “Cookies and site data” or something similar. In that area you can typically:

• View which sites have stored them and how much space they use.
• Delete them for one specific site (useful when a single site misbehaves or will not log you out).
• Clear all of them at once.
• Choose whether third-party ones are allowed, blocked, or blocked only in private windows.

One thing to expect after clearing: you will be logged out of most websites and some preferences will reset, because those tickets are gone. Clearing them is a good occasional tidy-up and a standard troubleshooting step when a site displays oddly, but it does not delete your accounts or anything stored on the websites themselves.

Frequently Asked Questions

Is a cookie a virus?
No. It is a small text file that cannot run, install anything, or spread. The genuine concerns are privacy — especially third-party tracking — not infection.

Why does every website ask about cookies now?
Privacy laws in many regions require sites to get your consent before using any that are not strictly necessary, particularly for advertising and tracking. The banner is the site asking for that permission.

What happens if I reject all cookies?
Usually, very little breaks. The site keeps its essential ones for logins and carts where the law allows, and you lose mainly personalised adverts and some remembered preferences. On a few poorly built sites, rejecting can cause repeated banners or lost settings.

Do cookies store my passwords?
Not directly. One usually holds an ID that tells the site “this browser is already logged in as this account.” Your password itself stays with the website’s systems and your browser’s own password store, which are separate from these files — though this is exactly why a stolen login cookie can be misused, and why logging out on shared computers matters.

Should I clear my cookies regularly?
There is no fixed schedule. Clearing them is sensible after using a shared computer, when a website behaves strangely, or as an occasional privacy tidy-up. Just expect to sign in to your sites again afterwards.