Tag Pilot
Menu

Web tracking introduction

Cookies, banners and consent

Updated

Cookies

When users visit a page, all page views and other actions look the same from the server’s perspective. The server can read some basic, general information about where a request comes from, such as the IP address or browser details, but that is not enough to identify an individual person precisely.

Without identification, users couldn’t log in to their accounts or even have their own cart, and the server could serve the wrong data to the wrong people. That’s why cookies were introduced in the early days of the internet. They are small pieces of text that the server can create, the user’s browser stores, and the browser then sends along with every future request to that server.

Because cookies are so powerful, browsers and servers enforce several safeguards to prevent them from being stolen or leaked. Knowing someone’s cookie value could let a malicious actor use that person’s account.

Since cookies are designed to identify individual users precisely and reliably, they became the core technology for analytics and advertising.

Third-party cookies

Besides its main value, such as an identifier, each cookie carries information about a specific domain. That domain is the only place where the cookie can be accessed, so a login cookie from one website cannot be read or used on another.

There is an exception to this rule. Browsers let websites load parts of other websites, using iframes or images from external sources, and when this happens the embedded website can create its own cookies. These are third-party cookies, and this is how they work:

  1. A user visits website a.com.
  2. a.com embeds an iframe or image from b.com.
  3. b.com sets a cookie that only the b.com server can read.
  4. The user visits website c.com.
  5. c.com embeds an iframe or image from b.com, exactly like a.com.
  6. The b.com server can read and use the same cookie across a.com and c.com.

That’s why iframes and pixels used to be so powerful: they reliably tracked the same person across many websites, as long as all of those websites embedded the same iframe or pixel.

Interestingly, the embedding website cannot access those third-party cookies; they belong only to the server that created them.

Because third-party cookies have few uses beyond tracking and advertising, they have come under scrutiny for privacy reasons. Safari and Firefox block them by default, and many ad blockers do too. Chrome still allows them: Google dropped its plan to phase them out. Either way, a tracking setup that depends on third-party cookies misses a large part of your visitors.

As explained above, cookies are essential and powerful components of the modern internet, yet most people don’t know exactly how they work. That’s why laws like the GDPR and the ePrivacy Directive require websites to ask for consent, usually with a cookie banner that explains which cookies the website uses and what for.

These banners also let users decide which cookies they accept and which they don’t. As a result, some cookies can be blocked, which affects website features or tracking performance.

Cookie banners are to cookies what tracking pixels are to analytics: generic, and needing to work on virtually any website on the internet. That is not easy, given how extensively cookies are used by various systems and platforms. That’s why Consent Mode was introduced.

Consent Mode is a technology similar to the dataLayer: a very technical protocol that gives all systems standard information about the user’s consent status. In fact, Google Consent Mode is an extension of the dataLayer. It is a set of commands that let tags adjust their behaviour depending on whether the user accepted certain cookies.

For instance, Google tags read the Consent Mode state from the dataLayer, and if consent wasn’t granted they don’t create or read their cookies. Depending on the implementation, they either don’t fire at all (basic Consent Mode) or send cookieless pings without identifiers (advanced Consent Mode).

For the technical details, read Google Consent Mode explained.