Differences

This shows you the differences between two versions of the page.

--- privacy:cookies [2025/02/18 15:46] – Formatting karelkubicek
+++ privacy:cookies [2026/08/31 19:48] (current) – Add one sentence pointing to the new Privacy:Browser storage page for persistence that is not a Set-Cookie. Authored by Claude karel.kubicek.claude
@@ Line 1: / Line 1: @@
 ====== Classifying Cookies ======
-Browser cookies are still the most commonly used method for tracking the session state of websites and the identity of visitors. According to prior studies, between 80% in 2012 {[roesner2012_detecting]} and 90% in 2019 {[solomos2019_clash,sanchezrola2019can]} of websites use cookies for user tracking, often without users' knowledge. While other stateless tracking technologies, such as [[Privacy:Fingerprinting]] or [[Privacy:Requests#classification_of_link_decorators|Link decorators]], exist, cookies remain the primary choice, with stateless methods typically used in combination with cookies. This trend persists despite the discontinuation of third-party cookies.
+Browser cookies are still the most commonly used method for tracking the session state of websites and the identity of visitors. According to prior studies, between 80% in 2012 {[roesner2012_detecting]} and 90% in 2019 {[solomos2019_clash,sanchezrola2019can]} of websites use cookies for user tracking, often without users' knowledge. While other stateless tracking technologies, such as [[Privacy:Fingerprinting]] or [[Privacy:Requests#classification_of_link_decorators|Link decorators]], exist, cookies remain the primary choice, with stateless methods typically used in combination with cookies. This trend persists, and third-party cookies were in the end **not** discontinued: on 22 April 2025 Google announced it would "maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies".((Privacy Sandbox, [[https://privacysandbox.com/news/privacy-sandbox-next-steps/|"Next steps for Privacy Sandbox and tracking protections in Chrome"]], 22 April 2025. Checked 2026-08-19.)) They remain allowed by default in Chrome, blocked in its Incognito mode, and partitioned per top-level site by default in Firefox and Safari — so what a measurement observes depends on which browser it drove and in which mode; see [[Programming:Stateful stateless#Since 2022 the engine decides, not you]].
 Below, we discuss two main classification methods: using datasets of labeled cookies or machine learning (ML) to classify cookies based on their context and request URL. But first some preliminaries.
+This page is about cookies. A site can persist an identifier in several other places — ''localStorage'' and ''sessionStorage'', IndexedDB, Cache Storage behind a service worker, and the HTTP and favicon caches — and a crawler that records only cookies sees none of them; that is [[Privacy:Browser storage]].
 ===== First- and Third-Party Cookies =====
-First-party cookies are set by the domain the user is directly visiting, while all other cookies are from third parties. A common misconception is that first-party cookies are always benign and third-party cookies are always intrusive. However, first-party cookies can also track users or even be set by third parties using CNAME cloaking. First-party cookies are restricted to the website's context, while third-party cookies can track users across multiple websites.
+<WRAP important>A common misconception in research is that first-party cookies are always benign and third-party cookies are always intrusive!</WRAP>
+First-party cookies are set by the domain the user is directly visiting, while all other cookies are considered third-party cookies. Although third-party cookies are significantly more used for tracking than first-party cookies, it is wrong to claim that first-party cookies are always benign and third-party cookies are always intrusive. First-party cookies can also track users or even be set by third parties using [[https://arxiv.org/abs/2102.09301|CNAME cloaking]] and there are many third-party cookies serving necessary functionality such as SSO.
+The only difference is from the browser perspective. First-party cookies are accessible only from the first-party website's context, while third-party cookies are accessible across multiple websites that embed the same third party. But this implementation depends on the browser, with [[https://webkit.org/blog/8943/privacy-preserving-ad-click-attribution-for-the-web/|Safari]] and [[https://blog.mozilla.org/en/products/firefox/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/|Firefox]] setting the  storage for third parties for every website separately.
 Munir et al. {[shaoor2023cookiegraph]} observed that 89.86% of the top-million websites use first-party tracking cookies. Of these, 96.61% are ghostwritten by third-party scripts embedded in the first-party context, and some are set by fingerprinting scripts.
@@ Line 126: / Line 132: @@
 Edit your crawler to load the profile before starting the crawl and to extract the cookie category data afterward:
-<file python create_profile.py>
+<file python crawl.py>
 import json
 from selenium import webdriver