Third-party cookie

How it works

The browser compares the domain and scheme of the cookie with the page in the address bar. If they match, the cookie is a first-party cookie. If they do not match, it is a third-party cookie. A cookie from a subdomain of the top page is still first-party.

A third-party cookie needs SameSite=None and Secure to go with requests from a cross-site frame. Even then, the browser can block it. Ad networks use third-party cookies to follow people across sites, so browsers limit them.

Browser rules

Browser	Third-party cookies by default
Safari	Blocked by Intelligent Tracking Prevention
Firefox	A separate cookie jar for each top-level site (Total Cookie Protection)
Chrome	Allowed. Blocked in Incognito and when the user turns on blocking

In April 2025, Google said Chrome keeps the current user choice for third-party cookies. Google did not add a new prompt for them.

For an iframe that needs state, use a Partitioned cookie (CHIPS) or the Storage Access API. A partitioned cookie keeps one copy for each top-level site. The Storage Access API asks for the normal, unpartitioned cookies.

Set-Cookie: widget_session=7yjgj57e4n3d; SameSite=None; Secure; HttpOnly

# Sent in a cross-site frame, if the browser allows third-party cookies
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=None

# One copy for each top-level site (CHIPS)
Set-Cookie: __Host-session=abc123; Path=/; Secure; HttpOnly; SameSite=None; Partitioned