What is a first-party cookie?

A cookie set by the domain being visited and readable only to it — the rail under sessions, carts, analytics identity, and stored click IDs; the cookie family's purge survivor.

What does Safari's ITP do to first-party cookies?

Caps script-set lifespans at seven days (one in some flows) — truncating attribution windows, reshuffling test buckets, and turning returning visitors into strangers unless storage moves server-set.

Are first-party cookies exempt from consent rules?

No — ePrivacy-family rules judge by function, not party label; a tracking cookie needs consent regardless of which domain set it, and third-party scripts on your domain don't launder anything.

Growth Marketing Glossary

First-Party Cookie

first-par·ty cook·ienoun

The cookie your own domain owns — infrastructure, not surveillance, and the survivor with an asterisk named ITP.

Schematic — the cookie the visited site owns

Term: First-Party Cookie
Set by: The domain being visited
Powers: Sessions, carts, analytics, click IDs
Caveat: Safari ITP caps script-set lifespans

Forms & parts of speech

first-party cookie · noun

The visited site's cookie.

"The login, the cart, the analytics ID, the gclid - all riding first-party cookies the purge never touched."

Definition in plain terms

A first-party cookie is set by — and readable only to — the domain the user is actually visiting: your site's session cookie, cart state, analytics identifier, the stored CLICK-ID. It is the half of the COOKIE family the privacy purge largely spared: browsers blocking THIRD-PARTY cookies by design left first-party ones standing, because they are how websites function rather than how strangers follow you. The asterisk is real, though — Safari's Intelligent Tracking Prevention caps script-set first-party cookies at seven days (one day in some flows), which quietly shortens every measurement window riding on them.

The mechanics

The mechanics are the COOKIE entry's, scoped home: Set-Cookie from your domain (or document.cookie from your scripts), sent back on every request to you, invisible to other sites. What rides on the rail is most of this glossary's measurement layer — analytics identity (GA4's client ID), stored click IDs feeding CAPI and ENHANCED-CONVERSIONS joins, A/B-test bucket assignments, consent states — which is why ITP's lifespan caps matter operationally: a returning Safari visitor on day eight is a 'new user' to script-set cookies, attribution windows silently truncate (the CLICK-ID entry's cookie-lifetime warning), and test buckets reshuffle. The responses form the modern stack: server-set cookies (HttpOnly, set via response headers) escape the script-set caps, first-party-domain measurement endpoints (the server-side tagging pattern — your subdomain proxying the analytics, earning server-set lifespans), and identity layered above cookies entirely (logins and hashed emails, the DETERMINISTIC-MATCHING spine, durable where cookies are weather). The boundary cases keep lawyers employed: a third-party script setting cookies on your domain is technically first-party and behaviorally whatever the script does — consent rules (the EPRIVACY entry's storage-access line) apply by function, not by party label, and 'first-party' is not a compliance category.

When it matters

First-party cookies matter as the load-bearing rail under sessions, personalization, and measurement — and their ITP-era fragility matters to anyone reading Safari-heavy cohorts: retention, attribution, and test integrity all inherit the seven-day cliff. The discipline is architectural: server-set where lifespans matter, first-party measurement endpoints for the analytics that deserve them, identity above cookies for the relationships that must persist, and the compliance reflex that function, not party label, decides what consent a cookie needs.

Worked example. A subscription brand's Safari metrics read strangely for a year - 'new visitor' rates implausibly high, returning-customer attribution evaporating, A/B tests reshuffling mid-flight - and the diagnosis is the seven-day cliff: everything rode script-set first-party cookies that ITP expires weekly, so every Safari customer who returned on day eight arrived as a stranger. The re-architecture moves the load: analytics shifts to a first-party measurement endpoint (a subdomain proxy earning server-set cookie lifespans), click IDs and consent state move to server-set storage, test bucketing keys to logged-in identity where it exists, and the login prompt earns its place in the deterministic-identity strategy. Safari cohort metrics rebase upward overnight - returning recognition up 40% - and the team files the standing lesson: the purge spared first-party cookies, but Safari put them on a timer, and the fix was architecture, not acceptance.

Failure modes to watch. Script-set cookies carrying loads ITP expires weekly; Safari cohorts read as churn when the cookie died first; attribution windows assumed while the rail truncates them; third-party scripts wearing first-party labels past consent rules that judge by function; and identity strategies that never graduate above the cookie layer.

Synonyms & antonyms

Synonyms

first-party cookie1P cookiesite cookie

Antonyms

third-party cookieserver-side identity (the layer above)

Origin & history

The first/third-party distinction is as old as the cookie itself — Montulli's 1994 invention was first-party by design, the third-party variant the unintended sequel — and the privacy era inverted their fortunes: third-party blocked by default, first-party preserved as infrastructure, then disciplined by Safari's ITP lifespan caps from 2019 onward.

Etymology: source.

Usage trends

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Common questions

What is a first-party cookie?: A cookie set by the domain being visited and readable only to it — the rail under sessions, carts, analytics identity, and stored click IDs; the cookie family's purge survivor.
What does Safari's ITP do to first-party cookies?: Caps script-set lifespans at seven days (one in some flows) — truncating attribution windows, reshuffling test buckets, and turning returning visitors into strangers unless storage moves server-set.
Are first-party cookies exempt from consent rules?: No — ePrivacy-family rules judge by function, not party label; a tracking cookie needs consent regardless of which domain set it, and third-party scripts on your domain don't launder anything.

Related tools & calculators

toolA/B test sample size

Resources & people to follow

referenceWikipedia — HTTP cookie
referenceWebKit ITP documentation (cookie lifespan policies)
referenceRGM analysis — the purge spared them, Safari put them on a timer; server-set what matters, and build identity above the weather

Curated, non-competitor resources verified per term.

Related training

modulePerformance marketing

Disciplines

Areas of marketing where first-party cookie is a core concern:

Performance marketingGrowth strategy

Sources

trendsGoogle Trends — "first party cookies"