Quick answer: Cookies are small text files websites save on your device — first-party cookies make sites work properly (remembering logins, cart contents), while third-party cookies track your activity across multiple sites to build an advertising profile. You can limit this tracking through your browser’s privacy settings, a privacy-focused browser, and by paying attention to what cookie consent banners actually let you reject.
Cookies get blamed for a lot that isn’t really about cookies — the deeper issue is what companies do with the data cookies collect, and who they share it with. A 2023 case against a major health platform makes that distinction concrete, and it’s a useful lens for understanding why “just cookies” can still mean a real privacy problem.
A Real Example: When Cookie-Based Tracking Exposed Health Information
In February 2023, the FTC took its first-ever enforcement action under the Health Breach Notification Rule against GoodRx, the prescription discount and telehealth platform. The FTC found that GoodRx had used tracking technology — including advertising cookies and tracking pixels — to share users’ health information, including which medications they searched for and which conditions they indicated having, with Facebook, Google, and several other advertising and analytics companies. GoodRx then used that same data to target its own users with personalized health-related ads, despite telling users their health information would stay private and falsely claiming compliance with HIPAA privacy standards.
GoodRx paid a $1.5 million civil penalty and agreed to a permanent ban on sharing health data for advertising purposes. The case matters beyond GoodRx specifically: it was the clearest signal yet that the FTC considers this kind of third-party cookie and tracking-pixel data sharing a real consumer harm, not a technical footnote — especially when the data involved is sensitive.
What Are Cookies?
- First-party cookies come directly from the website you’re visiting and generally improve your experience — remembering that you’re logged in, keeping items in a shopping cart, or storing a language preference.
- Third-party cookies are set by a domain other than the one you’re visiting — typically an advertiser or data broker — and are the mechanism that lets your activity be tracked across many different sites to build a profile of your interests, habits, and (as the GoodRx case shows) sometimes far more sensitive information.
Why Cookies Matter for Privacy
- They build a detailed picture of your behavior — searches, purchases, pages visited, and time spent — often across sites that have no obvious connection to each other.
- They enable targeted advertising based on that profile, which is the business model behind most “free” websites and apps.
- They can expose sensitive categories of information, as in the GoodRx case, when tracking technology captures health searches, financial activity, or other sensitive data alongside ordinary browsing behavior.
- Data gets shared with third parties, often without consumers realizing the scope of it, since a cookie consent banner rarely spells out every company receiving the data.
Where Third-Party Cookies Actually Stand Right Now
Starting in 2020, Google had planned to phase out third-party cookies in Chrome entirely, following Safari and Firefox, which already block many of them by default. In July 2024, Google reversed course, announcing it would not deprecate third-party cookies after all and would instead let users make their own choice about tracking through browser settings. Third-party cookies remain active in Chrome today as a result, rather than being phased out as originally announced. (Google has since wound down several of the specific Privacy Sandbox advertising APIs it had built as cookie replacements, but that’s a separate development from the cookie-deprecation reversal itself.) In practical terms: don’t assume cookie-based tracking is going away on its own. The protective steps below still matter regardless of which browser you use.
How to Protect Your Privacy
- Adjust your browser’s privacy settings to block third-party cookies specifically — most major browsers allow this without breaking most sites’ core functionality.
- Use a privacy-focused browser like Firefox or Brave, which block many third-party trackers by default rather than requiring manual configuration.
- Clear cookies regularly, or set your browser to clear them automatically when you close it, to limit how long a tracking profile can accumulate.
- Install a dedicated tracker blocker like Privacy Badger or uBlock Origin for an additional layer beyond your browser’s built-in settings.
- Actually read cookie consent banners rather than clicking “Accept All” reflexively — most now include a “Reject Non-Essential” or “Manage Preferences” option, often in a secondary menu, that meaningfully reduces what gets shared.
- Be more cautious on sites handling sensitive topics — health, finance, legal — where tracking technology carries more risk if it’s misused, as the GoodRx case demonstrated directly.
People Also Ask
No — cookies are a basic, necessary web technology, not malware. The privacy concern is specifically with third-party tracking cookies and what companies do with the data they collect, not with cookies as a category.
It’s not dangerous in the way clicking a phishing link is, but it does mean broader data sharing than necessary for the site to function. Looking for a “reject” or “manage preferences” option takes a few extra seconds and meaningfully limits third-party tracking.
No. After years of planning to phase them out, Google reversed that plan in July 2024 and third-party cookies remain active in Chrome. Safari and Firefox block many third-party cookies by default already, so your protection still depends heavily on which browser you use.
You’ll likely be logged out of sites and lose saved preferences like cart contents or language settings, but nothing is permanently lost — you’ll just need to log back in. This is a minor inconvenience compared to the tracking reduction it provides.
A breach is typically an unauthorized intrusion by an outside attacker. The GoodRx case was different — it was the company’s own sharing of user data with advertising partners, through cookies and tracking pixels it had deliberately deployed, which is why the FTC treated it as a deceptive practice and privacy violation rather than a security incident.
Sources: Federal Trade Commission, “FTC Enforcement Action to Bar GoodRx From Sharing Consumers’ Sensitive Health Info for Advertising” (February 2023); Federal Trade Commission, Health Breach Notification Rule
Leave a Reply
You must be logged in to post a comment.