Are cookies dangerous?

Most cookies are harmless or necessary. Session cookies keep you logged in. Preference cookies remember your settings. The privacy concern comes from third-party tracking cookies set by advertising networks like Google and Meta, which follow your activity across millions of websites to build advertising profiles.

Can I delete cookies?

Yes. In Chrome: Settings → Privacy and Security → Clear browsing data → Cookies. This removes existing tracking identifiers but does not prevent new ones from being set when you visit sites again.

Do cookies contain personal information?

Typically no — cookies store anonymous IDs rather than your name or email. However, those IDs are linked to your activity profile on the tracking company's servers, which can be extremely detailed even without your name attached.

What is a third-party cookie?

A cookie set by a domain different from the site you are visiting. When a website loads a Facebook Like button, Facebook sets a cookie from its own domain — making it a third-party cookie on that site. These are the primary mechanism for cross-site tracking.

Why can't this page show all my cookies?

Browsers protect certain cookies with an HttpOnly flag, which prevents JavaScript from reading them. These are typically session and login cookies — the safe, essential kind. The tracking cookies used by advertising networks are generally readable because they need to be accessed by JavaScript to function.

Are third-party cookies being phased out?

Google announced plans to phase out third-party cookies in Chrome but reversed the decision in 2024. Safari and Firefox already block or partition them by default. The advertising industry is actively developing alternative tracking methods that do not rely on cookies at all — including browser fingerprinting, which is harder to block.

What is the difference between cookies and browser fingerprinting?

Cookies are files stored in your browser that can be deleted. Browser fingerprinting reads characteristics of your browser and device — GPU, screen resolution, fonts, browser version — to create an identifier that cannot be deleted because nothing is stored. Fingerprinting is increasingly used as a backup when cookies are blocked or cleared.

MYSYSINFO / blog● LIVE SCAN

MySysInfo API →

Browser Cookies Explained

// My System Information on the Internet

What they are, who sets them, what they store about you — and how to see every single one in your browser right now.

Every website you visit drops small files called cookies into your browser. Some are essential — they keep you logged in, remember your cart, save your preferences. Others are surveillance tools that follow you across the internet, building a profile of everywhere you go and everything you do. Most people have dozens of cookies stored right now without knowing it. This post explains exactly what they are, who put them there, and what they actually do.

BROWSER...

COOKIES...

IP_ADDRESS...

↑ Your browser right now — cookies are enabled and any website you visit can read and set them.

What Is a Cookie?

A cookie is a small text file — nothing more than a string of characters — that a website writes to your browser and reads back on your next visit. The name comes from an older computing concept called a "magic cookie" — a token passed between programs to identify a session.

When you visit a website, the server sends back an HTTP response that can include a Set-Cookie header. Your browser saves that value and sends it back automatically on every future request to that domain. That's the entire mechanism — a note your browser passes back and forth with the server on every visit.

A typical cookie looks like this:

Set-Cookie: _ga=GA1.1.62690543.1761215355;
            expires=Thu, 17-Oct-2027 03:36:21 GMT;
            path=/;
            domain=.example.com

_ga — the cookie name
GA1.1.62690543... — the value (your unique ID)
expires — when it gets deleted automatically
path=/ — works on all pages of the site
domain=.example.com — works on all subdomains

BROWSER...

The Three Types of Cookies

First-party cookies are set by the website you are actually visiting. When you log into your email, the site sets a session cookie so you stay logged in. When you add something to a shopping cart, a cookie remembers what is in it. These are generally necessary and harmless — without them, websites would forget who you are on every page load.

Third-party cookies are set by a domain different from the one you are visiting. When a site loads Facebook's Like button, Google's analytics script, or a Twitter share widget, those external scripts run in your browser and set their own cookies — from facebook.com, google.com, and twitter.com respectively — even though you never went to those sites directly. This is how a single tracking cookie from Google or Facebook can follow you across millions of websites simultaneously.

Session vs persistent cookies. Session cookies exist only while your browser is open. Close the tab, close the browser — they are gone. Persistent cookies have an expiry date set in the future, sometimes years away. Your Google Analytics cookie expires in two years. Facebook's pixel cookie lasts three months. These persist across browser restarts and continue tracking you until they expire or you delete them.

COOKIES...

The Cookies on Your Browser Right Now

Most people are surprised when they first see what is actually stored in their browser. Below is a breakdown of the most common cookies found on real browsers — and what each one actually does.

_gaGoogle Analytics🟡 Medium

Assigns you an anonymous ID and tracks every website you visit that uses Google Analytics. One of the most common cookies on the internet — present on roughly 55% of all websites.

⏱ Expiry: 2 years

_ga_XXXXXXXGoogle Analytics (GA4)🟡 Medium

Your specific GA4 session data — visit count, last visit time, current session. The XXXXXXX matches the site's GA4 property ID.

⏱ Expiry: 2 years

_fbpFacebook / Meta🟠 High

Facebook's Pixel cookie. Links your browsing activity to your Facebook profile. Every site with a Facebook Like button or ad pixel sets this. Meta uses it to build your ad profile across the entire web.

⏱ Expiry: 3 months

_gcl_auGoogle Ads🟡 Medium

Tracks whether you clicked a Google ad before visiting a site. Links your session to specific ad campaigns for conversion attribution.

⏱ Expiry: 3 months

_rdt_uuidReddit Ads🟡 Medium

Reddit's tracking pixel cookie. Set on any site running Reddit ad campaigns. Tracks which Reddit ads drove you to visit.

⏱ Expiry: 6 months

_twpidTwitter / X🟡 Medium

Twitter's pixel tracking ID. Links your site visits back to your Twitter ad profile.

⏱ Expiry: 1 year

intercom-device-idIntercom🟢 Low

Identifies your device for the Intercom chat widget. Persists across sessions so chat history is maintained.

⏱ Expiry: 9 months

PHPSESSIDThe website's server🟢 Safe

Essential session cookie set by PHP-based websites. Keeps you logged in. Contains no personal data — just a random ID that maps to your session on the server. Expires when you close the browser.

⏱ Expiry: Session only

IP_ADDRESS...

↑ Your IP address is also visible alongside cookies — together they paint a detailed picture of who and where you are.

How Tracking Cookies Actually Work

You visit a news site. That site loads Google Analytics — Google sets a _ga cookie in your browser with your unique ID: 62690543.

Later that day you visit a shopping site. That site also loads Google Analytics. Google reads back the same _ga cookie — 62690543 — and now knows you visited both the news site and the shopping site.

Tomorrow you visit a cooking blog, a travel site, and a finance forum. All three use Google Analytics. Google now has a browsing history for ID 62690543 across five different websites — your interests, your habits, roughly how much money you might have, where you might want to travel.

This is not hypothetical. Google Analytics is installed on approximately 55% of all websites. Facebook's pixel is on roughly 30%. Between the two, a significant portion of your browsing activity is logged by these two companies every day.

BROWSER...

GPU_RENDERER...

↑ Your browser and GPU are additional signals that help trackers confirm your identity even when cookies are cleared.

What Cookies Cannot Do

Cookies cannot execute code. They are plain text files, not programs. A cookie cannot install software, access your files, or run in the background. The tracking happens server-side when the cookie value is sent with a request — the cookie itself is inert.

Cookies are domain-restricted. A cookie set by facebook.com can only be read by facebook.com. A cookie set by google.com can only be read by google.com. They cannot read each other's cookies. The cross-site tracking works because both companies embed their scripts on millions of third-party websites — not because they share cookie data with each other.

Cookies cannot access your device. They have no visibility into your files, camera, microphone, contacts, or any other device resource. They are limited entirely to the browser storage they are given.

AD_BLOCKER...

↑ An ad blocker prevents most third-party tracking cookies from being set in the first place.

How to See Your Own Cookies

Method 1 — Browser DevTools (technical). Open Chrome, Firefox, or Edge. Press F12 to open Developer Tools. Click the Application tab. In the left sidebar, expand Cookies and click your current domain. Every cookie, its value, expiry date, and flags are listed here.

Method 2 — MySysInfo Cookie Scanner (easy). For a plain-English breakdown of every cookie in your browser — who set it, what it does, and whether you should be concerned — use the MySysInfo cookie scanner.

What Is Browser Fingerprinting →

How to Reduce Cookie Tracking

Clearing cookies periodically removes tracking identifiers and forces sites to assign new ones. This breaks the historical tracking thread but does not prevent new cookies from being set.

Browser extensions like uBlock Origin block third-party tracking scripts from loading at all — which means the cookies are never set in the first place. This is more effective than clearing cookies after the fact.

Brave Browser blocks third-party cookies by default and randomizes fingerprinting signals, making cross-site tracking significantly harder.

Firefox's Enhanced Tracking Protection partitions third-party cookies by site — so a Facebook cookie set on a news site cannot be read by Facebook on a different site.

Safari's Intelligent Tracking Prevention automatically expires third-party cookies after 7 days, limiting the tracking window.

PRIVACY_BROWSER...

AD_BLOCKER...

↑ Whether your browser has built-in privacy protection affects how many tracking cookies get set on your device.

Check What Is in Your Browser

You can see every readable cookie in your browser right now — explained in plain English, no technical knowledge required.

What Is Browser Fingerprinting →See everything your browser reveals → MySysInfo Monitor your website uptime → URLWatch.io

// Subscribe to MySysInfo blogs - More privacy explainers and tools coming soon

Frequently asked questions

Common questions about browser cookies, tracking, and privacy.

Are cookies dangerous?
Most cookies are harmless or necessary. Session cookies keep you logged in. Preference cookies remember your settings. The privacy concern comes from third-party tracking cookies set by advertising networks like Google and Meta, which follow your activity across millions of websites to build advertising profiles.
Can I delete cookies?
Yes. In Chrome: Settings → Privacy and Security → Clear browsing data → Cookies. This removes existing tracking identifiers but does not prevent new ones from being set when you visit sites again.
Do cookies contain personal information?
Typically no — cookies store anonymous IDs rather than your name or email. However, those IDs are linked to your activity profile on the tracking company's servers, which can be extremely detailed even without your name attached.
What is a third-party cookie?
A cookie set by a domain different from the site you are visiting. When a website loads a Facebook Like button, Facebook sets a cookie from its own domain — making it a third-party cookie on that site. These are the primary mechanism for cross-site tracking.
Why can't this page show all my cookies?
Browsers protect certain cookies with an HttpOnly flag, which prevents JavaScript from reading them. These are typically session and login cookies — the safe, essential kind. The tracking cookies used by advertising networks are generally readable because they need to be accessed by JavaScript to function.
Are third-party cookies being phased out?
Google announced plans to phase out third-party cookies in Chrome but reversed the decision in 2024. Safari and Firefox already block or partition them by default. The advertising industry is actively developing alternative tracking methods that do not rely on cookies at all — including browser fingerprinting, which is harder to block.
What is the difference between cookies and browser fingerprinting?
Cookies are files stored in your browser that can be deleted. Browser fingerprinting reads characteristics of your browser and device — GPU, screen resolution, fonts, browser version — to create an identifier that cannot be deleted because nothing is stored. Fingerprinting is increasingly used as a backup when cookies are blocked or cleared.