What Are Browser Cookies and What Do They Actually Track?

Open any website in India today and you'll hit the same wall before you've read a single line: a banner asking you to "accept cookies." Most people tap accept without a second thought, just to make the pop-up go away. Few stop to ask what they just agreed to.

What a Cookie Actually Is

A cookie is a tiny text file, usually just a few kilobytes, that a website asks your browser to store on your device. It's not a program and it can't run code on its own — think of it as a sticky note the site leaves in your browser so it can recognize you the next time you show up. When you log into your bank's app and it remembers your session for the next twenty minutes without asking for your password again, that's a cookie doing its job.

Cookies were never designed to be sinister. The web's HTTP protocol (the basic set of rules browsers and servers use to talk to each other) has no built-in memory — every page load is treated as a brand-new, anonymous visit unless something tells the server otherwise. Cookies were invented in the mid-1990s to solve exactly that problem: giving websites a way to remember a shopping cart, a login, or a language preference between page loads.

Not All Cookies Are Built the Same

The trouble starts with how far that memory extends. A few distinctions matter more than the rest:

• Session cookies disappear the moment you close your browser tab — these are the harmless, short-lived kind that keep you logged in while you shop.
• Persistent cookies stick around for days, months, or years, which is how a site remembers you weeks after your last visit.
• First-party cookies are set by the site you're actually on — useful for things like remembering your cart or theme preference.
• Third-party cookies are set by a different domain entirely, usually an ad network embedded on the page you're visiting, and these are the ones that follow you across unrelated sites to build an advertising profile.

That last category is the one privacy researchers worry about. Visit a shoe store, then a news site, then a recipe blog, and you might notice shoe ads chasing you the whole way. That isn't coincidence — it's a third-party cookie from an ad network recognizing you across all three sites and quietly building a profile of your interests.

Why the Consent Banners Showed Up in India

If cookie pop-ups feel like a newer addition to Indian websites, that's not your imagination. India's data privacy law, the Digital Personal Data Protection (DPDP) Act, requires companies to get clear, informed consent before collecting personal data, and cookies that track you across sites count as exactly that kind of data collection. Companies serving Indian users are now expected to let you actually decline non-essential cookies, not just acknowledge that tracking exists — which is why you're increasingly seeing a genuine "reject all" option instead of a single "OK" button designed to make you click through as fast as possible.

This matters more in India than the global conversation around cookies usually suggests. With well over 800 million internet users, a huge share coming online through low-cost Android phones and mobile data rather than desktop browsers, the sheer scale of tracking data being collected on Indian users is enormous — and historically, there's been far less visibility into where it ends up compared to markets with longer-standing privacy regulation.

A cookie banner that only offers "Accept" isn't asking for your consent — it's asking for your compliance.

Taking Back Some Control

You don't need to become a privacy engineer to cut down on unnecessary tracking. A few habits go a long way:

1. Use your browser's "reject non-essential cookies" option when a banner offers one, instead of the one-tap accept button.
2. Clear cookies periodically through your browser's privacy settings, especially on a shared or family device.
3. Turn on "block third-party cookies" in your browser settings — most modern browsers, including Chrome and Firefox, support this without breaking how sites function.
4. Use private or incognito windows for one-off purchases or searches you don't want linked to your regular browsing profile.

None of this makes you invisible online — plenty of tracking happens through other means entirely, like device fingerprinting. But it closes off the simplest, oldest method still in wide use.

The next time that banner pops up, it's worth the extra two seconds to look for the "manage preferences" link instead of mashing the accept button. Cookies aren't inherently the enemy — your bank, your email, and half the conveniences of modern browsing depend on them. The problem was never cookies existing; it was never being given a real choice about which ones got to follow you around.