Website cookies – what they are, how they work on your website and what GDPR requires

Definition

Cookies are small text files that a website stores in the visitor's browser to remember information between visits – such as login status, basket contents or tracking data for advertising.

What are website cookies and how do they work technically?

A cookie is a small text file – often just a few kilobytes – that the web server sends to the visitor's browser when they load a page. The browser saves the file locally and sends it back with the next request to the same domain. This lets the website recognise the visitor without having to store information on the server.

Cookies typically contain a unique ID, an expiry time and the domain name they belong to. Session cookies only last until the browser is closed. Persistent cookies stay in the browser until they expire – often after anything from 30 days to 2 years, depending on their purpose.

Types of cookies on a website

Cookies fall into four main categories, based on what they do:

• Necessary cookies – Required for the website to work: login, basket, session handling. Do not require consent under GDPR.
• Analytics cookies – Measure traffic and behaviour, for example Google Analytics or Plausible. Require consent.
• Functional cookies – Save preferences such as language, region or currency. Often require consent.
• Marketing cookies – Track visitors across websites for advertising, for example Meta Pixel or Google Ads tags. Always require consent.

Cookies and GDPR – what the law requires of your website

GDPR and the ePrivacy Directive (implemented in Sweden through the Swedish Electronic Communications Act, lagen om elektronisk kommunikation) require visitors to give informed consent before non-essential cookies are set. Consent must be freely given, specific, informed and revocable.

• Freely given – A pre-ticked box does not count as consent
• Specific – The visitor must be able to choose which categories they accept
• Informed – A clear explanation of what each category does
• Revocable – Easy to withdraw consent at any time

In recent years, the Swedish Authority for Privacy Protection (IMY) has criticised Swedish companies that fail to meet these requirements.

Cookie consent on the website – technical implementation

The most common cookie consent solutions are CMPs (consent management platforms) such as Cookieyes, Axeptio or Usercentrics. They display the banner, block cookies until consent is given, store the consent and keep documentation for audits.

First-party vs third-party cookies

First-party cookies are set by the domain the visitor is on and are considered more privacy-friendly. Third-party cookies are set by external domains – typically advertisers. Safari and Firefox already block them by default, while Google chose in 2025 to keep them in Chrome.

The trend is towards server-side tracking and first-party data collection. For online retailers and advertisers, that means investing more in their own data flows and CRM integration to keep measurement working.