Open any website today, and a banner appears before you have read a line. It asks about cookies. Most owners set that banner up once, paste in a policy from somewhere, and move on. That holds until a client, a lawyer or a regulator asks what is actually running on the site.
So, what are cookies, and what do they oblige you to do? This guide covers the basics, the types you will find on your own pages, where browsers stand in 2026, and what India's data protection rules and Europe's cookie law mean for a site you run.
What are cookies, and how do they work?
A cookie is a small piece of data that a website asks your browser to store. It might be a login token, a language choice or a random ID. On the next visit, the browser sends it back, and the site recognises you, which is how a shop keeps your cart intact as you move between pages. A cookie can generally be read only by the domain that set it, with some exceptions for third-party cookies.
The data itself is rarely the issue. A cookie that remembers dark mode tells nobody anything. A cookie carrying a unique ID that passes through several ad servers can follow one person from site to site, and that second kind is what privacy law is written for.
Why websites use cookies
Nobody adds cookies out of curiosity. They solve ordinary problems. Persistent cookies let a site remember dark mode, currency, language, or whether a notification banner was dismissed. Session cookies hold a login steady. Analytics scripts count visits so you can see which pages work. Advertising tags, the heaviest users of third-party cookies, help ad platforms buy and sell impressions in real time.
Each of those is a separate purpose, and that matters. Under India's rules, consent has to be tied to the purpose of processing. A single line saying "we use cookies to improve your experience" covers none of them properly.
The kinds of cookies on your site
Cookies are sorted two ways: by how long they live and by who sets them.
On lifespan, session cookies vanish when the browser closes, while persistent cookies stay until they expire or the visitor deletes them. Session cookies mostly keep a visit working, through a login or a cart, so they are typically treated as strictly necessary and exempt from consent, whereas persistent tracking cookies generally need it.
On origin, first-party cookies come from the site the visitor is on. Third-party cookies come from another domain, such as an ad network, a chat widget or an embedded video. Strictly necessary cookies, covering things like authentication and security, are the only ones that can be set without consent.
Where owners slip is a mistake ConsentPixel flags as the most common: bundling necessary and optional cookies behind one "Accept" button, or letting persistent trackers fire before the visitor has chosen anything. You can test this yourself. Open your site in a private window, open the browser's developer tools, and read the cookie list before touching the banner. Anything non-essential already sitting there is a problem.
Where third-party cookies stand in 2026
For years the story was that Chrome would kill third-party cookies. It did not. In April 2025, Google said it would keep its current approach and not roll out a separate prompt, so third-party cookies stay on by default, and users can switch them off in Privacy and security settings. Chrome held 71.37% of browser usage in April 2026, according to Statcounter figures cited in that same piece.
Other browsers went the other way. Safari, Firefox and Edge already block or restrict third-party cookies, and Safari also enforces a seven-day expiry on first-party cookies set through JavaScript.
For you, the practical result is uneven data. The same visitor looks different depending on their browser. Chrome's decision changes nothing legally, either: it affects how often tags succeed at setting cookies, not the consent requirement.
What Indian website owners need to know
MeitY notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025, and the rollout is phased. Rule 4, on consent managers, comes into force on 13 November 2026. These are intermediaries through whom a person can give, manage, review and withdraw consent. The substantive duties, including notice, consent, breach reporting and individual rights, become fully enforceable by 13 May 2027.
Cookies sit inside this. A site that uses cookies to collect personal data needs valid, specific, informed consent before setting non-essential ones. Strictly necessary cookies need no consent but must still be disclosed. There is also no size exemption: a small business with a blog and an analytics tag is covered. Treat the cookie-specific guidance as interpretation and have your lawyer confirm it for your site.
What Europe expects
If visitors from the EU use your site, the ePrivacy Directive and the GDPR still apply, and consent must be specific and obtained before cookies are set.
Enforcement is active. France's regulator lists a March 2026 fine of €15,000 on a ticketing company, with cookie consent among the breaches. It also runs an automated crawler that checks for a banner, whether refusing is as easy as accepting, and whether cookies drop before consent. The ceiling is higher than most owners assume: up to 2% of worldwide annual revenue for a cookie breach, as the 2025 fines of €325 million on Google and €150 million on Shein show, according to the same source.
The EU did try to loosen things. The Digital Omnibus, published on 19 November 2025, proposed one-click rejection, a six-month wait before asking again after a refusal, and browser-level consent signals. The Council's June 2026 compromise text removed the one-click and six-month provisions after member states could not agree. Separately, member states blocked the browser-signal plan, leaving Parliament the last chance to restore it. For now, that is a proposal. Not law.
A checklist you can finish this week
Small sites often assume cookie enforcement is a problem for big brands. The 2026 numbers point the other way. One compliance guide reports that 32% of the companies the CNIL audited in 2025 were small or medium-sized businesses, and that 23 cookie sanctions were issued through the simplified procedure after January 2026, averaging €5,815 each. These are not headline fines, but they are real money for a small firm. Here are some ways to resolve this matter easily.
- Scan the site and list every cookie with its purpose, owner and expiry. A scan often turns up tags that someone added two redesigns ago.
- Split the list into strictly necessary and optional. Be strict. If a cookie exists for analytics or advertising, it is optional.
- Hold optional cookies back until the visitor agrees. The CNIL's crawler checks exactly this, so test it yourself in a private window.
- Make "Reject" as easy to find as "Accept". One click, on the first screen.
- Write the cookie policy in ordinary words and name the third parties. A copied policy describes someone else's site.
- Keep a record of each visitor's choice, and review the list every quarter. New plugins and marketing tags bring new cookies with them.
Indian owners have a slightly longer runway, with the main duties fully enforceable by 13 May 2027, but there is little reason to wait. A site that already asks properly, records the answer and explains itself will not need a rebuild when the deadline arrives.
Cookies themselves are ordinary. Trouble starts with the ones nobody can explain. If you can say what each cookie on your site does, who set it and why a visitor agreed to it, you are most of the way there.