Written by Robert Bateman, Privacy and Data Protection Research Writer at TermsFeed. Reproduced locally from the archived copy of the referenced article.

Cookies are little packets of data that get placed on a computer or mobile device with the purpose of doing things like keeping you signed in to a site or remembering the contents of your shopping cart. They can sometimes collect personal information, which means they sometimes are regulated by privacy laws.

In this article, we answer your questions about cookies. For example: Do the privacy implications of cookies really matter? Is there anything you can do to avoid being tracked? And does every website really need to pester you about agreeing to cookies?

What are Cookies?

A cookie (also known as an "HTTP cookie," "browser cookie," or "web cookie") is a data file that is stored on your computer or device when you visit a website.

Cookies do several different jobs. One of the most basic jobs cookies do is to remember your activities on a website.

For example:

• The contents of your shopping cart
• The text you have entered in a form
• Whether you're signed in to your account

Cookies can also be used for analytics. This is a way for a website operator to monitor how users interact with their site.

Cookies do some more complicated jobs, too, such as tracking you as you move around the internet. They can gather information about your habits and preferences, and this information can be used to deliver tailored advertising.

Why Do Websites Warn About Cookies?

Websites warn users about cookies because it's the law to do so.

In certain countries, there are rules requiring website operators to inform users about how they use cookies. Almost every website displays a Privacy Policy and/or a Cookies Policy which explains how the website owner uses cookies.

And in some countries, there are also rules requiring website operators to ask permission before setting cookies on a users' device.

Due to these rules, many websites display a "cookie banner" or "cookie notice" when a user visits their site.

Here's an example of such a notice:

But why are cookies regulated by law in this way? The reason cookies are legally-regulated is because they can reveal information about you.

What Can Cookies Reveal About You?

Cookies can reveal a lot about you, including your web browsing history, the information you've entered into forms, your web search history, and even your location.

Cookies are not designed to "identify" you, as in your name or your "real-world" identity. They associate information with a unique ID: a random string of characters assigned to your web browser.

However, because of the volume of data you transfer over the internet, cookies can reveal some highly sensitive information. And the data sets stored by cookies could also quite easily reveal your "real-world" identity.

Are Cookies Personal Information?

Whether or not cookies count as "personal information" depends on what job a cookie is doing, and which legal jurisdiction the user is based in.

One of the first regions to recognize cookies as personal information was the European Union (EU). The EU's tough privacy laws are what has led to the abundance of "cookie banners" across the internet over the past few years.

The EU's definition of personal information (or "personal data") is found in an important law known as the General Data Protection Regulation (GDPR):

This definition includes any information relating to a person, either directly or indirectly.

So, a cookie that reveals your activity on a website might not be sufficient to identify you on its own. But it still reveals something about you, and could indirectly contribute to your identification.

It's not just the EU that considers cookies to be a type of personal information. There are other laws with similar definitions of personal information being enacted all over the world, including in the United States (specifically, California), Canada, and India.

Do Websites Need to Ask Permission For Cookies?

In the EU, website operators must ask for your consent (permission) before they set certain types of cookies. This is due to a law known as the ePrivacy Directive.

According to the ePrivacy Directive, websites have to ask consent before they set most types of cookies. There are two exceptions. Under the ePrivacy Directive, websites do not have to ask for users' consent before setting cookies that are either:

• Used for "carrying out the transmission of a communication"
• "Strictly necessary" for providing an online service that you have requested

So, under EU law, websites might not have to ask you for consent to set cookies that do the following jobs:

• Storing your items in a shopping cart as you move around the site
• Verifying your identity on secure websites (such as internet banking)
• Ensuring the website runs smoothly via "load balancing"

So what cookies do require consent in the EU? Well, any cookie that is not used for carrying out the transmission of a communication, or that is not strictly necessary for providing an online service.

This includes cookies used for:

• Analytics: Website operators use analytics to see how you navigate their website and to check how well it's working, fix bugs, and test their design. They can also use analytics to count how many people are visiting their website, and where they are visiting from.
• Advertising: Businesses can use cookies to see what you've been doing online, both on their website and on other websites. This allows them to deliver "personalized" or "targeted" advertising: ads that are tailored to your preferences based on your online activity.

Take a look at this example of a cookie banner:

The website using this banner will set two types of cookies. It doesn't give you an option about setting the first type of cookies because these are necessary. When it comes to analytics cookies, the website asks for your consent. This demonstrates the rule about cookies in the ePrivacy Directive.

Is it Safe to Agree to Cookies?

Technically, cookies can represent a security threat. For example, if you transmit sensitive personal information over an unsecured Wi-Fi network, the information could be collected by a session cookie. This information could, in theory, be targeted by hackers.

However, these situations are very rare. Most of the time, it's perfectly safe to agree to cookies.

Are Cookies Bad?

The reason some people object to cookies has to do with privacy rather than security. Tracking cookies allow businesses, such as Google and Facebook, to build up a "profile" about you by observing your online activities.

Given the vast amount of personal information you submit online every day, this act of profiling can give a reasonably accurate picture of who you are, where you live, and what things you might be likely to buy.

Why are Cookies a Privacy Risk?

Cookies that are used to store the information you enter into websites could certainly represent a privacy risk. However, this data is almost always encrypted. This means the only people capable of reading the information stored by these cookies are you and the intended recipient.

A greater privacy risk comes from third-party cookies. These cookies are set by companies that don't even own the website you're visiting. There could be several of these on any given website, all loading themselves onto your device so they can track you around the web.

So, for example, if you visit a website about baking that contains an advertisement from Google Ads, Google's tracking cookies will note that you're interested in baking. Some days later, you might see an ad for rolling pins when you visit a completely unrelated website.

Many people don't have a problem with this. But privacy advocates point out that the big tech companies are amassing huge quantities of data about us, often without our permission.

Can I Opt Out of Cookies?

If you live in the European Union or the United Kingdom, you shouldn't actually need to opt out of cookies because websites should be asking you whether you consent to them (opt in). However, in reality, many websites break the rules.

If you live outside of the European Union, there's often little to no legal obligation on most companies to let you opt out of cookies.

In the U.S., where privacy law is very weak, there are a few laws relating to cookies. Several of these apply only to California residents.

The California Online Privacy Protection Act (CalOPPA) requires operators of commercial websites to create a Privacy Policy explaining how they collect personal information. This includes an explanation of whether the website sets tracking cookies, and how it responds to "Do Not Track" (DNT) signals.

The California Consumer Privacy Act (CCPA) requires certain big businesses and "data brokers" (companies whose main trade is in personal information) to allow California consumers to opt out of the "sale" of their personal information. This can apply to the use of certain cookies.

The California Privacy Rights Act (CPRA) expands upon the CCPA but doesn't increase any obligations for cookies opt-outs.

Even if websites don't have to let you opt out of cookies, there are several ways to avoid them. For example, you can use a privacy-focused browser like Mozilla Firefox or Brave Browser, or you can opt delete cookies using the method we describe below.

How to Delete Cookies

If you want to delete cookies from your browser, you can do it via your browser's menu.

Here are the steps for how to delete cookies from four popular browsers.

How to Delete Cookies from Google Chrome for Windows

• Click the three dots to open the main menu and click on Settings:
• On the left side menu, click Privacy and security. Then, click on the arrow next to the Clear browsing data; Clear history, cookies, cache, and more section:

Select whether you want to do a Basic or Advanced delete.

A Basic delete lets you quickly clear all browsing history, cookies and cached images and files:

An Advanced delete lets you delete more information including passwords, autofill form data and download history:

• Click on Clear data and you're done.

Note: You can use Incognito Mode (Ctrl + Shift + N) to automatically delete cookies and other session data when you close your browser window.

How to Delete Cookies in Firefox (Mozilla) for Windows

• From the main toolbar menu, click Options:
• In the left sidebar menu, click on Privacy & Security:
• Under Cookies and Site Data, click on Clear Data:

Visit the Mozilla support page if you need more guidance.

How to Delete Cookies on Opera for Windows

• In the Settings menu, click Advanced, then click Privacy & Security:
• Under Privacy and security, click the arrow next to Clear browsing data:

Select a time range and the types of data you wish to clear, and click Clear data. You can choose Basic or Advanced.

A Basic delete lets you quickly clear all browsing history, cookies and cached images and files:

An Advanced delete lets you clear more information:

Visit the Opera help page if you need more guidance.

How to Delete Cookies on Edge for Windows

• Open the menu and click Settings:
• Select Privacy and services:
• In the Clear browsing data section, click on the Choose what to clear button:
• Choose what you'd like to clear and click Clear now to finish:

As privacy laws around the world continue to get stricter and come into existence, cookies laws may become tougher as well. In the meantime, there are a number of ways users must be informed about cookie usage by businesses, and many ways they can opt out or manually block cookies when properly informed.

Adobe's goal is to put users in control of their own data and computers. Flash Player can provide you with the same control of local shared objects that web browsers give you for cookies. This TechNote explains how to manage the settings for and delete local shared objects through the Settings Manager.

What is a local shared object?

A local shared object, sometimes called a "Flash cookie," is a data file that can be created on your computer by the sites you visit. Shared objects are most often used to enhance your web-browsing experience. For example, by allowing you to personalize the look of a website that you frequently visit. Shared objects, by themselves, can't do anything to or with the data on your computer. More important, shared objects can never access or remember your e-mail address or other personal information unless you willingly provide such information.

Where can I change the settings for disabling, or deleting local shared objects?

Flash Player provides a number of ways you can manage a website's ability to store information in local shared objects. You can control storage by individual websites or for all websites.

###

Changing storage settings for individual sites, deleting individual site data, or deleting all stored data

To adjust settings or delete data for individual websites you have visited, use the Website Storage Settings panel   in the Settings Manager. You can change the storage limit of individual websites by selecting the website from the list and moving the slider bar. You can also delete data from a specific website by selecting a website and clicking Delete. Finally, you can delete all data currently stored on your system in local shared objects by clicking Delete All Sites. This function is similar to the function in your web browser that lets you delete cookies.

The Website Storage Settings panel of the Settings Manager lets you configure individual website storage and delete stored data.

###

Configuring storage for the site you are currently viewing

On the site you are viewing, right-click rich media content to display the context menu.

Select Settings to bring up the Settings dialog box.

Right-click rich media to access the Settings option in the context menu.

Click the third tab on the bottom of the dialog box (the folder icon) to open the Local Storage panel. This panel indicates the amount of storage currently in use for the current website. It lets you change the default amount of storage for the current website by moving the slider bar.

The Local Storage tab shows the amount of space currently used by the website and lets you change the setting.

When you have finished changing the settings, click Close. Flash Player remembers your local storage settings for the current website.

If you are unsure how much space to allow, but want to be prompted when the site tries to store data or increase the storage limit, move the slider bar to 0 KB. Selecting the Never Ask Again option prevents the Local Storage pop-up dialog from appearing within the rich media content. However, this option can cause certain sites that rely on some amount of local storage to stop working without any warning.

###

Changing the default storage setting for all websites

By default, Flash Player allows each site to store 100 KB of data in a local shared object on your computer. You can change the default storage behavior for all sites you visit using the Global Storage settings panel in the Flash Player Settings Manager.

Go to the Global Storage Settings panel  in the Flash Player Settings Manager.

In the Global Storage Settings panel, you can change the default amount of storage to apply to all websites you visit.

Use the slider bar to change the default amount of storage you want to allow for sites you visit in the future.

When you have finished changing the settings, close the Settings Manager. Flash Player remembers your global storage settings and uses it for any websites you visit in the future.

If you are unsure how much space to allow, but would like to be prompted tries to store data or increase the storage limit, move the slider bar to 0 KB. Selecting the Never Ask Again option prevents the Local Storage pop-up dialog from appearing within the rich media content. However, this option can cause certain sites that rely on some amount of local storage to stop working without any warning.

Additional information

For additional information regarding security, visit the  Flash Player Privacy and Security Center .

To learn how to disable Flash Player's Local Shared Objects see Disable third-party local shared objects .

Adobe takes consumers' privacy seriously and is committed to protecting the security of individuals' personal information on the web. Adobe is dedicated to helping you maintain a secure browsing experience by providing and continuously improving Flash Player privacy controls.