Definition
An HTTP cookie is a key-value pair set by a website in the user's browser and returned by the browser on every subsequent request to that site. Cookies were introduced to solve a real problem — HTTP is stateless, so without them you would have to log in to every page individually — but they have grown into a primary vehicle for tracking. First-party cookies are set by the site you are visiting; third-party cookies are set by domains the site embeds, often advertising networks.
Why Cookies Defeat a VPN
If you log into Google over a VPN, Google still knows you are you because your browser presented your Google session cookie. The VPN changed your IP from Helsinki to Bucharest, but the cookie identified you all the same. This is the most common practical demonstration that a VPN protects the network layer, not the application layer. To unlink your VPN session from your real-world identity, you must also clear cookies — or use a separate browser, container, or incognito window with no logged-in accounts.
Cookie Lifecycle
Cookies have an expiration date and can be marked as Secure (sent only over HTTPS), HttpOnly (inaccessible to JavaScript), and SameSite (restricted from cross-site contexts). Recent browser changes have begun deprecating third-party cookies, but the tracking industry has responded with techniques like CNAME cloaking, fingerprinting, and server-side tracking that achieve similar ends without third-party cookies.