In this guide
- Cookies have a purpose (necessary, preferences, analytics, advertising), an owner (first or third party) and a lifetime (session or persistent).
- Advertising and most analytics cookies need consent in the EU and UK.
- Audit your own cookies twice a year: list them, say why you have each, and delete the ones you do not need.
Cookies are text values a website asks the browser to keep. Some keep you logged in, others remember a language, others measure visits or recognise you across sites for ads. People often call the last two "tracking cookies". This page explains how to tell them apart and what to do about them. It links to third-party cookies, cookies, GDPR and the ePrivacy Directive and Safari ITP.
Four ways to describe a cookie
| Dimension | Types | Why it matters |
|---|---|---|
| Purpose | Strictly necessary, preferences, analytics, advertising | Decides whether consent is needed |
| Owner | First party (your domain), third party (another domain) | Browsers block third-party cookies more often |
| Lifetime | Session (until the browser closes), persistent (days or years) | Longer cookies recognise returning visitors |
| How it is set | By JavaScript, or by an HTTP response from a server | Safari limits script-set cookies more strictly |
Raw events in. Clean events out.
Open Tracked collects each event on your own domain, removes the noise and sends what is left to Meta, Google Ads, TikTok.
Common tracking cookies
| Cookie | Set by | Purpose | Typical life |
|---|---|---|---|
_ga, _ga_* | Google Analytics | Recognise visitor and session | Up to 2 years |
FPID | Server container (GA4 client) | First-party client ID | Up to 2 years |
_gcl_au, _gcl_aw | Google Ads | Link ad clicks to conversions | 90 days |
_fbp | Meta pixel | Browser ID | 90 days |
_fbc | Meta pixel | Click ID from fbclid | 90 days |
_ttp | TikTok pixel | Browser ID | 13 months |
Names and lifetimes come from the vendors and change. Check your own site for what is actually set.
What the law says
In the EU and UK, storing or reading non-essential information on a device, including advertising and most analytics cookies, needs the visitor's consent. Strictly necessary cookies, such as a shopping cart or a login, do not. Other regions have their own rules. This is general information, not legal advice; see server-side tracking and GDPR.
3 things to remember
Scroll and the points stack up.
Cookies have a purpose (necessary, preferences, analytics, advertising), an owner (first or third party) and a lifetime (session o
Advertising and most analytics cookies need consent in the EU and UK.
Audit your own cookies twice a year: list them, say why you have each, and delete the ones you do not need.
Audit your cookies
Open a private window
Visit your site without accepting anything.
List the cookies
In developer tools, Application, Cookies. Note which are set before consent.
Accept and list again
Note which appear after consent.
Write down purpose and owner
For each cookie, who sets it and why.
Remove what you do not need
Delete tags that set cookies you do not use.
Keeping useful cookies alive
Cookies written by scripts are capped in Safari. Cookies set by your own server last longer. Open Tracked's Cookie Keeper (every plan) keeps selected platform cookies for up to 400 days by restoring them from your server. This works only if the visitor consented to the cookie in the first place. See extending cookie lifetime.
A note on consent and server-set cookies
It is easy to think that a cookie set by your own server escapes the consent rules. It does not. The rule follows the purpose of the cookie, not the machine that writes it. A cookie that exists only to recognise a visitor for advertising needs consent wherever it comes from. The practical effect is that your banner should control the server side too: if the visitor declines, the server should not set or restore advertising cookies, and the tags that use them should not fire.
Many sites get this half right. The banner blocks the browser tags, but the server container keeps setting cookies because nobody told it about the choice. Test it: decline everything in a private window, then look at the cookies and at the server Preview. You should see neither the cookies nor the advertising tags.
Terms you will see
- Session cookie
- A cookie that disappears when the browser closes.
- Persistent cookie
- A cookie that stays until its expiry date.
- Strictly necessary
- A cookie without which the service the visitor asked for cannot work.
- Consent banner
- The notice that asks visitors which cookies they allow.
- Cookie notice
- A page that lists the cookies you use and why.
When a vendor offers to extend your cookies, ask what exactly changes. Is the cookie set by your server, or by a script? Does it last longer in Safari, and how do you know? Is it restored from a copy kept on your server, and if so, under what identifier? Does it respect the visitor’s consent choice? Clear answers to these four questions tell you more about a tool than a feature list does.
Brands that grow on cleaner data
Stores and agencies use Open Tracked to see which ads earn the sale.
Frequently asked questions
What is a tracking cookie?
A cookie used to recognise a visitor across visits or sites, usually for analytics or advertising.
Do I need consent for all cookies?
Not for strictly necessary ones. Analytics and advertising cookies usually need consent in the EU and UK.
How long do tracking cookies last?
From the session to two years, depending on the cookie. Chrome caps any cookie at 400 days.
Are first-party cookies exempt from consent?
No. First-party cookies for analytics or ads still need consent where the law requires it.
How do I see my cookies?
In your browser's developer tools, under Application and Cookies, or in Safari's Storage tab.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Integrations · 6 min read
