Become an affiliateStart your program

Technology and tracking

First-party cookie

Also called first party cookie, 1st party cookie, first-party tracking cookie, førstepartscookie.

Short answer

A first-party cookie is a cookie that belongs to the domain shown in the address bar. The browser treats it as the site’s own, so it is not hit by the blocking that applies to cookies set by other domains.

Definition of First-party cookie.

Whether a cookie is first-party or third-party comes down to one question: does the cookie’s domain match the domain the user is on? A cookie on store.com is first-party while the user is on store.com, and third-party if it is read while the user is somewhere else entirely. It is the relationship, not the cookie, that changes.

Who technically writes the cookie, on the other hand, does not matter. A script from an external vendor running on the store’s page sets a first-party cookie, because it is written to the domain the page is on. That is exactly why tracking is increasingly being moved onto the site’s own domain.

First-party does not mean consent-free. In Denmark, a cookie used for tracking, statistics or marketing requires consent under the Danish cookie order (cookiebekendtgørelsen), regardless of which domain it is set from. The exemption covers cookies needed to deliver the service the user has asked for – not cookies that exist to attribute a sale.

First-party does not mean long-lived

Safari’s tracking protection, ITP, limits cookies set from JavaScript to about 7 days – even when they are first-party. If the user arrives via a link with tracking parameters from a domain the browser has classified as a tracker, the limit can be as low as 24 hours. A first-party cookie therefore solves the blocking problem, but not the lifespan problem.

There are two common countermeasures: setting the cookie from the server instead of from JavaScript, and rewriting it on every visit so the window moves along with the user. Neither makes the cookie permanent – an attribution window should never depend on the cookie having survived.

What a first-party cookie cannot do in affiliate tracking

A first-party cookie cannot follow the user from the affiliate’s site to the store. The two domains cannot read each other’s cookies, so the referral has to travel in the URL itself as a parameter. The cookie can only be set once the user has landed on the store.

Nor can it follow the user from phone to computer. If the reader clicks on their mobile and buys on their laptop in the evening, there is no shared cookie, and the sale does not belong to the click. That is a limit of the method, not a bug.

First-party cookie vs. third-party cookie

AspectFirst-party cookieThird-party cookie
Belongs tothe domain shown in the address bara different domain from the one the user is on
Used forlogin, basket and tracking on the site’s own domainrecognition across websites
Browser stanceaccepted, but can be time-limitedblocked by default in several browsers
Requires consentyes, when used for trackingyes

Choose a first-party cookie for anything that has to work on one domain, and never build measurement on the assumption that a third-party cookie is still there.

How it goes wrong

  • 01

    Letting the cookie decide the attribution window

    If the window lives only in the cookie’s expiry time, the browser in practice decides how long an affiliate gets credit. The window should be decided by the click’s timestamp on the server; the cookie is only the transport.

  • 02

    Reading first-party as not tracking

    The domain says something about who can read the cookie, not about what it is used for. A first-party cookie that exists to attribute sales is a tracking cookie and must be included in the consent solution.

  • 03

    Testing the setup in a browser that already knows the store

    If you have visited the store before, the cookie may still be there from last time, and the test confirms nothing. Test in a clean window where the first visit is the click on the affiliate link.

At Affilyflow

First-party cookie in practice

Affilyflow uses the second countermeasure. The click sends the user on to the store with the click ID in the URL as ?afid=, and the store’s tracking script stores the ID in a first-party cookie on the store’s own domain and in localStorage. The cookie is set from JavaScript and is therefore subject to the browsers’ time limits, but both are written again on every visit, so a cleared cookie can be restored. The attribution window does not live in the cookie: it was copied onto the click row the moment the click happened and is decided on our server. A user who extends the cookie in their browser therefore does not get a longer window.

Frequently asked questions

What is the difference between a first-party cookie and a third-party cookie?

A first-party cookie belongs to the domain shown in the address bar, while a third-party cookie is set by a different domain from the one the user is visiting. Several browsers block third-party cookies by default, while first-party cookies are accepted – but can be time-limited.

Does a first-party cookie require consent?

Yes, if it is used for tracking, statistics or marketing. The consent requirement is tied to the purpose and to access to the user’s device, not to which domain the cookie is set from. Only cookies needed for the service the user has asked for are exempt.

How long does a first-party cookie last?

The expiry time is set when the cookie is created, but the browser can shorten it. Safari limits cookies set from JavaScript to about 7 days, and to as little as 24 hours when the user arrives via a link with tracking parameters from a domain the browser has classified as a tracker.

Do first-party cookies solve affiliate tracking?

They solve blocking, not lifespan or reach. A first-party cookie can follow the user neither between two domains nor between two devices, and it can be cut down to a few days. That is why the referral has to travel in the URL and the window has to be decided on the server.

Read on