Become an affiliateStart your program

Technology and tracking

Third-party cookie

Also called third-party cookie, 3rd party cookie.

Short answer

A third-party cookie is a cookie set by a domain other than the one the user is visiting – for example a tracking domain embedded on a store page. Safari blocks them entirely and Firefox isolates them per site, so for cross-site tracking they are effectively useless.

Definition of Third-party cookie.

The distinction between first and third party is about the domain, not the cookie's content. If the user visits shop.example, cookies from shop.example are first party, while cookies set by an embedded script from tracking.example are third party. The same cookie can therefore be first party on one site and third party on another – what decides it is what is in the address bar.

In classic affiliate tracking, the network set a third-party cookie at the click and read it again when the network's pixel loaded on the store's receipt page – a read across 2 domains. That model has broken down: Safari has fully blocked third-party cookies since March 2020 (ITP), and since June 2022 Firefox has isolated them per site with Total Cookie Protection, so they cannot follow the user between domains.

In July 2024 Chrome cancelled its announced phase-out and keeps third-party cookies – but blocks them in incognito. The consequence for affiliate marketing is nonetheless clear: tracking that depends on third-party cookies loses Safari and Firefox users, and robust setups instead move the click ID onto the store's own domain or report the sale server-to-server.

Third-party cookie vs. first-party cookie

AspectThird-party cookieFirst-party cookie
Set bya foreign domain embedded on the pagethe domain the user is visiting
Can follow the user across sitesyes – that was the purposeno, it is only read on its own domain
Browser status 2026blocked in Safari, isolated in Firefox, allowed in Chromeaccepted by all browsers
Role in affiliate marketing todaythe historical network cookie, effectively phased outcarries the click ID on the store's domain

All robust affiliate tracking today rests on first-party storage – the third-party cookie is the model the industry has left behind.

How it goes wrong

  • 01

    You only test in Chrome

    Chrome still allows third-party cookies, so a setup can appear to work and still lose every sale from Safari and Firefox users. Always test tracking in Safari – that is where the oldest model breaks first.

  • 02

    First party mistaken for consent-free

    Cookie rules do not distinguish between first and third party: if the purpose requires consent, that applies to both. That a cookie is first party says something about the domain – not about the law.

  • 03

    Tracking without a fallback

    A setup that only has the network's own cookie records clicks but loses the link at the purchase in Safari and Firefox. A click ID in the URL plus storage on the store's domain must be the main route – not the emergency fix.

At Affilyflow

Third-party cookie in practice

Affilyflow's tracking does not depend on third-party cookies. The click ID travels with the user in the URL (the afid parameter) onto the store's domain and is stored there as first-party storage, and attribution is decided on our server based on the click ID the conversion carries – not on what the browser allows in cross-site cookies.

We deliberately do not try to patch the gap with fingerprinting or cross-device tracking. If a sale cannot be traced to a click, it is not credited – that is the principle behind the numbers.

Frequently asked questions

Are third-party cookies dead?

For cross-site tracking, yes in practice. Safari has blocked them entirely since 2020, Firefox has isolated them per site since 2022, and although Chrome dropped its announced phase-out in 2024 and still allows them, serious tracking cannot rely on a technique that 2 major browsers have shut down.

What does the blocking of third-party cookies mean for affiliate tracking?

The classic model, where the network set a cookie on its own domain and read it again on the store's receipt page, no longer works in Safari and Firefox. Modern tracking therefore moves the click ID onto the store's own domain as first party, or reports the sale server-to-server.

What is the difference between first-party and third-party cookies?

The domain that sets the cookie, relative to the domain in the address bar. Cookies from the site the user is visiting are first party; cookies set by embedded scripts from other domains are third party. The same cookie can be one on one site and the other on another.

Does Affilyflow use third-party cookies?

No. The click ID is sent in the URL to the store's domain and stored there as first-party storage, and attribution is decided on Affilyflow's server based on the click ID the conversion carries. Tracking therefore does not depend on whether the browser allows cookies across sites.

Read on