What does “accept cookies” mean?
Clicking “Accept all” lets the site set every kind of cookie it listed, not just the ones it needs to work. The extras mostly count your visit and let advertising companies recognize your browser from site to site. The cookies that keep you logged in or hold your cart run either way. Rejecting blocks the extras, and the site should still work.
What a cookie is
A cookie is a small file a website asks your browser to save so it can recognize you when you come back. Some disappear when you close the browser. Others stay for months or years.
Cookies set by the site you’re on are first-party cookies. Cookies set by somebody else, like an ad network built into the page, are third-party cookies, and those are the ones that can follow you across the web.
The four kinds on a cookie banner
Most banners sort cookies into the same four piles. The UK’s privacy regulator says only the first pile can skip your permission. Analytics and advertising cookies always need it. Try the decoder below to see what each choice turns on.
Here’s a typical cookie banner. Flip the switches or press a button, and it tells you what that choice actually turns on.
This site uses cookies
We use cookies to make the site work, understand how it’s used and show you relevant ads.
- Strictly necessaryAlways on
- Functional
- Analytics
- Advertising
What your choice turns on
Only what the site needs to work. Nobody is counting your visit or following you to the next site.
Strictly necessary · On
Keeps you logged in, remembers what’s in your cart and keeps the site secure. These run whatever you pick, and they don’t need your permission.
Functional · Off
Remembers your settings, like language or region, and runs extras like a chat window.
Analytics · Off
Counts your visit and records how you move through the site, so the owner can see what gets used.
Advertising · Off
Lets ad companies recognize your browser on other sites, build a picture of what you’re into and show you ads based on it. These are the ones that follow you around.
Do you have to accept?
In the EU and UK: no
Sites need your consent before setting anything beyond strictly necessary cookies. European regulators say rejecting has to be as easy as accepting: a “Reject all” button right next to “Accept all,” not buried in a menu. France’s regulator has ordered dozens of companies to fix banners that made saying no harder.
In the US: there’s mostly no banner rule
No federal law requires a cookie banner at all. What several states give you instead is the right to opt out of a company selling or sharing your data, and California and Colorado make companies honor an automatic opt-out signal from your browser.
The signal your browser can send for you
Global Privacy Control is a setting that tells every site you visit you don’t want your data sold or shared. Brave has it built in, DuckDuckGo’s browser sends it by default, and Firefox has it in its settings. Chrome and Safari don’t have it built in, so you need an extension, like the Electronic Frontier Foundation’s Privacy Badger.
It has teeth where the law backs it. In 2022 California’s attorney general settled with Sephora for $1.2 million, in part for ignoring that signal.
What your browser already blocks
Safari
Blocks third-party cookies by default.
Firefox
Blocks known tracking cookies by default and keeps each site’s cookies in a separate jar, so they can’t follow you from one site to the next.
Chrome
Still allows third-party cookies by default. Google spent years planning to phase them out, then decided in 2025 not to. You can block them yourself in Chrome’s privacy settings.
Questions people ask
Should I accept cookies?
Nothing says you should. Accepting mostly helps the site measure visits and helps advertisers recognize you elsewhere. Rejecting keeps the site working, because the cookies it needs to run are on either way. If you’d like less tracking, reject.
What happens if I reject cookies?
The site keeps working. Logins, carts and security cookies still run. What stops is the optional layer: visit counting, some personalization, and ads based on your browsing.
Are cookies bad?
Not by themselves. The ones that keep you logged in are useful. The ones worth thinking about are third-party advertising cookies, because they let companies you never visited piece together what you do online.
Do I have to accept cookies to use a website?
In the EU and UK, no: rejecting has to be as easy as accepting. In the US there’s no banner rule, so some sites just set cookies. You can still block third-party cookies in your browser and turn on Global Privacy Control.
Where this comes from
- ICO: Cookies and similar technologies (UK regulator guidance)
- EDPB Cookie Banner Taskforce report, January 2023
- CNIL: Refusing cookies should be as easy as accepting them
- Global Privacy Control
- Sephora settles with California’s attorney general for $1.2M (Faegre Drinker)
- Global Privacy Control requirements by state (Foster Garvey)
- WebKit: full third-party cookie blocking in Safari
- Mozilla: Total Cookie Protection on by default in Firefox
- Chrome keeps third-party cookies after all (Digiday)
The course goes further
Module 5 of the course, “Cookies: what the banner is really asking,” covers this in full.
Your Data Rights is a plain-English course on what companies collect about you, what they’re allowed to do with it, and what you can do back. The app is waiting on store review.