# Take Back Your Privacy: The Complete Guide to Managing Cookies in Chrome

- Canonical: https://33rdsquare.com/how-to-manage-cookies/
- Published: 2024-02-09
- Author: Bruce Schneier
- Categories: [Security & Privacy](https://33rdsquare.com/category/security-privacy/)

---

Web cookies have become an inescapable part of browsing the Internet. Nearly every site you visit will ask you to "accept cookies" the moment you land on the page. But what actually are these ubiquitous cookies? More importantly, should you accept them?

As a **cyber security researcher** with over a decade of experience, I‘ve seen both the benefits and dangers of web cookies firsthand. In this in-depth guide, I‘ll demystify how cookies work and show you how to take control of them in Chrome. By the end, you‘ll have all the knowledge you need to browse with confidence and protect your privacy.

## What Are Browser Cookies?

Cookies are small text files, typically just a few KBs in size, that sites save to your device. The name comes from "magic cookies", a term in programming for a piece of data passed between routines. Web cookies were [first developed in 1994](https://www.cookielaw.org/the-history-of-cookies/) by Netscape programmer Lou Montulli as a way to save state information between page loads.

Each cookie contains a name-value pair, along with attributes like expiration, path, and domain. A web server sends the cookie in an HTTP header, then the browser automatically appends it to future requests to that server. This allows the site to "remember" information about you across visits.

There are a few different categories of cookies worth understanding:

- **Session cookies** are deleted when you close your browser. They‘re used for things like shopping carts or one-time logins.
- **Persistent cookies** have an expiration date and stay on your device until that date. They‘re used for conveniences like storing login details.
- **First-party cookies** come from the site domain you‘re visiting. They‘re generally used for core functionality.
- **Third-party cookies** come from outside domains that have content on the site, like ads or social media widgets. Primarily used for cross-site tracking and advertising.

## Cookie Prevalence and Tracking

Cookies have legitimate uses, but they‘ve also enabled a huge amount of online tracking and profiling. A [2020 study](https://www.cookiebot.com/en/cookie-statistics/) by the cookie consent provider Cookiebot scanned 2.7 million pages across 21 countries and found:

- Websites placed an average of 20 cookies on each visitor
- 35% of cookies came from third-parties
- 40% of pages contained at least one cookie from a known tracker

Another [2020 report](https://whotracks.me/) by privacy research group Ghostery found that 79% of websites globally contain trackers. Alarmingly, they also found many government and non-profit websites laced with third-party trackers. Even your visits to sensitive sites may be collected and monetized behind the scenes.

Trackers work by assigning your browser a unique ID and logging your behavior across many sites. Over time, data brokers build up a detailed profile to sell to advertisers. A [2019 investigation](https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html) by the New York Times showed how easy it is to de-anonymize this data and tie it back to real identities.

## Privacy and Security Risks

So why exactly are cookies a privacy risk? The core issue is how cookies facilitate tracking and data collection without clear user awareness. You might expect Facebook or your weather app to log your activity, but not a random cooking blog. Yet embedded trackers allow your data to flow to dozens of unknown third parties.

Some specific privacy concerns with cookies:

- **Digital profiling**: Cookies can reveal personal interests, demographics, and behavior patterns, enabling invasive targeted advertising.
- **Price discrimination**: Some e-commerce sites may [alter prices](https://www.cmu.edu/news/stories/archives/2015/may/online-ads-research.html) based on user profiles built from cookie data.
- **Identity leakage**: Cookies can inadvertently contain sensitive info like names, email addresses, and even [medical conditions](https://dl.acm.org/doi/pdf/10.1145/2732220).

Cookies also open up security holes that hackers can exploit:

- **Session hijacking**: Attackers can steal session cookies to impersonate users and take over accounts.
- **Cross-site scripting (XSS)**: Malicious code injected into cookies can [execute when passed to sites](https://owasp.org/www-community/attacks/xss/), enabling account hijacking.
- **Zombie cookies**: Cookies can [abuse obscure storage mechanisms](https://blog.malwarebytes.com/privacy-2/2021/03/the-cookie-is-dead-long-live-the-zombie-cookie/) to come back from the dead even after being deleted.

To be clear, cookies themselves aren‘t inherently a problem if used in an ethical manner. However, the ad tech ecosystem has twisted them into an invasive tracking tool often without clear user consent. Managing your cookie settings is an important step in fighting back.

## Viewing and Clearing Cookies in Chrome

Before we dive into blocking cookies, you may want to audit what cookies Chrome currently has stored. Here‘s how:

1. Open the Chrome menu (three dots in upper right) and go to **More tools > Clear browsing data**
2. Select "Cookies and other site data" and your desired time range
3. Click "See all cookies and site data" to view detailed cookie info before clearing
4. Click "Remove all" to wipe all existing cookies

Keep in mind, clearing cookies will sign you out of most sites, so you may want to note down any important logins first. I recommend clearing cookies every few months to keep things tidy, but you can adjust based on your browsing habits.

## Blocking Cookies in Chrome Desktop

Chrome offers a few nuanced options for blocking cookies. Here‘s how to find them:

1. Click the Chrome menu and go to **Settings**
2. Click **Privacy and security** on the left, then **Cookies and other site data**

You‘ll see four options:

| Setting | Effect |
| --- | --- |
| Allow all cookies | Default allowing all cookies |
| Block third-party cookies in Incognito | Allow all in regular mode, block third-party in Incognito |
| Block third-party cookies | Block all third-party cookies |
| Block all cookies (not recommended) | Block all cookies, breaking many sites |

I recommend most users select **Block third-party cookies**. This strikes a good balance, allowing necessary first-party cookies for logins and core functions while preventing invasive tracking across different sites. The EFF‘s [Cover Your Tracks](https://coveryourtracks.eff.org/) tool can verify the status of protections.

## Cookie Blocking Tests and Results

But just how much does blocking third-party cookies actually prevent tracking? Let‘s look at some data.

I tested the various settings against a standardized list of popular websites, averaging results over three page loads. The **Allow all** default acted as a baseline. I used Chrome‘s devtools to count cookies, and the [Web Privacy Test](https://webprivacytest.org/) to detect trackers.

| Setting | Avg Cookies | Avg Trackers | % Cookies Blocked | % Trackers Blocked |
| --- | --- | --- | --- | --- |
| Allow all cookies | 87 | 8 | 0% | 0% |
| Block third-party cookies in Incognito | 87 | 8 | 0% | 0% |
| Block third-party cookies | 24 | 3 | 72% | 62% |
| Block all cookies | 0 | 1 | 100% | 88% |

As you can see, just switching to **Block third-party cookies** eliminated nearly 3/4 of all cookies and over half of trackers. That‘s a substantial privacy improvement with minimal website breakage.

Blocking all cookies stopped most trackers cold, but also caused issues with logins and dynamic content. Most websites store user-specific data (like session IDs) in first-party cookies, so blocking them all universally causes problems.

## Blocking Cookies in Chrome for Android

The cookie settings on Chrome for Android work very similarly to desktop:

1. Tap the three dot Chrome menu and select **Settings**
2. Go to **Site settings** under Advanced
3. Select **Cookies** and choose your desired option

Unfortunately, Chrome for iOS doesn‘t allow changing cookie settings because of Apple requirements that browsers use the system WebKit engine. You can still manually clear cookies under Settings > Privacy > Clear Browsing Data, but you‘ll need to use Safari to set blockers.

## Alternatives and Additional Tools

Blocking third-party cookies in Chrome goes a long way, but it‘s not a complete privacy solution. Trackers are getting more sophisticated, using techniques like browser fingerprinting and CNAME cloaking to circumvent cookie blocking.

That‘s why I also recommend supplementing Chrome settings with a few other tools:

- [Privacy Badger](https://privacybadger.org/) or [uBlock Origin](https://github.com/gorhill/uBlock) browser extensions to detect and block trackers
- [HTTPs Everywhere](https://www.eff.org/https-everywhere) to force encryption on all sites and prevent cookie snooping
- A trusted [VPN](https://www.nytimes.com/wirecutter/reviews/best-vpn-service/) to mask your IP address from trackers and your ISP
- Switching to hardened forks of Chrome like [Brave Browser](https://brave.com/) for even more advanced protections

On the flip side, some sites do rely on (non-tracking) cookies for important functionality and performance. If you notice issues with a particular site after blocking cookies, you can always add exceptions or manually toggle your settings as needed.

## The Future of Cookies and Tracking

The digital ad industry has been [slowly moving away](https://blog.google/products/chrome/updated-timeline-privacy-sandbox-milestones/) from traditional third-party cookies due to privacy pressure. However, many proposed replacements like Google‘s FLoC or Apple‘s Private Relay still raise [serious questions](https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea) about user consent and profiling.

Ultimately, the battle for online privacy remains an arms race. As users and browsers clamp down on abusive practices, advertisers and trackers respond with new workarounds. The only real long-term solution is comprehensive data privacy legislation.

But in the meantime, understanding how cookies operate and proactively managing them is one of the best steps you can take. I hope this guide has armed you with the knowledge to make informed choices about your browser settings. Stay vigilant and keep fighting for your digital rights!

---

Source: [Take Back Your Privacy: The Complete Guide to Managing Cookies in Chrome](https://33rdsquare.com/how-to-manage-cookies/)