Post #1527733
2026-04-15 01:24 UTC
@grigs I see. That's pretty sneaky, I'm a bit surprised it's permitted (even has a platform API - document.cookie) but once it sets a first party cookie, it could not be read by by the script origin that used document.cookie, if I understand correctly (not a given). Maybe that's where inter-origin data sharing comes in, on the server. Anyway, thanks for the link!
@AmeliaBR
Replies (1)
-
@AmeliaBR@front-end.social 2026-04-15 04:43
@prushforth @grigs On their own, these 1st party cookies can't really track you like 3rd party cookies do: the analytics/ad/social-media server doesn't get the same cookie for each site you visit with their script, they get a different one for each domain. In theory, that means they can only track your activity on that site. However, that's where fingerprinting comes in. A script can poke around in your browser settings, add your IP address, and pull together enough to match you across sites.