This question already has an answer here:

Cookies are just a simple text file or DB (some parts encrypted). There is no way to execute them and they cannot access other user data store.

Normally cookies keep some data like session ID or hash of your credential and domain who you visited.

But could it be true that they can be used to show ads or even trigger popup ads?

Advertisers can use cookies to track what popup has been viewed by the user before and whether the ad is being distributed to them.

Is it possible for cookies to be used for user tracking and targeted advertising?

Should we be concerned about privacy violation by cookies?

marked as duplicate by Conor Mancone, ThoriumBR, Steffen Ullrich, Rory Alsop Aug 31 '18 at 7:38

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    to be sure, web devs can browser fingerprint and store would-be-cookie data server-side, it's just easier to use what's there already... – dandavis Aug 30 '18 at 18:41
  • 1
    Not sure why this was down voted with no recommendation to change..... It's a fair question. – SomeGuy Aug 30 '18 at 18:55
  • 2
    @SomeGuy one of the reasons for downvoting is "lack of research effort" in which case, there is nothing to improve – schroeder Aug 30 '18 at 19:06
  • @dandavis I am not sure what you are saying. you meant that they can have more intelligent on server-side and they do not need client-side data? – R1- Aug 30 '18 at 19:22
  • 1
    exactly; store the cookie data server-side, keyed by unique client fingerprint, send it with the page or scripts. – dandavis Aug 30 '18 at 19:34

Cookies are just there to keep some state between different HTTP requests to the same web site. This kind of state can be used for various things: keeping user preferences, keeping a user authenticated after login - but also to track user at the costs of his privacy. In other words, some use cases are considered important and valid and others are often considered bad.

Just because the bad use cases are possible cookies should not be banned. First, it does not solve the tracking problem since there are enough other ways to track users (like by using user-specific resources cached in the browser). It only makes the desirable use cases for cookies harder to implement.

To tackle the privacy problem technical solutions can only provide a half-baked solution, the real solution must come from the society. If privacy is considered a worthwhile goal then laws can be passed which will prohibit activities which are considered too privacy-invasive, no matter if they are done with cookies, browser-fingerprinting or whatever technology comes up next.

Still, some technical solutions are possible and are also implemented in some browsers or extensions, like blocking most cross-site cookies. These solutions will probably work as long as the majority of users does not use them. If these techniques are too much in use another tracking technology will be used - as long as tracking is still considered legal.

  • I am looking at my google chrome cookie database and all the text except domain name are encrypted, is it good and makes it safer or is it bad because I cannot read it and find out what is happening? maybe tracking are legal but they are against privacy. – R1- Aug 30 '18 at 17:24
  • 3
    Generally, best practice for cookie usage isn't even to make them encrypted, but to have them be meaningless tokens that look up data in some third party system. This is both good and bad, like most technology tradeoffs. – Phoshi Aug 30 '18 at 17:30
  • 1
    @R1-: please keep the discussion here on a technical level and move discussions about who is making a law etc to the appropriate sites like Law and Skeptics. As for plain vs. encrypted vs. random cookies - plain cookies are usually only used to store client site settings. Session cookies transport authentication information or are associated with these and should be therefore protected against manipulation (to make sure one user cannot impersonate as another one just by manipulating the cookie value) - which often involves encryption too. – Steffen Ullrich Aug 30 '18 at 17:56
  • 1
    @R1-: "maybe tracking are legal but they are against privacy." - there is no perfect privacy - the society together and not each individual by its own decides what is a necessary and what is an acceptable amount of privacy and thus how much tracking is allowed and how much might even be useful. These are mainly non-technical decisions (although partly driven by technical possibilities) and might differ between cultures and between times. Moral discussion on what the right amount of privacy is are off-topic here and maybe more on-topic on Philosophy. – Steffen Ullrich Aug 30 '18 at 18:05
  • Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Aug 30 '18 at 21:47

Is it possible for cookies to be used for user tracking and targeted advertising?

Yes. If a page contains a "Share on Facebook" button it is often loaded from Facebook. A little piece of JavaScript and the image for the button are requested from facebook.com. Your current cookies are sent along in the request. Facebook now knows which page you visited and uses this for targeted advertising.

One thing you can do is to disable third-party cookies. This is an option in the browser to only sent cookies of the curren top-level domain. Unless you are on an actual facebook.com page, your facebook.com cookies won't be sent when retrieving the share button.

  • The cookie is just added to the header of the request with the content the cookie contains, so how does the cookie sent to facebook from a third party site reveal what page did I visit? – BornToCode Apr 30 at 7:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.