You have done it a thousand times. A box slides up — “We value your privacy” — and before you have read a single word, your thumb is already on the biggest button. Accept all. Continue. Fine. The page you actually came for is right there.
It is a strange ritual. Nobody enjoys the banners, nobody reads them, and almost everybody clicks the same button. So it is worth asking what that button actually agrees to. Because it is more than “remember my preferences,” and the answer is a little less sinister — and a little more complicated — than most people assume.
There are two kinds of cookies, and only one of them follows you around
A cookie is just a small note a website leaves in your browser: a few bytes of text saying “this visitor did X.” The useful kind is the one the site itself leaves. Google’s own help documentation puts it plainly — first-party cookies are created by the site shown in the address bar, and they do the boring jobs you actually want: keeping you signed in, remembering your language, saving what is in your shopping basket.
Then there is the other kind. Third-party cookies are created by other sites — the ones whose content is embedded in the page you are reading: an advertiser’s image, an analytics script, a social media button. Because that third party’s content appears on hundreds of different sites, its cookie can recognise your browser on all of them. That is how looking at a pair of shoes once can make those shoes follow you around the internet for a week. It is not a hack and it is not magic; it is the intended function of the cookie.
This distinction is the whole story, really. The banner is never about the site’s own cookies. It is about permission to let the other ones in.
Why the banner exists in the first place
Websites did not start asking out of courtesy. European privacy law decided that dropping tracking notes on someone’s device requires their consent first — the GDPR from May 2018, layered on top of the older ePrivacy rules, and in the UK the Privacy and Electronic Communications Regulations plus UK GDPR. Similar consent rules have since spread well beyond Europe, which is why you see banners even on sites with no European connection.
The rules are stricter than most banners suggest. Under the UK’s version, a site is supposed to get your consent before non-essential cookies are set — not after, not “by continuing to browse.” The UK regulator, the ICO, also insists that saying no must be as easy as saying yes: a banner that glows the Accept button and buries Reject in a grey text link is not compliant. The ICO’s deputy commissioner put it bluntly in 2023: a cookie banner with no “reject all” option is “breaking the law.”
One honest carve-out: strictly necessary cookies — the ones that keep the site running, like your login session or the shopping basket — do not need consent. Nobody is asking your permission to remember that you are logged in. The banner is entirely about the optional extras.
What “Accept all” actually hands over
When you hit Accept all, you are agreeing to both kinds of cookies at once: the site’s own and the trackers embedded in it. In practice, that usually means advertising and analytics companies can place their cookies and recognise your browser across every site that carries their code. That recognition is what builds the profile — rough interests, rough habits, a rough sense of who you are — that decides which ads you see.
A few things worth knowing, because they are not obvious:
- The banner is per site, not per internet. Every “accept” only covers the trackers on that particular website. Clicking it on fifty sites is fifty separate permissions, which is why the banners never stop coming.
- Accepting does not mean your name is known. Most cookie tracking is pseudonymous — a random ID in a database, not your name. That is thinner comfort than it sounds, because the profile is still detailed enough to aim ads at.
- Rejecting rarely breaks the site. The law requires that strictly necessary functions work without consent. If a site refuses to load until you accept tracking, that is a dark pattern, not a technical necessity — and in the UK, it is not how the rules are supposed to work.
One more thing: accepting is not a marriage. The banners are required to let you change your mind, and every banner has a settings or preferences option where you can withdraw consent later. Few people ever go back to do it, but the option is there.
Why the banner looks different depending on your browser
Here is a detail most people miss: the cookie banner is not the only layer deciding this. Your browser has opinions too, and they differ.
Safari and Firefox block third-party cookies by default — they decided years ago that cross-site tracking was not their problem to solve per-banner. Chrome took the other road. Google spent years planning to phase third-party cookies out of Chrome, reversed course in April 2025, and later that year began retiring the replacement advertising technologies it had built instead. The current position is simple: Chrome keeps third-party cookies, and the choice is yours to manage in Settings > Privacy and security > Third-party cookies. Chrome does draw one line on its own: in Incognito mode, third-party cookies are blocked by default.
So the banner matters most in Chrome, and matters least in Safari — not because the rules differ, but because the browser is already doing part of the job.
A practical way to answer banners without overthinking it
You do not need to read every banner like a contract. A simple default works for almost everyone:
Reject by default, accept where you have a reason. On a site you visit daily — your webmail, your bank, a news site you subscribe to — accepting costs little and occasionally makes the site work more smoothly. On the random blog you found through a search result and will never see again, hit Reject all and move on. When a banner only offers “Accept” with no visible reject, look for “Settings,” “Preferences,” or “Manage options” — the reject is usually one level down.
And once in a while, look at what is actually stored. In Chrome, Settings > Privacy and security > Third-party cookies > See all site data and permissions shows every site holding data in your browser, and you can delete any of them individually. It is a strangely satisfying audit — most people find dozens of sites they have not visited in months still sitting there. (Google does warn that if you block everything, some sites will misbehave — which is why the reject-by-default approach works better than the nuclear one.)
If you want to go one step further, our guide to keeping work and personal browsing apart shows how separate browser profiles stop tracking from linking your activities together — a different profile for shopping or social accounts quietly cuts the trail that third-party cookies were following.
The banner is annoying, but it is also one of the rare moments the web asks your permission for something and waits for an answer. You might as well answer on purpose.
Comments 2