Skip to content

Cookies

| Article: 3 min read | Privacy and law

Cookies are small pieces of data that a site stores on a visitor's device through the browser and gets back with later requests. They let a site "remember" the cart, the language or a login, and they are also used for analytics and advertising.

This is not legal advice: below is what the sources say, with links.

How it works in plain words

The server sends the browser a `Set-Cookie` header, the browser stores the value and adds it to every following request to that server. HTTP by itself does not "remember" earlier requests, so cookies are what make it possible to keep a cart or a login session (MDN).

The MDN documentation names three main jobs for cookies: session management (login, cart), personalization (language, theme) and tracking user behavior.

Types of cookies

By lifetime:

  • Session cookies have no expiry date; the browser deletes them when it considers the session over.
  • Persistent cookies have `Expires` or `Max-Age` and live until the given time.

By who sets them:

  • First-party cookies are set by the site you opened: for example, your store remembers the cart.
  • Third-party cookies are set by embedded content from someone else (a widget, an ad pixel) and work in cross-site requests. These are the ones that make it possible to follow a person across different sites (MDN). More: third-party cookies.

By purpose (this is how banners usually group them; the law has no such division):

  • Necessary: cart, login, security, remembering the choice made in the banner.
  • Statistics (analytics): how many people came and what they did.
  • Advertising: retargeting, ad measurement.

Why an online store needs cookies

  • the cart is not lost while a person picks products and moves on to checkout;
  • the customer stays logged in, and language and currency are remembered;
  • analytics shows where customers came from and where they leave the site;
  • ads can measure results and show ads to people who looked at a product (this already requires consent if you work with visitors from the EU, see the cookie banner).

What to know about the rules

  • For visitors in the EU, Article 5(3) of Directive 2002/58/EC allows storing information on a device or reading it only with the consent of a person who has received clear and complete information, including about the purposes. Exceptions: technical storage solely for transmitting a message, and what is "strictly necessary" for a service the person explicitly requested (Directive 2002/58/EC).
  • The rule is not only about cookies. In Guidelines 2/2023 (version of October 7, 2024) the EDPB explains that it covers other technologies too: tracking pixels, unique identifiers, local processing on the device. The word "information" is broader than "personal data" (EDPB, Guidelines 2/2023).
  • Cookies are not always personal data, but if they can identify a person, the GDPR applies too. For Ukraine: personal data in Ukraine.

Common mistakes

  • assuming "technical" cookies means everything my plugin sets: analytics, an ad pixel and a chat widget are not necessary just because the business needs them. Regulators directly check whether cookies are correctly classed as "necessary" (EDPB, Cookie Banner Taskforce report, 2023);
  • not knowing which cookies the site actually sets: look at the Application tab in the browser's DevTools or use the scanner in a consent management system;
  • forgetting other technologies (localStorage, tracking pixel images).

FAQ

What are cookies in plain words? Text marks that a site leaves in the browser so it can recognize you on the next request.

Does an online store need cookies? For the cart and login, yes. For analytics and advertising there is no technical need, but the business needs them, so visitors from the EU must consent to them.

How do first-party cookies differ from third-party ones? First-party cookies are set by your site, third-party ones by someone else's embedded content, and they can follow a person across different sites.

Are cookies dangerous? By themselves they only store values. The risk is in how they are used for tracking, and in session security (the `Secure` and `HttpOnly` flags exist for that, MDN).

Sources

Share

Related

  • Selling abroad from Ukraine: logistics, duties, payments

    | Article: 4 min read

    Cross-border e-commerce is selling goods to buyers in another country through your own site or a marketplace. For a Ukrainian store this means three separate tasks: getting the goods across the border, handling the duties and taxes of the buyer's country…

  • Personal data in Ukraine

    | Article: 4 min read

    Personal data in Ukrainian law is information or a set of information about an individual who is identified or can be specifically identified. Its processing is regulated by the Law of Ukraine "On Personal Data Protection" of June 1, 2010, No. 2297-VI. A new…

  • Returning goods to an online store

    | Article: 5 min read

    A product return is the process in which a shopper gives a purchased item back to the seller and receives money or an exchange. In Ukraine, the shopper's rights are defined by the Law "On Consumer Rights Protection," and the rules for returning an online…

  • PRRO and fiscalization for an online store

    | Article: 4 min read

    A PRRO (software cash register, "програмний реєстратор розрахункових операцій") is a program registered on the tax authority's fiscal server, through which the seller carries out a payment and creates a settlement document (a fiscal receipt) (Law No.…