First-party vs third-party trackers

Every tracker on your site is either first-party or third-party, and the difference is not just technical detail. It shapes how browsers treat the tracker, what consent rules apply, and how much risk it carries. This post explains the distinction, how the SameSite attribute ties in, and why the line between the two is blurrier than it looks.

The core distinction

A first-party tracker is set by the domain the visitor is on. A third-party tracker is set by a different domain, usually through embedded content like ads, analytics, or social widgets. The browser decides which is which by comparing the cookie's domain to the site in the address bar.

Where SameSite fits in

The SameSite attribute tells the browser when a cookie may be sent. It controls whether a cookie may be sent in same-site or cross-site request contexts; it does not by itself determine who the first or third party is.

Set-Cookie: session=abc; SameSite=Strict // only first-party, same-site
Set-Cookie: ad=xyz; SameSite=None; Secure // cross-site allowed, HTTPS only
Set-Cookie: pref=1; SameSite=Lax // first-party + safe top-level nav (browser default)

• Strict: sent only in first-party, same-site contexts.
• Lax: first-party plus safe top-level navigations; the modern browser default.
• None: allows cross-site sending, but requires the Secure attribute so it only works over HTTPS.

Why the line is blurry

The distinction is muddied by server-side tracking and first-party proxying, where a third-party service routes its data through your own domain so the tracker looks first-party to the browser. That can dodge third-party restrictions, but it does not change the underlying purpose or the consent obligations. A cross-context advertising tracker routed through your domain is still cross-context advertising, and the law looks at the activity, not just the domain.

Why it matters for consent

• Third-party trackers are the primary target of browser restrictions and phase-outs, so they carry the most operational risk.
• Consent gates apply to both, based on whether the tracker is necessary, not on which party sets it.
• Your tracker inventory should record the party for each entry, because it affects how you categorize and enforce it.

First-party and third-party describe where a tracker comes from, and browsers treat them differently. But for consent, the real question is whether the tracker is necessary for what the visitor came to do. Classify by purpose, record the party, and let the consent category decide what loads.

Materially reviewed July 11, 2026. Regulatory and implementation guidance is general information, not legal advice.