What Is a Cookie?
In web technology, a cookie is a lightweight text file that a website instructs your browser to store on your device. The name comes from "magic cookies", a computing term for a packet of data passed between programmes. When you visit a website again, your browser sends the stored cookie back to the server, allowing the site to recognise you and recall your preferences, shopping cart contents or login status without requiring you to start from scratch every time.
Cookies are categorised in two important ways. The first is by origin: a first-party cookie is set by the domain of the website you are visiting, while a third-party cookie is set by a domain different from the one shown in your address bar, typically an embedded ad network, analytics platform or social media widget. The second distinction is by purpose: session cookies expire when you close your browser, while persistent cookies remain on your device for a set duration and are the type used for long-term tracking and retargeting.
From a marketing standpoint, cookies are the foundation of digital advertising as it has existed for two decades. They allow Google Ads and Meta's advertising platforms to track which users visited your website and retarget them with ads on other platforms. They allow analytics tools to attribute conversions to the correct campaigns and measure multi-session journeys. Google Analytics 4 uses first-party cookies by default but also supports measurement in environments where cookies are restricted.
In South Africa, POPIA governs the use of cookies that collect personal information. Tracking cookies that identify individual users or build profiles of their behaviour across sites are considered personal information processing activities and require prior consent. This has prompted many South African businesses to implement cookie consent banners and review which cookies their websites deploy. Failing to obtain consent before setting non-essential cookies is a compliance risk that the Information Regulator can investigate and penalise.
Cookie In Practice
A Pretoria-based e-commerce store selling outdoor equipment places a persistent first-party cookie on every visitor's browser when they view a product. If the visitor leaves without purchasing, the store's Google Ads account reads that cookie signal (through Google's conversion tracking tag) and serves retargeting ads on YouTube, Gmail and across the Google Display Network. The same cookie enables Google Analytics to show the store owner a complete session history, from first visit to eventual purchase, even if the journey spans several days and devices.
When the store also loads Meta Pixel, a third-party cookie associated with Facebook's domain is set. This allows Meta to match the visitor to a Facebook account and serve them retargeted ads on Facebook and Instagram. As browsers restrict third-party cookies, this pixel must increasingly rely on server-side tracking and first-party data matching to maintain effectiveness. Understanding how cookies work helps South African business owners make informed decisions about their tracking setup, consent management and data strategy.
What cookies are used for
A cookie is a small text file a website stores in your browser to remember information between requests or visits. Their legitimate uses are everyday and often essential: keeping you logged in, remembering items in a basket, storing language or display preferences, and letting a site function across pages. Analytics cookies remember whether you are a returning visitor so a site can measure its audience. Advertising cookies, especially third-party ones, were used to track behaviour across sites for targeting, and it is this category that privacy rules and browser changes have curtailed. So cookies are not inherently a privacy problem; the concern centres on the cross-site tracking kind, while first-party functional cookies remain a normal part of how the web works.
Cookies and privacy law
Because some cookies collect personal data or track behaviour, their use is governed by privacy law, which is why consent banners appeared. The general principle across modern privacy regimes is that non-essential cookies, analytics and advertising, require informed consent before being set, while strictly necessary cookies that make a site function do not. In South Africa, processing personal information through cookies falls under privacy law, so sites should explain what cookies they use, obtain consent for non-essential ones, and let users decline. Beyond compliance, the honest approach, clear notice and genuine choice, also builds trust. As third-party cookies decline, the emphasis is shifting towards first-party data collected transparently with consent.
FAQ
Do South African websites need a cookie consent banner?
Under POPIA, South African websites must obtain prior consent before collecting personal information, which includes non-essential cookies used for tracking and advertising purposes. Functional cookies required for the site to operate do not require separate consent, but analytics and marketing cookies do. A clear cookie consent mechanism is best practice and reduces compliance risk significantly.
What is the difference between first-party cookies and third-party cookies?
First-party cookies are set by the website you are visiting and are used for functionality such as keeping you logged in or remembering your cart. Third-party cookies are set by external domains embedded in the page, typically ad networks or analytics platforms, and are used to track behaviour across many different websites for advertising purposes.
Are cookies bad for privacy?
Not inherently. First-party functional cookies that keep you logged in or remember preferences are a normal, useful part of the web. The privacy concern centres on third-party cookies used to track behaviour across many sites, which is the category privacy rules and browsers have restricted.