What Are Third-Party Cookies?

A cookie is called “third-party” when it is set by a domain different from the website a visitor is actually looking at. When you embed a YouTube video, the iframe can cause Google’s domains to set cookies in the visitor’s browser, even though the visitor believes they are simply on your site.

Why browsers restrict them

Third-party cookies are commonly used for cross-site tracking and advertising, which is why modern browsers increasingly block or limit them by default, and why regulations such as the GDPR pay close attention to how and when they are set.

Reducing third-party cookie exposure

Using the youtube-nocookie.com embed domain, deferring embeds until after consent, or using a lightweight thumbnail-then-load pattern (only inserting the real iframe after a visitor clicks) are the three most common mitigations.

How third-party cookies actually get set through an embed

When your page includes a YouTube iframe, the visitor’s browser makes a request directly to Google’s servers to load that iframe’s content, entirely separate from the request that loaded your own page. Because that second request goes to a different domain than the one in the browser’s address bar, any cookie it sets counts as third-party. This is a structural consequence of how iframes work, not something a site owner can prevent through their own page’s code alone; it can only be influenced by which embed domain and settings are used.

A practical example

Imagine a visitor on yoursite.com with an embedded YouTube video. Loading the standard youtube.com embed can set a cookie readable by google.com the next time that visitor’s browser visits any site with a Google service embedded, contributing to cross-site ad tracking. Loading the same video from youtube-nocookie.com defers that cookie-setting until the visitor actually presses play, meaningfully narrowing the window during which passive tracking can occur.

Third-party cookies vs. first-party cookies

A first-party cookie is set by the domain shown in the address bar, your own site, typically for things like remembering a shopping cart or login session, and is generally viewed as lower-risk since the connection to the visible site is obvious. A third-party cookie, set by an embedded resource like YouTube, is less visible to the visitor and is the category most privacy regulation and modern browser restrictions specifically target. Browsers including Safari and Firefox now block many third-party cookies by default, which is gradually reducing this category’s reach independent of any site-level choices. See youtube-nocookie.com for the specific mitigation this site’s tools default to.

Understanding this distinction helps explain why a site can look identical on the surface, same video, same player, yet behave very differently from a privacy standpoint depending purely on which embed domain was used.

Frequently asked questions