Cookies in third-party context
Can a site embedded on another site read and write its cookies?
A cookie is used in third-party context when it belongs to a site other than the one in the address bar, for example in an embedded <iframe>, an image or a script loaded from another site. Third-party cookies let one company recognize the same browser on every site that embeds its content, which is the classic way of cross-site tracking. They also power legitimate features such as embedded sign-in, chat and payment widgets.
Browsers take one of three approaches:
- Allowed: the third party gets the same cookies on every site.
- Partitioned: the third party gets a separate set of cookies on each top-level site, so it can’t link the visits. Sites can opt individual cookies in to partitioning with the
Partitionedattribute ( CHIPSCHIPS Cookies Having Independent Partitioned State. A cookie set with the Partitioned attribute can be used in third-party context, but it is partitioned by the top-level site. Supported by Chrome, Edge, Firefox and Safari 26.2+.). - Blocked: no cookies at all in third-party context.
Where cookies are partitioned or blocked, embedded content can ask for its unpartitioned cookies through the Storage Access APIStorage Access API A web API that lets content embedded in third-party context, such as an <iframe>, ask for access to its unpartitioned cookies, usually after a click and sometimes with a prompt to the user. See Safari for how it works there..
By browser
Brave
Partitioned- Not sent in cross-site subresource requests.
- Partitioned access in frame.
- Partitioned storage is cleared shortly after the user leaves the site (closes all its tabs), or when the browser is closed.
Sources (2) · 2026-10-31
- Cookie Status test, 2026-10-31
- privacytests.org (2026-10-22)
Chrome
No restrictions- Third-party cookies are allowed. Google has dropped its plan to restrict them by default, and retired most other Privacy Sandbox technologies in October 2025. New
- Opt-in mechanism (CHIPS) for partitioning cookies in 3P context.
- Supports the Storage Access API, which matters mostly where third-party cookies are blocked. Chrome 119+ New
- Cookies restricted to a maximum lifetime of 400 days.
Sources (4) · 2026-10-31
Edge
Limited- Access blocked for known trackers, unless the user engages with the tracker’s site or organization.
- Opt-in mechanism (CHIPS) for partitioning cookies in 3P context.
- Supports the Storage Access API, which matters mostly where third-party cookies are blocked. New
- Cookies restricted to a maximum lifetime of 400 days. New
Sources (4) · 2026-10-30
- Tracking prevention in Microsoft Edge
- Cookie Status test, Edge 155
- Cookie Status test, 2026-10-31
- Storage Access API (MDN)
Firefox
Partitioned- Access restricted for known trackers.
- Cookies are partitioned between the site and the third-party. Cookies are not shared across sites.
- Supports the
Partitionedattribute (CHIPS), although third-party cookies are partitioned anyway. Firefox 141+ New - Embedded content can ask for unpartitioned cookies with the Storage Access API. Firefox only prompts once an origin has asked on several sites, and denies requests if the user hasn’t used the site as a first party in the last 30 days. New
Sources (4) · 2026-10-31
- Cookie Status test, 2026-10-31
- privacytests.org (2026-10-22)
- Firefox 141 release notes
- Storage Access API (MDN)
Safari
Blocked- All access restricted, except with Storage Access API. Safari prompts the user for each embedded site, and grants expire after 30 days of browser use without interaction.
- Opt-in mechanism (CHIPS) for partitioning cookies in 3P context. First shipped in Safari 18.4, removed in 18.5, back in 26.2. Safari 26.2+ New
- Temporary compatibility fix: if a site opens a third party in a pop-up and the user interacts with it, the third party gets cookie access when embedded on that site. New
Sources (5) · 2026-10-30
- Cookie Status test, Safari 26
- Cookie Status test, 2026-10-31
- Intelligent Tracking Prevention 2.0 (WebKit blog)
- WebKit Features in Safari 26.2
- Storage Access API (MDN)
History
CHIPS returns in Safari 26.2
Partitioned cookies with the
Partitionedattribute are supported again, after being removed in Safari 18.5 for further work.Google retires most Privacy Sandbox technologies announced
Topics, Protected Audience, Attribution Reporting, Related Website Sets and others are being phased out. CHIPS and FedCM stay.
Firefox 141 supports partitioned cookies (CHIPS)
Third-party cookies can opt in to partitioning with the
Partitionedattribute. Total Cookie Protection already partitions them, so this mainly helps developers write one cookie for all browsers.Chrome keeps third-party cookies announced
Google says Chrome will keep its current approach to third-party cookies and won’t add a separate prompt for users to choose. Third-party cookies stay enabled by default.
Safari 18.4 supports partitioned cookies (CHIPS)
Cookies set with the
Partitionedattribute work in third-party context, kept separate for each top-level site. The feature was removed again in Safari 18.5 (May 2025) and returned in 26.2.Google drops its plan to phase out third-party cookies announced
Instead of removing third-party cookies, Google proposes letting users make a choice in Chrome. The plan was itself dropped in April 2025.
Chrome restricts third-party cookies for 1% of users in trial
A test of “Tracking Protection” blocks third-party cookies by default for a random 1% of Chrome users. The test ended when Google changed course.
Total Cookie Protection on for all Firefox users
Firefox partitions cookies and other storage of every third party by top-level site in its default Standard mode.
Brave announces ephemeral third-party storage announced
Instead of blocking storage in third-party frames, Brave gives each one a temporary partition that is cleared when the user leaves the site. It was turned on by default later in 2021.
Safari blocks all third-party cookies
Safari 13.1 blocks third-party cookies for all domains, not only classified trackers, and caps all script-writable storage at 7 days of browser use without interaction.
New Edge ships with tracking prevention
The Chromium-based Edge 79 is released with tracking prevention set to Balanced by default.
Enhanced Tracking Protection on by default
Firefox 69 blocks third-party cookies of known trackers and cryptominers for all users.
ITP 2.0
Classified domains lose third-party cookie access immediately, unless granted through the Storage Access API or the pop-up compatibility fix.
Intelligent Tracking Prevention 1.0
Safari starts classifying cross-site trackers on the device and restricting their cookies.