First-party cookie

Updated 2026-11-02

Definition

A first-party cookie is a small piece of data stored in the browser by the site a person is visiting. It's tied to that site's domain. Sites use them to keep you signed in, remember settings, and recognize a returning browser.

A third-party cookie is set by a different domain, usually to follow people across sites. Many browsers block those by default. First-party cookies are treated far better, though browsers still put limits on them.

Example

This example uses made-up numbers. A visitor reaches example.com on March 1 from a Google search. Your analytics script sets a first-party cookie with an ID. They come back through an email on March 20, and the cookie is still there, so both visits belong to the same visitor.

On April 10, they sign up on app.example.com and pay $300. If the cookie was set on example.com, the app can read it too, and the $300 can be linked to both earlier visits. If it was set only on www.example.com, the app can't read it, and the visit history breaks.

Browser limits

Safari limits cookies set by JavaScript, capping them at seven days in many cases. Cookies set by a server response can last longer. Chrome caps any cookie at 400 days. Users can clear cookies at any time, and doing so makes them a new visitor.

How Headstream measures it

Headstream's script sets a first-party cookie named hs_vid, lasting up to 400 days. It writes the cookie on the shortest domain the browser accepts, which keeps a visitor's ID the same across subdomains. It also keeps a copy in local storage.

To get around Safari's script limit, you can route tracking through your own domain. The server then sets the cookie itself. See install the script for the steps. The script also detects when neither store works and falls back to an ID derived from the request.