Have you ever stopped by a website when it asks you for cookies and wondered what the options really mean? Ever thought what they do, and why are they suddenly so consensual? You’re not alone. Most people don’t care. But if you’re a proponent for digital privacy and curious about the laws surrounding it, keep reading.

So, what are cookies? And why do they matter? In simple terms, cookies are simply text files that store your information for future use. The problem lies in what they store, or more accurately, what you allow them to store. Cookies are mainly responsible for three things – session management, personalization, and tracking. Let’s talk about each one by one.

Ever thought about how a website remembers the account you signed in with, the light/dark mode preferences you had the last time you visited, or even just the items in your shopping cart before logging in? That’s called session management. When you log onto a website, a new session object is created, which contains your activities on the website. To tag this unique session, the server creates a new session ID. Now, upon coming back to the website, this ID is used to lookup the session object that contains your data. That data is retrieved to show your past activity on the website.

Tracking refers to using cookies to track user activites and learning their preferences overtime. Personalization is essentially using the data gathered from tracking to provide personalized advertising during marketing campaigns. Google Ads is the largest contributor to its Google’s revenue. According to the 2023 report, out of the $307B in revenue, $237B, came from ads. If you’ve heard, Google is often held in scrutiny because of the lack of transparency on how it targets these ads. It collects a vast amount of user data through its various services, including Google Search, Gmail, and YouTube. Google also places cookies on its partner websites to collect data and track user activities.

However, what suddenly caused all these websites to ask for consent before tracking? The answer – GDPR. The General Data Protection Regulation (GDPR) is an organization located in the European Union that regulates information privacy in the continent. It has introduced requirements for obtaining consent for cookies on websites. Specifically, the GDPR mandates that consent for cookies must be “freely given, specific, informed, and unambiguous.” This means that users should be able to easily consent or refuse to be tracked when it comes to cookies on websites. To provide context of not complying with their regulations, Google was fined $57M over GDPR violations in 2019.

What’s in it for you? Well, awareness. Just know what those banners on websites mean. If you value privacy, only allow the necessary ones required to keep track of your preferences on the website and switch everything off. So that you don’t have to login every time you reload the page. :)