What is Cookie Context?

Web browsers supporting an advanced form of cookie management, notice and record the "context" in which cookies are received. They note whether cookies are received from first-party or third-party servers — In other words, from the server of a page the user is deliberately visiting, or from the server of some other site referred to by that page. These extra-aware browsers can be configured to enforce additional privacy by not returning a cookie during a third-party query that was originally received during a first-party reply.

For example, if you were within the Yahoo domain (yahoo.com) and using any of Yahoo's many services with first-party cookies enabled, your browser would be receiving and returning Yahoo's cookie(s) in “first-party context” because you are deliberately visiting and using Yahoo. This is normal, useful, and even necessary if you would like to take advantage of Yahoo's many features where you “logon” through your browser and need to be known to Yahoo as you move from page to page and from visit to visit.

But if you were then to visit the eBay online auction site, where a Yahoo-provided advertisement is present, a normal first-party cookie exchange would occur with eBay in a first-party context, because that's the site (and domain) you are visiting. But any cookie exchange with Yahoo's servers would occur in a “third-party context” because you are at eBay now, not at Yahoo.

The problem is, your web browser is carrying a Yahoo domain cookie, and Yahoo knows all about you due to your deliberate and intentional relationship with them. But do you want Yahoo to also know every time you visit eBay (and all other sites where Yahoo provides advertisements or other page assets) and also what you searched for on eBay?

Even when web browsers are configured not to accept (new) third-party cookies, they will still send any cookies that they may have already acquired.

As a result, returning to our example above, a browser that was not aware of the context in which it originally received Yahoo's first-party cookie might subsequently leak that cookie — which was received in a trusted first-party context — when its user subsequently visited eBay (or any other site) where Yahoo provided a page asset in a third-party context  . . . which is not what most privacy-conscious user would want.

Testing your browser's cookie-receipt context management only makes sense if your web browser is currently configured to accept updates to, and return, first-party cookies while successfully blocking, or at least not accepting, updates to third-party cookies.

• First verify this with the help of our Cookie Forensics page: As you successively reload the page verify that either no third-party cookies are being returned, or that if they are, their age as shown in the "Cookie's age" field is steadily increasing. If you are seeing third-party cookies you may wish to make a note of its/their age since we are about to offer your browser these third-party cookies in a first-party context, which would reset their age to zero, making them young again.
• Once you have confirmed that your browser is configured to block — or at least not update — third-party cookies, you can test your browser's cookie receipt context awareness and management by clicking the link below. The link will take your browser to GRC's third-party server (“www.grctech.com”). But since it is going directly to that server, rather than having page assets supplied by that server behind the scenes, this will be a first-party visit!

  Being a deliberate first-party visit, your web browser will accept the first-party cookie offered to it by the www.grctech.com server. The question is, when you then return to the regular www.grc.com forensics page, will that cookie that was just received (or perhaps updated) in a first-party context now be offered by your web browser in its regular third-party context? Let's find out!

  Test Cookie Context Management
• The question then, is whether these cookies, which were received in a "first-party context", will subsequently be exchanged by your web browser once it has returned to the main "www.grc.com" server and those cookies become third-parties to GRC.
• After returning to GRC's Cookie Forensics page, reload the forensics page again to see whether the third-party "www.grctech.com" cookie(s) have been created and/or were updated by the visit to "www.grctech.com" as a first-party. If not, your browser is preventing "cross party context cookie leakage", which further enhances your privacy against Internet tracking.