First-party cookies: what they are and why your measurement depends on them

What are first-party cookies, and why does my ad measurement depend on them?

Most of what an ad platform knows about who bought after clicking its ad comes from a handful of small cookies. When they disappear, sales stop being connected to the ads that produced them, platforms optimize on less, and your reports drift away from your store. Understanding which cookies matter, and why browsers treat them differently, is the first step to protecting measurement without collecting anything you should not.

First-party and third-party, in one example

You are on yourstore.com. A cookie set for yourstore.com is first-party: it belongs to the site in the address bar. A cookie set for adserver.example, whose script or image is loaded on the page, is third-party. The distinction is about the domain the cookie belongs to, not about who wrote the code that set it.

That last point matters: the measurement cookies ad platforms use today are mostly first-party. When a visitor arrives from an ad, the platform's script on your page stores the click identifier in a cookie on your own domain, and reads it back when the purchase happens.

What browsers restrict

Safari limits cookies created by JavaScript. Under WebKit's ITP 2.1, persistent cookies created through document.cookie are capped at seven days, and only those are affected: cookies set by a server in an HTTP response are not. Under ITP 2.2, the cap drops to one day when the visitor was sent by a domain classified as having cross-site tracking capabilities to a URL with a query string or fragment, which is exactly what an ad click with a click ID looks like.

Chrome was expected to phase out third-party cookies for years. On April 22, 2025, Google announced that it would keep its current approach to third-party cookie choice and would not roll out a new standalone prompt, while Incognito mode keeps blocking them by default.

Ad blockers and privacy browsers block known tracking scripts and domains outright. If the script never loads, no cookie is set, first-party or not.

Why it breaks attribution

• Longer purchase cycles lose their start. A visitor who clicks an ad on Monday and buys twelve days later on Safari may have lost the click cookie in between, so the sale looks unattributed or goes to whatever touch came last.
• Returning visitors look new. When the identifying cookie expires, the same person becomes a new visitor, which inflates new-visitor counts and weakens retargeting audiences.
• Platforms optimize on less. Purchases that cannot be matched to an ad interaction are purchases the platform's bidding cannot learn from.

How to protect measurement

• Collect through your own domain. Send events to an endpoint on your domain, a subdomain or a proxy the platform supports, instead of a third-party domain that blockers list. This is the idea behind server-side tagging, explained in server-side tracking.
• Set identifiers from your server. A cookie your server sets in an HTTP response is not covered by Safari's cap on cookies created by JavaScript. Store the click identifier the moment the visitor lands, on the server, and keep it with the session.
• Store the click ID with the order. Once an order exists, the identifier lives in your database, not only in a browser cookie that might expire.
• Send purchases server-side. A purchase reported by your backend does not depend on any cookie surviving until checkout. We explain what that fixes and what it does not in what the Conversions API actually fixes.
• Use neutral paths. Blockers match on well-known names such as /collect or /track. A neutral route on your own domain avoids path-based filters, though not domain-level ones.

First-party does not mean exempt

Collecting through your own domain changes how browsers treat the data. It does not change what you are allowed to collect. Measurement and advertising cookies need to be covered by your privacy notice and consent choices whoever sets them, and in Mexico that framework is the federal data protection law, which we cover in the new LFPDPPP and marketing tracking. For how this applies when an AI assistant reads your data, see is it safe to give your marketing data to ChatGPT or Claude.

How Adray does it

Adray's pixel sends events to a neutral route and prefers a first-party path where the platform allows it: an app proxy on Shopify, a WordPress plugin on WooCommerce that also captures attribution on the server in HTTP-only cookies, and an edge route on VTEX IO. Purchases come from each platform's order webhooks, not from the browser, so an order stays attributed even when the pixel was blocked.