Embedding and web termsUpdated
Third-party cookies
Also called: third-party cookie, cross-site cookies
Definition
A third-party cookie is a cookie set by a site other than the one in the browser's address bar, usually by content embedded from another domain such as an iframe or script. Browsers restrict them because they can be used to track people across sites.
First-party vs third-party
Whether a cookie is first- or third-party depends on where you are, not on the cookie. If you're on shop.example and it sets a cookie for shop.example, that's first-party. If a video player framed on the same page sets a cookie for its own domain, that cookie is third-party in this context, even though it would be first-party on the video site itself. The same cookie can be either, depending on which site the visitor is on.
How browsers treat them
Cookies meant for cross-site use must be marked SameSite=None; Secure. Developers can also opt into partitioned cookies (CHIPS), which keep a separate jar per top-level site, or use the Storage Access API to ask permission frame by frame. Browser policies have changed several times, so check current documentation before relying on any of this.
| Browser | Default behavior (per MDN) |
|---|---|
| Firefox | Total Cookie Protection gives each site a separate cookie jar, so embeds can't track across sites |
| Safari | Intelligent Tracking Prevention restricts third-party cookies |
| Chrome | Allowed by default; blocked in Incognito or if the user turns blocking on |
What it means for embeds
- Embeds that depend on the visitor being signed in, for example to like or comment, may show fewer features or a sign-in prompt where cookies are restricted.
- Cookie-consent tools sometimes hold back third-party embeds until a visitor accepts, which looks like an empty box until then.
- LinkedIn's own embeds and plugins load from linkedin.com and fall under LinkedIn's cookie policy.
- LinkedInEmbed widgets don't set cookies, so cookie restrictions don't change what they show. Details are in does a LinkedIn widget use cookies?
Sources
Related terms
- iframe
- An iframe (inline frame) is an HTML element, <iframe>, that displays a separate web page inside the current one. The embedded page loads from its own address and runs as its own document, kept apart from the host page's styles and scripts.
- iframe sandbox attribute
- The sandbox attribute on an <iframe> puts extra restrictions on the embedded page, such as blocking scripts, forms, pop-ups and navigation of the top window. An empty sandbox applies every restriction, and tokens like allow-scripts lift them one at a time.
- Content Security Policy (CSP)
- A Content Security Policy (CSP) is a set of rules a website sends to the browser, usually in a Content-Security-Policy header, saying which sources the page may load scripts, frames, images and other resources from. Anything not allowed is blocked.
Related
Show your LinkedIn on your website
Paste a LinkedIn URL and embed it with one snippet. Free plan, no credit card.
Put your LinkedIn on your website today
Create your first widget in about two minutes. Free plan, no credit card required.