First-party and third-party cookies
First-party cookies are set by the site you are on. Third-party cookies are set by someone else’s domain. Purpose matters more than the label.
A first-party cookie is stored by the site in the address bar. A third-party cookie is stored by another domain, often an analytics or advertising vendor loaded on that page.
The party label does not tell you whether a cookie is strictly necessary. A first-party analytics cookie can still be optional. A third-party cookie that only keeps a login on an embedded service might be essential in a narrow case. Your purpose model has to say which.
How a scan helps
Consent Guru’s scanner lists cookies and script patterns so you can map them to purposes and vendors. Coverage is incomplete for cookies that appear only after login or only inside a tag container. Review unmapped findings before you treat a scan as a full inventory.
Enforcement
Mapping a finding does not block it until the published policy and the SDK say so. Classify first, publish second, then confirm the optional scripts wait.
Educational overview only — not legal advice. Confirm requirements with counsel for your products and markets.
