On this page
Third-party cookies are cookies set by a site other than the one in your address bar, usually by an ad, analytics or embedded-content vendor whose code runs on the page. In 2026 Safari blocks them by default, Firefox keeps each one in a separate cookie jar per site (MDN), and Google said in October 2025 that Chrome will keep offering users the choice rather than ending them (Google). For a healthcare website that runs ads, the cookie matters less than what the vendor's script sends, which is why Curve Compliance replaces browser ad pixels with server-side tracking under a BAA it signs on every plan.
Book a call. Running ads for a clinic or telehealth brand? Curve Compliance replaces browser ad pixels with one script, sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What third-party cookies are
A cookie belongs to a domain. MDN puts the line this way: “If the domain and scheme are different, the cookie is not considered to be from the same site, and is referred to as a third-party cookie.” It adds that “Third-party cookies are sometimes referred to as cross-site cookies” (MDN). Google's Chrome Help describes them as “Created by other sites. A site you visit can embed content from other sites, for example images, ads, and text” (Chrome Help).
Ad technology is one common use. Among the uses MDN lists is “Counting ad impressions and recording user interests to enable ad-tech platforms to serve more relevant ads” (MDN). HHS, in its guidance on tracking technologies, describes cookies as “files placed on a user's device to customize a user's browsing experience but can also be used to track a user's activities” (HHS).
First-party and third-party cookies
The difference is who sets the cookie, not what is in it. An ad pixel can use both kinds, as TikTok's own help pages show.
| First-party cookie | Third-party cookie | |
|---|---|---|
| Who sets it | The site you are on. Chrome: “Created by the site you visit. The site is shown in the address bar” (Chrome Help) | Another site whose content is embedded on the page (Chrome Help; MDN) |
| Where it can be read | On your own domain | Across the sites where that vendor's content is embedded, unless the browser blocks or partitions it |
| Example from an ad pixel | TikTok: first-party cookies “are created and owned by your website and are used to recognize a person on your domain only” (TikTok) | TikTok: third-party cookies are “Created and owned by TikTok via TikTok's server” and “are enabled by default with the TikTok Pixel” (TikTok) |
| Another ad platform | Meta: “The Meta browser ID value is stored in the _fbp browser cookie under your domain” (Meta for Developers) | Depends on the vendor and its settings |
That table holds the main point for a health site. Blocking third-party cookies does not remove an ad platform's first-party cookies, because those sit under your own domain. To see which cookies your own pages set, use the steps in our cookie checker guide.
Where browsers stand in 2026
| Browser | Default for third-party cookies | Source |
|---|---|---|
| Chrome | “Google Chrome doesn't block third-party cookies by default, only in Incognito mode, or when users explicitly set it to block third-party cookies” | MDN; Chrome Help |
| Safari | “Cookies for cross-site resources are now blocked by default across the board” (WebKit, March 24, 2020, for Safari 13.1) | WebKit |
| Firefox | “Firefox enables Total Cookie Protection if Enhanced Tracking Protection is enabled, as it is by default. This gives third-party cookies a separate cookie jar per site, preventing cross-site tracking.” | MDN |
| Edge | “Edge blocks trackers from unvisited sites, and blocks known harmful trackers by default.” | MDN |
| Brave | “The Brave browser blocks tracking cookies by default.” | MDN |
Chrome is the browser whose plans changed. On October 17, 2025, Google's Privacy Sandbox team wrote: “Since announcing that Chrome will maintain our current approach to offering users third-party cookie choice in Chrome, we've sought input from the ecosystem.” In the same update Google said it would retire several Privacy Sandbox technologies, among them the Attribution Reporting API, Protected Audience and Topics (Google Privacy Sandbox). So Chrome keeps third-party cookies available, and each user decides whether to block them. Pages that still say Chrome is ending cookies on a set date are out of date.
How to allow or block third-party cookies
Chrome. On a computer, open Chrome, select More, then Settings, then Privacy and security, then Third-party cookies, and choose Allow third-party cookies or Block third-party cookies. Chrome Help says that “If you block third-party cookies, all third-party cookies from other sites are blocked unless the site is allowed on your exceptions list,” and that “By default, third-party cookies are blocked in Incognito mode.” You can also allow one site for a while from the address bar; in regular browsing Chrome says that site is then “allowed to use third-party cookies for 90 days or until you turn the setting off” (Chrome Help).
Safari. Apple's guide says to choose Safari, then Settings, click Privacy and select “Prevent cross-site tracking.” With that on, Apple says, “Unless you visit and interact with the third-party content provider as a first-party website, their cookies and website data are deleted” (Apple).
Firefox and Edge. MDN notes that “It is possible to allow usage of third-party cookies on a case-by-case basis in Firefox, Chrome, and Edge via browser settings” (MDN).
If you run the website, MDN's advice to developers is to “Test your functionality with third-party cookies blocked, to see what breaks” (MDN). On a health site, patient portals, embedded booking tools and video players are worth checking first.
Why health sites shouldn't depend on them
- Many visitors already block them. Safari, Firefox and Brave block or partition third-party cookies by default, so anything measured only through them misses those visitors.
- Blocking them does not stop a pixel. TikTok says its pixel “collects information available via standard web browsers, like Chrome,” including the IP address and user agent, and that cookies are only one item on that list (TikTok). The pixel still sends page events from the visitor's browser.
- Cookies are one tracking method among several. HHS says “Websites commonly use tracking technologies such as cookies, web beacons or tracking pixels, session replay scripts, and fingerprinting scripts” (HHS). The HIPAA question is what gets disclosed to a vendor, whatever the method.
- MDN points the same way. Its transition advice includes using another storage mechanism “or consider a server-side solution” (MDN).
For how a pixel works on a health page, see what a tracking pixel is, and for one pixel in depth, see what the TikTok Pixel sends.
Cookies, consent banners and HIPAA
A cookie banner is not a fix for health data. HHS says: “Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization.” It adds that regulated entities “must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI” (HHS).
The same HHS page notes that on June 20, 2024 a federal court vacated part of the guidance: the part saying HIPAA applies when a tool connects a visitor's IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers (HHS). Logged-in pages, forms and booking flows are a different matter. Which rules apply to your pages depends on your setup, so talk to your counsel. For more, see whether a cookie banner is enough for HIPAA and our HIPAA compliant website checklist.
Server-side tracking instead
Server-side tracking sends a conversion from a server to the ad platform instead of from a pixel in the visitor's browser. That send does not depend on a third-party cookie in the browser, and it gives you one place to decide exactly which fields each platform receives. It does not change the platforms' own rules, so the content of each event still matters; see why server-side tracking alone is not HIPAA compliance.
For the wider strategy, see cookieless attribution with first-party data and server-side as the post-cookie default. If you would rather have it built for you, book a call with Curve.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted.
Curve keeps ad attribution when a patient leaves to book in IntakeQ, Calendly, Acuity, Jane App and other schedulers, and bookings made days later still match. Curve also offers consent management, and its free website scan lists the pixels and trackers on a page. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry). Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: MDN, Third-party cookies; Google Chrome Help, Delete, allow, and manage cookies in Chrome; Google Privacy Sandbox, Update on Plans for Privacy Sandbox Technologies; WebKit, Full Third-Party Cookie Blocking and More; Apple, Prevent cross-site tracking in Safari on Mac; TikTok, About TikTok Pixel; TikTok, About using cookies with TikTok Pixel; Meta for Developers, customer information parameters; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What are third-party cookies?
Third-party cookies are cookies set by a site other than the one in your address bar, usually by an ad, analytics or embedded-content vendor whose code runs on the page (MDN). They are also called cross-site cookies.
Should I allow third-party cookies in Chrome?
It is your choice. Chrome lets you allow or block them for every site and keep a list of exceptions, and it warns that if third-party cookies are blocked, “some sites that rely on them may not work as expected” (Chrome Help). Blocking them and allowing the few sites that need them is one way to balance the two.
How do I allow third-party cookies in Chrome?
On a computer, open Chrome, select More, then Settings, then Privacy and security, then Third-party cookies, and choose Allow third-party cookies. To allow one site only, add it under “Sites allowed to use third-party cookies” (Chrome Help).
Are third-party cookies going away?
Not in Chrome on a set date. Google said on October 17, 2025 that Chrome will keep offering users third-party cookie choice (Google). Safari, Firefox and Brave already block or partition them by default (MDN).
What is the difference between a pixel and a cookie?
HHS describes a tracking pixel as “a tiny graphic image (usually 1 pixel) placed on a webpage that allows the website owner or a third party to collect information regarding the use of the webpage” (HHS). A cookie is a small file stored in the browser. A pixel sends data whether or not third-party cookies are allowed; see what a tracking pixel is.
Does blocking third-party cookies stop ad pixels on a health site?
No. Ad platforms also use first-party cookies under your own domain, such as Meta's _fbp cookie (Meta), and a pixel still sends details such as IP address and user agent (TikTok).
Is a cookie banner enough for HIPAA?
No. HHS says banners that ask users to accept or reject tracking technologies “do not constitute a valid HIPAA authorization” (HHS). See whether a cookie banner is enough for HIPAA.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the setup, typically live in about a week (Directory entry).
Talk to Curve Compliance
Book a call. Want ad measurement that doesn't depend on browser cookies or pixels? Curve Compliance sends conversions to your ad platforms from its own servers, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.