Also called: first party cookie, third-party cookie, cookie lifetime, ITP
The seven-day cap is the detail most measurement setups miss. A first-party cookie is not automatically durable: if it is written by a script (as GA4's _ga cookie is), Safari expires it after seven days of no return visit. Written by the server in an HTTP response header from your own domain, it can persist far longer.
That distinction is the main measurement argument for server-side tagging: moving cookie-setting from client JavaScript to an HTTP response on your own subdomain restores realistic lifetimes on Safari, which is a large share of mobile traffic in many markets.
Chrome retained third-party cookies after reversing its planned deprecation in 2025, but the direction of travel across the browser market has not reversed. Building measurement that depends on third-party cookies is building on a shrinking base.
Cookie lifetime silently truncates attribution: a 30-day consideration cycle measured with a 7-day cookie reports the same buyer as a fresh direct visitor, crediting the wrong channel for the sale.
Two years by default, but Safari's ITP truncates it to seven days because it is written by JavaScript. The configured expiry and the effective expiry are different numbers on Safari and, for some scenarios, on Firefox.
No. The consent question turns on purpose, not on which domain set the cookie. A first-party analytics cookie still requires consent in the EEA; a first-party cookie holding a shopping-cart session generally does not.
TagEasy's free auditor checks any URL for Consent Mode v2 signals, PII in tracking, duplicate pixels, and 10 other tracking-quality faults. No signup.
