Privacy & Tech

What is the difference between first-party and third-party tracking?

First-party tracking generally concerns interactions with the website a person is visiting. Third-party tracking involves an external party collecting or linking activity, potentially across multiple websites. The distinction is useful, but it does not by itself determine privacy obligations.

Aspect	First-party tracking	Third-party tracking
Typical context	Measuring activity within a website’s own service.	An external service collecting activity through participating websites.
Example	A retailer analysing its checkout journey.	An advertising network connecting visits across retailers.
Data recipients	May include the website operator and its service providers.	May include providers that combine information from different sites.
Consent status	Not automatically exempt.	Depends on the operation, purpose and applicable law.

Cookie terminology is more specific. A cookie is considered first-party or third-party based on its relationship to the website being visited, not simply on who operates the service. An external provider can therefore set or use a cookie in a first-party context when it operates as part of the website’s own service.

This distinction also matters for cross-site tracking. Third-party tracking can connect activity across different websites, but cross-site tracking can also involve other techniques such as link-based identifiers or browser fingerprinting.

MDN’s guide to third-party cookies explains this technical distinction. To assess how tracking works, examine the full data flow, including who collects the information, where it is sent and whether it is combined with data from other sites.