How Hackers/Websites steal your information while accepting cookies

What are cookies? Cookies are small text files sent by the website you’re visiting to the computer or device you’re using. If accepted, these cookies are stored on the web browser of your device. Cookies can then track and collect data from your browser, sending that data back to the website owner. More on what type of data may be collected and for what purposes below.

If you’re surfing the web and see a pop-up notice that asks you to accept cookies, then you’ve already encountered this recurring decision. While the simple click of a button to accept cookies may seem harmless, the real solution requires a bit more depth.

Is accepting cookies a bad thing? It depends on the website. It depends on who will gain access to your data and what they will do with it, along with whether declining cookies will affect your ability to use that site.

Keep in mind not all cookies are the same. Some cookies are placed by first parties like the sites you visit, while others are placed by third parties like advertisers.

Why websites ask you to accept cookies

Websites have become more focused on asking you to accept cookies. The reason reflects a data privacy protection law that governs online data tracking and transparency.

This data privacy law is known as the European General Data Protection Regulation (GDPR), which became enforceable in May 2018. The GDPR legislation requires all multinational companies to provide an opt-in whereby website owners receive a user’s permission to use cookies before they can be stored on a user’s web browsers. This opt-in is designed to give users greater control over their data, knowing information is being collected if they give consent to that data collection.

A website owner’s noncompliance may result in fines. This potential legal violation has led to more websites sending cookie notifications to ensure they are in compliance.

Should you accept cookies?

There are reasons why you should or shouldn’t accept cookies. When making the decision, it’s helpful to understand two key questions.

Do you have to accept cookies? – The short answer is, no, you do not have to accept cookies. Rules like the GDPR were designed to give you control over your data and browsing history.
What happens if you don’t accept cookies? – The potential problem with refusing to accept cookies is that some website owners may not allow you to use their websites if you don’t accept their cookies. Another downside is that without acceptance, you may not receive the full user experience on certain websites. More on that, below.

3 times cookies can be helpful

In some scenarios, it can be useful for you to accept cookies. To understand why cookies can be helpful, it’s important to understand the data a cookie might contain about you. Here’s a list.

Website name
Unique user ID
Browsing habits and history
Personal preferences and interests
Links clicked
Number of times a website is visited
Time spent on a website
Settings selected
Account log-in information, including your username and password
Online identifiers like your location and IP address
Personal data like your phone number and address
Shopping cart items

With all of this data collected, companies can use cookies to their advantage and, in some cases, to your advantage as well. Here are three ways that accepting cookies could help you.

Website access. The first advantage is simple: Without consenting to cookies, some websites won’t grant access.
Improved user experience. Cookies can be helpful because they help sites remember you. This memory can help improve your individual user experience. Why is this a good thing? They already know about you and can tailor your website experience to your interests — making your browsing experience quicker, more focused, and more helpful. This more personalized experience can be especially helpful when online shopping. For example, when you revisit a website, it could remember shopping cart items you haven’t yet purchased. Cookies can make the shopping process quicker, more convenient, and more successful.
Easy log-ins. Cookies saved on your web browser also can remember your log-in credentials. This can come in handy when repeatedly logging in to your go-to websites, especially if you sometimes forget your passwords.

5 times you shouldn’t accept or keep cookies

There are some scenarios where you might not want to accept or keep cookies. Here are five examples.

Unencrypted websites. You shouldn’t accept cookies when you’re on an unencrypted website — a site where the lock icon beside the website address is not locked. Why is this dangerous? If a website isn’t encrypted, there is no security to protect your data. This unsecure access may allow third parties like hackers to steal cookies from your browser, intercepting personal information you likely want to be kept private, like credit card and other private information, leaving you more vulnerable to online crimes like identity theft.
Third-party cookies. Not all cookies are the same. It’s a good idea to decline third-party cookies. If you don’t decline, the website could sell your browsing data to third parties. Sharing your personal information with third parties without giving you any control over it could also leave you vulnerable. For one thing, you don’t get to choose the third parties.
Slowed computer speed. Having new cookies stored in your browser over and over also could slow down your computer. Cookies occupy disk space, which can affect your computer’s speed.
Flagged cookies. Antivirus software may flag suspicious cookies, in which case you should not accept them (or you should delete them if you already have).
Use of private information. If you’re sharing private data like your Social Security number (SSN) or banking information, you should decline the use of cookies to keep it safe. This is the type of personally identifiable information (also known as PII) that, if intercepted by the wrong parties, could help fraudsters commit online frauds like identity theft. Personal information like your Social Security number in particular should always be kept private and only shared when absolutely necessary and with the highest regard for privacy and security. A regulation like the GDPR helps ensure you’re given this decision and have control over your data, especially when sensitive information like your SSN is at stake.