Tracking Cookies: What They Are and How to Remove Them

Your antivirus just finished a scan and the result reads something like "7 tracking cookies found, click to remove." It sounds like you've been hacked. You haven't. Tracking cookies are small text files that websites use to recognize your browser across visits, and in a lot of cases, across other websites entirely. They are not viruses or spyware in the classic sense, and clearing them once rarely makes them disappear for good.

This guide shows you what a tracking cookie actually looks like, with real names you can search for in your own browser, how to get rid of tracking cookies in Chrome, Firefox, Safari, and Edge, and why the same ones tend to reappear the next day. Near the end, there's a section for anyone who runs a website of their own: what is your browser carrying, and what does your own site hand out.

What Makes a Cookie a "Tracking" Cookie

A cookie, in the most basic sense, is a small piece of text a website asks your browser to hold onto. Most cookies are doing something useful and boring: remembering that you're logged in, keeping items in a shopping cart, remembering your language setting. Nobody complains about those.

A tracking cookie is different in one specific way. Its value is a persistent identifier, usually a long string of random characters, that gets reported back to a company every time you land on a page that includes their code. That company might be an ad network, an analytics provider, or a social platform. The identifier itself does not say "Ines from Porto." What it does is let one company recognize "the same browser that was on site A ten minutes ago" when that browser shows up on site B, C, and D.

Think of it as a wristband from a festival you don't remember signing up for. It doesn't carry your name, but every gate you walk through scans the same code and adds it to the same file. A tracking cookie sits quietly in browser storage, and most people never look.

There's also a first-party versus third-party split, which cookie "belongs" to the site you're on and which belongs to someone embedded in it, and that distinction changes how browsers treat the cookie by default. I cover that split on its own, so this guide won't repeat it here.

Meet the cookies you'll actually run into

Most tracking-cookie lists stay vague: "various tracking cookies," "third-party identifiers." Here are the names that show up constantly, along with who sets them and how long they stick around, per Google's own reference for its advertising and measurement cookies.

How common is this, exactly? The HTTP Archive's 2025 Privacy chapter, published in January 2026, found that 75% of desktop pages and 74% of mobile pages carry at least one tracker, and analytics tools sit on 64% of desktop sites, ahead of advertising at 15%. Google Analytics alone runs on 53% of sites, and Meta's pixel runs on 16%.

Cookiecheck.tools labels these the same way: _ga, _gid, and _gcl_au get classified as analytics or advertising trackers using the same reference names. The lifetime column above also hints at another split worth knowing: _gid behaves like a short session cookie while _ga persists for years, and the difference between those two cookie types is worth understanding on its own.

Are tracking cookies actually dangerous, or just annoying

Given how much attention tracking cookies get, is this actually dangerous, or just uncomfortable?

A cookie is a text record. It cannot run code, read files on your computer, or steal a password by itself, the way a virus or a piece of spyware can.

That's part of why the language your antivirus uses feels dramatic. Security suites flag tracking cookies conservatively, based on what a persistent identifier could theoretically be used for, rather than anything the cookie is actively doing to your machine right now. A regular on an AnandTech forum thread summed it up about right after a new laptop owner panicked over a scan finding "5 to 8 tracking cookies": mostly harmless, flagged for what they represent rather than what they do.

The real cost of a tracking cookie is the profile it helps build across sites, not code execution. Where cookies genuinely matter for security is a different category: session cookies, the ones that keep you logged in, can be stolen through cross-site scripting or an unencrypted connection if a site hasn't set the right flags. That's a separate topic with its own guide here, and it's the one actually worth worrying about. (If you're curious how those flags interact with a site's response headers, securityheaders.tools checks that side of things.)

Check your own browser before you delete anything

Before you start clearing data, it helps to see what's actually sitting in your browser right now. Guessing is how people end up clearing the wrong thing twice.

Cookiecheck.tools has a "Your browser" tab built for exactly this, and it never sends anything to a server. It prints a short snippet, you paste it into your browser's console, and it reads back your cookies and local storage, flagging anything that looks like a tracking identifier using the same name list as the table above. Open the browser check here and give it a minute.

How to get rid of tracking cookies (browser by browser)

You don't need any extra software for this, just the browser itself and a couple of minutes. One thing worth deciding first: do you want to clear cookies for one troublesome site, or wipe the slate everywhere? Every browser below supports both, and each set of steps notes which is which.

Chrome

1. Click the three dots in the top-right corner of Chrome, then choose "Delete browsing data." A small window should open with checkboxes for time range and data types. If nothing appears, you likely clicked the wrong icon; look for three vertical dots, not three horizontal lines, which toggles the bookmarks bar in some themes instead.
2. Under "Time range," pick "All time," and confirm "Cookies and other site data" is checked. Leave "Browsing history" unchecked if you'd rather keep that.
3. Click "Delete data." The window closes, and if it worked, any site you were logged into will ask you to sign in again on your next visit. That sign-out is your confirmation. Clearing browsing data this way does not sign you out of your Google Account itself, only the individual sites.
4. To clear cookies for just one site instead of everywhere, go back to the three-dot menu, then Settings, then "Privacy and security," then "Cookies and other site data," then "See all site data and permissions," and search for the site by name.

Firefox

1. Open Firefox's menu (three horizontal lines, top-right), choose Settings, then "Privacy & Security" from the left sidebar. You're looking for a section called "Cookies and Site Data."
2. Click "Clear Data," and in the dialog that opens, keep "Cookies and Site Data" checked. Click "Clear," then confirm again when Firefox asks a second time; that extra step exists so you don't wipe everything by accident.
3. You'll know it worked because logged-in sites revert to logged-out on your next visit, the same signal as Chrome. If cookies reappear within a day for the same three or four sites, that's expected and covered in the next section. It doesn't mean the deletion failed.
4. For a single site, use "Manage Data" in that same panel and search for the domain, or click the shield icon in the address bar while on that site and choose "Clear cookies and site data for this site."

Safari

1. Open Safari's Settings from the Safari menu in the top-left, then click the "Privacy" tab.
2. Click "Manage Website Data." A list of every site with stored data appears, and this can run into the hundreds even on a browser you only use for a handful of sites.
3. Search for a specific site and click "Remove," or click "Remove All" to clear everything at once. Apple's own guidance is direct about the tradeoff: removing this data may reduce tracking, but may also sign you out of websites or change how they behave.
4. If "Manage Website Data" looks empty or greyed out, check that you're not in Private Browsing. Safari handles stored data differently there, and the list can look empty even though cookies exist for the current session.

Edge

1. Click the three dots in the top-right corner, go to Settings, then "Privacy, search, and services," then "Choose what to clear" under "Clear browsing data." Pressing Ctrl+Shift+Delete opens the same dialog directly.
2. Check "Cookies and other site data," pick a time range, and click "Clear now."
3. Confirm it worked the same way as the other browsers: sites you were logged into will ask you to sign back in, since clearing cookies signs you out of most sites. It's worth skipping this step right before you need to log into something you rarely use.
4. For ongoing cleanup, Edge lets you turn on "Clear cookies and site data when you close all windows" in that same settings screen, so every session starts closer to fresh without you deleting anything by hand.

Why they're back tomorrow even though you just deleted them

This is the question that shows up over and over in forums: "I deleted my tracking cookies and my antivirus found the same ones a day later, am I infected?" No. Here's what's actually happening.

When you clear cookies for a site, older browser behavior cleared what belonged to that site's own domain, but a tracking cookie set by doubleclick.net while embedded on that page belongs to doubleclick.net, not the site you were looking at. Firefox changed this with version 91 in August 2021: its Enhanced Cookie Clearing groups everything a tracker set while visiting a given site into that site's own data jar, so forgetting the site now empties the tracker's cookies too. Mozilla's announcement explains the mechanism, and it's the real fix for the "it keeps coming back" problem, not a myth about hidden folders on disk.

Then there's the simpler reason. As soon as you visit any site running that same tracker again, the cookie gets set fresh, because the tracker's code runs on every page load. Deleting yesterday's cookie doesn't stop tomorrow's page from asking for a new one. The durable fix is blocking third-party cookies at the browser level plus a content blocker.

Wait, does your own site set tracking cookies too

Everything above assumes you're the one being tracked. If you also run a WordPress blog, a Shopify store, or any site with an analytics snippet in the header, flip the question: are you setting tracking cookies too, maybe without meaning to?

It's an easy thing to miss. Installing Google Analytics, a Meta pixel, or a chat widget usually means agreeing to a short setup wizard, not reading a cookie policy. Regulators have been explicit that it still counts. The UK's Information Commissioner's Office published a "fact versus fiction" post in September 2025 correcting a common assumption: the rule requiring consent before storing or reading information on someone's device isn't limited to cookies or personal data, and it applies whether or not you'd personally call your analytics tool "tracking." The ICO's own explanation is worth five minutes if your site gets any EU or UK visitors.

This is where running a URL through cookiecheck.tools earns its keep. Paste in your own site's address and it fetches the page once, reads every cookie the server sets and every third-party host in the HTML, and flags things like advertising or analytics trackers firing before any consent banner has loaded (the pattern behind what a compliant banner actually looks like), or a cookie set to live longer than 400 days. It won't tell you "you're compliant" or "you're breaking the law," because that call depends on facts a single page fetch can't see.

One limit is worth knowing up front. A plain URL check can't always see cookies that only get set by JavaScript after the page finishes loading, which is how _ga and _fbp usually get set. For that, use the browser tab, the same one from earlier in this guide, on your own site to see what actually lands after the page runs.

Frequently Asked Questions

What are tracking cookies?

Tracking cookies are small text files that websites and their embedded services use to recognize your browser across visits, and often across other websites, using a persistent identifier stored in the cookie's value. Analytics tools like Google Analytics's _ga, and advertising tools like Google's IDE or Meta's _fbp, are the most common examples, and together they run on the majority of websites according to the HTTP Archive's 2025 Privacy chapter.

Are tracking cookies dangerous?

Not in the sense of a virus or malware. A cookie is a text file and can't execute code or read files on your device on its own. The real risk is profiling: a company can build a picture of your browsing habits across many sites using the same identifier.

Antivirus tools flag tracking cookies conservatively because of what that identifier could be used for, not because the cookie is actively harming your computer. Session cookies, the ones keeping you logged in, are the category actually worth securing, and that's a separate, more technical concern.

How do I remove tracking cookies from my browser?

In Chrome, Firefox, Safari, and Edge, the option lives under a privacy or history settings menu, usually labeled "Clear browsing data" or "Manage website data," where you can select cookies and site data specifically and clear them for one site or everywhere. The full steps for each browser are above. Expect to get signed out of sites you were logged into afterward. That's the confirmation it worked, not a side effect to worry about.

How can I tell if my own site sets tracking cookies?

Run your site's URL through a cookie checker like cookiecheck.tools, which fetches the page once and reports every cookie the server sets along with third-party hosts and tracker categories found in the HTML. Because some tracking cookies get added by JavaScript after the page loads rather than by the server, also check the browser tab on your own site while logged out, to see what actually lands in storage once the page finishes running.