A second-party cookie is a cookie set by one website and accessed by another site through a direct business relationship. In identity and security contexts, it can help recognize users across related domains, but still requires clear consent, controlled sharing, and governance because it can expose behavioral data and tracking risk.
What Second-Party Cookies Are Used For
Second-party cookies are usually used to recognize the same user across related properties that have a direct commercial or operational relationship. That makes them useful for shared authentication journeys, audience continuity, and cross-domain measurement, but only when the relationship and purpose are clearly defined.
Because the cookie is set by one party and read by another in an agreed arrangement, the technical value is not just tracking, it is controlled reuse of state across trusted domains. In practice, that means the cookie’s purpose, scope, and retention need to match the business relationship, not just the marketing use case.
How Second-Party Cookies Differ From Other Cookie Models
The distinction matters because second-party cookies sit between first-party cookies, which are bound to one site, and third-party cookies, which are broadly reused across unrelated sites. A second-party cookie can look like a privacy-preserving middle ground, but it still carries cross-site visibility and governance obligations.
In identity and security contexts, the main issue is not the label, but who can read the value, what identifiers it contains, and whether the same state can be correlated across domains. If the cookie becomes a durable tracking or session-matching mechanism, it should be treated as sensitive state rather than routine website plumbing.
That is why consent and notice language matter as much as implementation. NHIMG’s Consent Management Guide: Cookies, CMPs and GPC is relevant here because second-party arrangements often depend on the same consent, logging, and signal-handling controls used for cookie governance.
Security and Privacy Implications
Second-party cookies can expose behavioral data, enable cross-domain correlation, and create trust leakage if shared too broadly. The risk is not limited to tracking, because the same mechanism can reveal login state, preference state, or other usage patterns that should not move freely between properties.
They also increase the importance of data minimization and purpose limitation. If the cookie value can be used to link a person, session, or device across sites, then the business relationship becomes part of the security boundary and the privacy boundary at the same time.
For organisations that need an external privacy baseline, the GDPR’s principles on lawful processing, minimisation, and security of processing are directly relevant. The European Commission’s guidance on the EU AI Act is less central here than privacy law, so the stronger fit is the GDPR and privacy governance rather than a broader AI framing. The cookie model also benefits from privacy engineering thinking, which is why NIST Privacy Framework is a useful reference point for data governance and risk reduction.
Governance and Operational Controls
Second-party cookies should be governed like any other cross-domain data-sharing mechanism: documented purpose, explicit ownership, review of sharing scope, and a clear decision on whether the cookie is necessary at all. If the arrangement is contractual, the contract should match the technical reality, not just the marketing intent.
Operationally, teams should know where the cookie is set, which domains can read it, how long it persists, and whether it is linked to a customer, session, or analytics identifier. When those answers are unclear, the risk is usually not a technical defect, but uncontrolled reuse of state.
Where cookie sharing is part of a wider third-party or partner ecosystem, resilience and accountability concerns become more important. The EU Digital Operational Resilience Act (DORA) is relevant for regulated entities that must manage ICT dependency and third-party exposure, while the EU General Data Protection Regulation (GDPR) remains the clearest external rule set for consent, lawful basis, and data protection obligations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Article 5 — Principles relating to processing of personal data | Second-party cookies can process personal data across domains, so minimisation and purpose limits apply. |
| Article 6 — Lawfulness of processing | Cross-domain cookie use requires a lawful basis when the cookie identifies or tracks a person. | |
| Article 25 — Data protection by design and by default | Second-party cookies should be designed to minimise tracking scope and default to the least data sharing necessary. | |
| Recommendation — Limit cookie sharing to the stated purpose and only retain identifiers needed for that purpose. Document the lawful basis that justifies the cookie’s cross-site use before deployment. Build cookie flows so the default configuration shares the minimum data needed for the approved use case. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Cookie values can function as session or authentication material that needs lifecycle control. |
| AC-20 — Use of External Information Systems | Second-party cookie sharing spans a controlled external relationship and needs explicit access conditions. | |
| Recommendation — Treat session-like cookie values as managed authenticators and control their issuance, storage, and revocation. Define and enforce the conditions under which external partners may read or reuse the cookie state. | ||
Related resources from NHI Mgmt Group
- What are the signs that third-party cookie use is becoming a governance problem?
- Why do consent and cookie rules create compliance risk for third-party trackers?
- How should organisations handle cookie consent when third-party cookies are phased out?
- When should teams prioritise first-party data over third-party cookie tracking?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org