What happens when you accept cookies from a website?

This is just one of the stories from our “I’ve Always Wondered” series, where we tackle all of your questions about the world of business, no matter how big or small. Ever wondered if recycling is worth it? Or how store brands stack up against name brands? Check out more from the series here.

Catherine K. asks:

If you "accept all” cookies from a website, what are you consenting to -- where would you find the terms and conditions?

You’ve probably encountered endless pop-ups on the internet prodding you to “accept all” cookies.

These cookies are used to deliver you personalized ads, analyze the site’s web traffic and “enhance your browsing experience,” according to some of these requests. These cookie banners stem from a European Union law requiring websites to ask for user consent in order to place cookies on your computer, said Chester Wisniewski, a director at the security firm Sophos.

Some websites only display them if you’re a European Union citizen, while some have decided to just warn everybody about cookies, he said. Even if you don’t accept them, some websites may place them anyway, while others may only place cookies that are considered essential, like for logging in.

Companies have increasingly used cookies in sophisticated ways in order to track user behavior. But the original idea behind cookies was to remember a user’s preferences, Wisniewski said. Cookies are little text files that your web server can set on your computer, he explained.

So if you set your browsing preferences to “dark mode” for a particular website because you don’t like the bright light of the screen, that sets a cookie.

“Next time I go to that website, that website goes, ‘Hey, do you have any cookies for xyz.com?’ And my browser goes, ‘Yeah, here are all the cookies I have,’” Wisniewski said.

It will send back little text files with information about you, including your preference for “dark mode.”

“This allows the site to remember who I am a little bit,” Wisniewski said.

Cookies also ensure that you’re consistently logged in as you’re browsing a website. “That's why when you click link to link to link when you're on Amazon, it doesn't make you log in every time you go to another page,” Wisniewski said. Websites store a cookie with a "cryptographic secret" on your computer saying who is currently logged on, and it retrieves that cookie as you go from page to page, Wisniewski explained.

You can also think of cookies as signing up for a membership club, said David Musicant, a computer science professor at Carleton College in Minnesota.

“You get your own little ID number associated with that website,” Musicant said. Cookies also provide other useful benefits, like maintaining a shopping cart, Musicant said.

But the level of tracking enabled by cookies has raised privacy concerns. Websites have ads from third parties, and the third party can leave a cookie of their own on your computer, Musicant said.

If you go to another website that has that same advertiser, that advertiser can now track you across multiple sites, Musicant said. This tracking allows them to provide you with targeted ads. .

If you’re rejecting cookies on a website, you may just be rejecting the optional ones, which track your preferences, Wisniewski said.

Some cookies are essential for websites to function and needed to, for example, log in.

But some website might still place cookies that are considered nonessential even if you don’t accept them. One journalist, reporting for Consumer Reports, wrote that websites still tracked him even though he rejected them.

With the level of tracking that persists, Wisniewski said the EU’s cookie law “is clearly not effective.”

“It’s just annoying,” he said.

But California and the EU have passed some laws that are “a great start.” Wisniewski said. The EU allows people to ask organizations to delete their personal data, while the California Consumer Privacy Act gives consumers the right to know what information a business has collected about them and it gives them the right to delete personal information that’s been collected from them, with some exceptions.

“Some of this doesn’t need to be solved with a cookie banner or doesn't need to be solved by tech companies. I think some of this needs to be solved by Congress,” Wisniewski said.