# COOKIEGRAPH: Understanding and Detecting First-Party Tracking Cookies

arXiv: https://arxiv.org/abs/2208.12370 · HTML: https://mlsanity.com/paper/2208.12370/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Aug 2022.

## Built on by (most cited first, 3 of 3)

- [PURL: Safe and Effective Sanitization of Link Decoration](https://mlsanity.com/paper/2308.03417/) (2023)
- [SINBAD: Saliency-informed detection of breakage caused by ad blocking](https://mlsanity.com/paper/2405.05196/) (2024)
- [Differentially Private Synthetic Data Release for Topics API Outputs](https://mlsanity.com/paper/2506.23855/) (2025)

## Abstract (arXiv)

As third-party cookie blocking is becoming the norm in browsers, advertisers and trackers have started to use first-party cookies for tracking. We conduct a differential measurement study on 10K websites with third-party cookies allowed and blocked. This study reveals that first-party cookies are used to store and exfiltrate identifiers to known trackers even when third-party cookies are blocked. As opposed to third-party cookie blocking, outright first-party cookie blocking is not practical because it would result in major functionality breakage. We propose CookieGraph, a machine learning-based approach that can accurately and robustly detect first-party tracking cookies. CookieGraph detects first-party tracking cookies with 90.20% accuracy, outperforming the state-of-the-art CookieBlock approach by 17.75%. We show that CookieGraph is fully robust against cookie name manipulation while CookieBlock's acuracy drops by 15.68%. While blocking all first-party cookies results in major breakage on 32% of the sites with SSO logins, and CookieBlock reduces it to 10%, we show that CookieGraph does not cause any major breakage on these sites. Our deployment of CookieGraph shows that first-party tracking cookies are used on 93.43% of the 10K websites. We also find that first-party tracking cookies are set by fingerprinting scripts. The most prevalent first-party tracking cookies are set by major advertising entities such as Google, Facebook, and TikTok.