Aligning the concept of cookies

[MatiasLFranco]

Everyone has heard about first-party cookies, second-party cookies and third-party cookies.

• First-party cookies are created by the website you are currently visiting. It is the site displayed in the address bar.
• Second-party cookies are created by one company and shared with another company.
• Third-party cookies are created by a different website than the one you are currently visiting.

Technically, second-party cookies do not exist. There are only first-party and third-party cookies. Some people use the term "second-party cookies" to describe when two companies agree to share their first-party data (or cookies) between them.

When third-party cookies go away, mutual agreements between companies to share cookies will no longer be possible and the concept of second-party cookies will become obsolete.

Third-party cookies, on the other hand, will continue to exist within a First-Party Set.

I am not an expert, but I believe that it is important to clarify the different types of cookies after the deprecation of third-party cookies.

[krgovind]

Thanks for the feedback, @MatiasLFranco! Indeed, with the changes that we made to First-Party Sets a few months ago with #92, it is true that the use of the requestStorageAccess and requestStorageAccessFor APIs unlock access to conventional third-party cookies. This is different from our previous approach with the SameParty cookie attribute, which restricted the scope of cookie access relative to regular third-party cookies.

While requestStorageAccess and requestStorageAccessFor do indeed make third-party cookies available again, they now require active invocation by the site, instead of being available by default as with the current state of third-party cookies (in Chrome). As noted in privacycg/storage-access#165, we are also considering supporting the use of a user-prompt-based requestStorageAccess outside of First-Party Sets to enable authenticated third-party embeds.

We'll think about how to better communicate this, especially in developer articles which have wider readership than individual proposals/explainers such as this one.