What are cookies GCSE computer science students ask about most: a small text file that a website stores on a user's device via their browser, used to remember information between visits — such as login status, items in a shopping basket, or site preferences. Cookies make browsing feel continuous rather than starting from scratch on every page.
What is a cookie in computing, exactly?
A cookie is a tiny piece of text data — usually just a few kilobytes — sent from a web server to a user's browser, then stored on the user's device. On every later request to that same website, the browser automatically sends the cookie back to the server, so the server can "remember" who the user is and what they were doing.
A cookie typically stores information such as:
- A unique session identifier (so the server recognises the same visitor across multiple page loads)
- Login status (so a user doesn't have to sign in again on every page)
- Items added to a shopping basket
- Language or display preferences
- Tracking data used for advertising or analytics
Cookies are not programs and cannot run code themselves — they are just stored data. This distinguishes them from viruses or malware, though they still raise real privacy questions, covered later in this article.
How do cookies actually work between browser and server?
The process follows a consistent pattern every time a browser visits a site that uses cookies.
- The user's browser sends a request to a website for the first time.
- The server responds with the requested page and includes an instruction to "set a cookie", containing a small piece of data (often a unique ID).
- The browser stores that cookie on the user's device, tagged with the website's domain.
- On every future request to that same domain, the browser automatically attaches the stored cookie to the request.
- The server reads the cookie and uses it to recognise the returning user — for example, keeping them logged in or restoring their shopping basket.
This is why logging into a website once usually keeps you logged in as you move between pages: the cookie is sent with every request, proving to the server who you are, without you having to log in again and again.
What is the difference between session cookies and persistent cookies?
GCSE specifications distinguish between two main types of cookie based on how long they last.
| Feature | Session cookie | Persistent cookie |
|---|---|---|
| Lifespan | Deleted when the browser is closed | Remains until a set expiry date or manual deletion |
| Typical use | Keeping a shopping basket active during one visit | Remembering login details across separate visits |
| Stored where | Browser memory (temporary) | Browser storage on disk |
| Example | Staying logged into a form-filling session | "Remember me" login on a returning site |
| Risk if stolen | Lower — expires quickly | Higher — valid for longer, more exposure |
A session cookie behaves like a wristband handed out for one event only — useless once you leave. A persistent cookie behaves more like a membership card, valid across many separate visits until it expires or is deleted.
Why do cookies raise privacy concerns?
Cookies were originally designed for a simple, useful purpose — remembering a user between page loads on the same site. But a category called third-party cookies raised much wider privacy questions.
A first-party cookie is set by the website the user is actually visiting. A third-party cookie is set by a different domain embedded within that page — often an advertising or analytics company — and the same third-party cookie can be read across many different websites that all use the same advertiser. This allows a company to build up a picture of a user's browsing habits across multiple, unrelated sites, without the user necessarily realising it is happening.
This tracking capability is the main reason cookies are treated as a data-protection issue rather than just a technical convenience. A student answering a GCSE question on ethical and legal issues in computing should be able to explain that cookies can track browsing behaviour, and that this is why websites are required to ask for consent before setting non-essential cookies.
What does UK law require websites to do about cookies?
UK websites must ask for a user's consent before setting cookies that are not strictly necessary for the site to function (essential cookies, like the one keeping a shopping basket working during checkout, are generally exempt). This is why almost every website now shows a cookie consent banner on a first visit, asking the user to accept or manage which categories of cookie they allow.
For a GCSE exam answer, the key point is the trade-off: cookies improve a user's experience by remembering preferences and login status, but they also collect personal data about browsing behaviour, which is why transparency and consent matter. A well-rounded answer on cookies should mention both the technical mechanism (small text file, sent between browser and server) and the ethical/legal dimension (consent, tracking, third-party sharing). This is the exact pairing that what are cookies GCSE computer science questions are usually checking for.
Frequently asked questions
What are cookies used for on a website?
Cookies are small text files a website stores on a user's device to remember information between visits or page loads — such as staying logged in, keeping items in a shopping basket, remembering language preferences, or recognising a returning visitor. The browser automatically sends the relevant cookie back to the server with every request to that site.
How do internet cookies actually work?
When a browser first visits a website, the server can instruct the browser to store a small piece of data called a cookie. On every subsequent request to that same website, the browser automatically sends the cookie back, allowing the server to recognise the user without asking them to log in or re-enter information every time. This request-and-response cycle repeats for as long as the cookie remains valid.
What is the difference between session cookies and persistent cookies?
A session cookie is temporary and is deleted automatically when the browser is closed, making it useful for things like keeping a shopping basket active during a single visit. A persistent cookie is stored on the device and remains valid until a set expiry date or until it is manually deleted, which is what allows "remember me" logins to work across separate visits days or weeks apart.
Are cookies a security risk?
Cookies themselves are just data and cannot run code, so they are not viruses or malware. However, if a cookie containing a login session is stolen (for example, over an unsecured network connection), an attacker could potentially use it to impersonate the user without needing their password — which is why secure websites encrypt cookie traffic using HTTPS and set expiry limits on sensitive cookies.
For Socratic computing tutoring at KS3 and GCSE — from web technology to full programming projects — see aitutors.me.