Why do websites need cookies?
The web was designed to forget you between every click, so a cookie is the note the site hands you to carry back, because it has no other way to know you are the same person.
Simple intuition
The plain reason, in everyday words
The web was built on a protocol that treats every single request as unrelated to every other one. You ask for a page, the server sends it, and the conversation is over. Click a link and a completely fresh request arrives, with nothing to say it came from the same person as the last one. That design made the early web simple and scalable, but it makes anything that has to persist impossible — being logged in, keeping items in a basket, remembering that you chose dark mode. So a mechanism was added: the server hands your browser a small piece of text, and your browser sends it back with every later request to that site. That is a cookie. Its core job is answering one question the protocol cannot: is this the same visitor as a moment ago?
Cookies are programs, or can carry viruses.
A cookie is a short piece of text. It cannot execute, and the browser only ever sends it back to the domain that set it.
Cookies are inherently about tracking.
Their original and most common purpose is holding a session together so you can stay logged in. Tracking is a specific use of third-party cookies, which is why consent rules distinguish between the two.
Blocking cookies makes you anonymous.
Fingerprinting identifies a browser from its characteristics without storing anything, and it grew in use precisely as cookie blocking spread. Blocking cookies removes one identifier, not the ability to identify.
The consent banner is required by law in the form you see it.
The law requires informed, freely given consent. The manipulative banners are an implementation choice, and regulators have repeatedly ruled against making refusal harder than acceptance.
It explains a piece of infrastructure everyone interacts with daily and almost nobody has had explained — including why the banners exist and what they are actually about. It also introduces statelessness, a design choice that shows up everywhere from REST APIs to serverless functions, and shows the standard consequence: statelessness scales beautifully and then requires you to reintroduce state carefully at a higher layer.
Who worked it out
Lou Montulli invented the cookie at Netscape in 1994, to solve a specific problem for a client who needed a shopping basket that survived between page loads.
What problem forced it
The mechanism was deliberately minimal — a small opaque value returned to the same site — and was not designed with cross-site tracking in mind.
How it changed since
Third-party advertising discovered that an embedded resource on many sites could correlate visitors across all of them. Regulation followed in the 2000s and 2010s, and browsers eventually began restricting third-party cookies by default, which pushed the tracking industry toward fingerprinting instead.
How browser fingerprinting works
The identification technique that grew as cookie blocking spread, and which no banner asks you about.
Why sessions are hard to scale
Server-side sessions and signed tokens trade revocability against statelessness, and every large system picks a side.
Written for Curio rather than collected from a forum — it is part of the curated corpus that ships with the platform. The references it draws on are listed under Sources.