What is an HTTP cookie?
A small piece of data a server sends a browser, echoed back on subsequent requests to the same site, the standard mechanism for sessions and tracking.
When a server sets a Set-Cookie header, the browser saves the cookie scoped to the domain (and optionally path) that issued it. From then on, every request the browser makes to that scope includes a Cookie header echoing those values back. That round-trip is what lets a stateless protocol behave like a stateful application.
Cookies have attributes that govern their behavior: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax|Strict|None (cross-site request rules), Max-Age (lifetime), Domain/Path (scope). For session cookies you want Secure, HttpOnly, SameSite=Lax and a short Max-Age, anything less is a vulnerability waiting to be exploited.
Third-party cookies, set by domains other than the page's, are how cross-site tracking historically worked. Safari and Firefox block them by default; Chrome's timeline keeps slipping but the direction is the same. Adtech has largely shifted to first-party cookies and server-side tracking as a result.