First-Party Cookie

A first-party cookie is one set by the domain in the browser's address bar — the site the visitor is actually on. A third-party cookie is set by some other domain loaded inside that page (an embedded tracker, ad, or shared tracking host). The distinction used to be a technicality; today it decides whether your tracking works, because browsers treat the two completely differently.

Why the distinction matters

Modern browsers — led by Safari's ITP and followed by Firefox and Chrome — block third-party cookies aggressively while largely leaving first-party cookies alone. An affiliate program that relies on a shared third-party tracking domain to set the click ID cookie will watch a large share of those cookies get withheld or deleted, and the conversions they would have attributed fall through to unattributed. Move the same tracking onto a domain that matches the visitor's site, and the cookie becomes first-party and survives.

A worked example

Two setups, same visitor journey, different outcomes:

• Shared subdomain (third-party). The click sets a cookie on shared-tracker.com. When the visitor converts on yourbrand.com, that cookie is third-party to the page and the browser may refuse to send it. Conversion: unattributed.
• Your own tracking domain (first-party). The click sets a cookie on track.yourbrand.com, aligned with your brand. At conversion the cookie is first-party and honored. Conversion: attributed.

Same code, same affiliate — only the domain changed, and it changed everything.

Cookies are a fallback, not the foundation

Even first-party cookies have limits: they can be cleared, they expire, and they do not cross devices. The most durable attribution never depends on the cookie at all — it passes the click ID explicitly from the landing URL through to the conversion. Treat the first-party cookie as a strong fallback, not the primary mechanism.

How this works in LimeliJourney

Every LimeliJourney account runs on its own tracking domain, so the click ID and visitor ID cookies are first-party by construction — far more likely to survive between click and conversion than a shared-host cookie. The platform still appends ll_cid to the landing URL so you can capture and echo it, making attribution work even when a cookie is missing. On a first-party domain the cookie fallback is reliable; on a shared subdomain some browsers withhold it, which is precisely why LimeliJourney does not use one.