What are cookies, and should I 'accept all' or 'reject all'?

More context

A cookie is a small piece of text that a website asks your browser to remember and send back on every future request to the same site. That tiny mechanism is the backbone of everything that distinguishes a web of disconnected pages from a web that knows you.

There are several different things people call “cookies”, and they have very different consequences:

• Session and essential cookies. Keep you logged in, hold your shopping cart, remember your language and theme. The site cannot work without them, you cannot meaningfully refuse them, and the law treats them as exempt. They are first-party only.
• First-party preferences cookies. Remember non-essential settings — collapsed menus, dismissed announcements. Low risk, low value.
• Analytics cookies. Tell the site owner how many people visited, where they came from, which pages they read. Usually first-party in 2026; some old setups still ship third-party Google Analytics.
• Advertising / tracking cookies. Set by third parties (ad networks, data brokers, retargeting platforms) whose scripts are embedded on the page. They link your browsing across many sites and build a profile used to target ads — and, increasingly, to enrich datasets sold elsewhere. These are the cookies the EU / UK cookie banner is about.

The “accept all / reject all” banner is mandated by the ePrivacy Directive (the “cookie law”, 2002, amended 2009) and tightened by GDPR (2018). Under it, non-essential cookies require informed, freely given, specific, unambiguous consent. The CNIL in France, the ICO in the UK, and equivalents elsewhere have repeatedly ruled that “reject all” must be as easy as “accept all” on the first screen — sites that hide “reject all” three clicks deep are non-compliant and some have been fined (Google was fined €150 M and Facebook €60 M by the CNIL in January 2022 for exactly this; further enforcement followed).

What “reject all” actually does:

• Refuses analytics and advertising cookies.
• Does not log you out — essential cookies are unaffected.
• Does not “break” the site visually. The site looks and works the same.
• Does not make you anonymous: fingerprinting, account-based tracking, and IP-based tracking still work to some degree.

What “accept all” actually does:

• Opts you into being tracked across, typically, several hundred third-party companies whose scripts the site embeds.
• Lets those companies build a long-term profile of your interests, purchases, and movements between sites.
• Does not affect your login state or page functionality — that is what makes “reject all” virtually free.

Practical reflex: “reject all” is the safe default for almost every visit. The only time “accept all” arguably costs you anything is on a site you visit every day and where you specifically want their analytics or personalised features — and even then, dedicated settings inside the site usually give finer control.

The cookie banner is also a useful sanity check on the site itself. If a site makes “reject all” hard to find — buried in “manage preferences”, styled as a faint grey link next to a bright “accept all” button, requiring you to toggle dozens of switches — that is a deliberate choice by the operator. It tells you something about how much they value your data versus your experience. In 2026, several browsers (Brave, DuckDuckGo, Firefox via tracking protection, Safari) auto-handle banners or auto-refuse non-essential cookies, removing the click entirely.