Cookies, Sessions, and Browser Privacy

Build the mental model

A cookie is a small piece of data a website asks your browser to store and send back on later visits. That mechanism has legitimate, everyday uses: it's how a site remembers you're logged in between pages, keeps a shopping cart from emptying when you navigate away, remembers a language or theme preference, and helps distinguish a real visitor from an automated request as part of basic security. Claiming all cookies are harmful oversimplifies what's actually a general-purpose, mostly boring storage mechanism.

The same mechanism can also be used for tracking, where a cookie doesn't store your preferences but instead helps identify you across visits, and sometimes across different websites entirely, usually to build an advertising profile. This is the use that draws privacy attention, and it's a real, separate category from the session and preference cookies described above, not evidence that the whole mechanism is inherently a problem.

Session cookies deserve a closer look because they connect directly to account security at a browsing level. When you log in, the site typically stores a session token in a cookie; as long as that cookie exists and the session is active, anyone with access to it could potentially act as you, without needing your password again. This matters most on a device you don't fully control, like a shared or public computer.

"Stay signed in" is convenient on a personal device but leaves that session sitting there on a shared one, sometimes well after you've walked away. Logging out is what actually invalidates the session on the server; closing the tab or the browser window just hides it from view, and on many sites the session remains usable until it's explicitly ended or expires.

text

COOKIES: TWO BRANCHES FROM ONE ROOT
-----------------------------------
          SMALL STORED DATA (a cookie)
                    |
      +-------------+--------------+
      |                            |
 LEGITIMATE USES               TRACKING USE
  - session (stay logged in)    - identify you across
  - preferences (language)        visits or sites
  - security (bot vs human)     - build ad profiles

Connect it to a real scenario

On your own personal device, staying signed in to sites you trust is a reasonable convenience trade-off; you control who has physical access, so the risk a shared device carries mostly doesn't apply. There's no need to log out of everything daily just for its own sake.

On a shared or public device, such as a library computer, a hotel business center, or a friend's laptop you borrowed briefly, treat it differently. Skip "stay signed in" when it's offered, and if you did stay signed in or you're not certain, log out fully through the site's own menu before you walk away rather than just closing the tab, since closing the tab alone typically leaves the session active on the server.

Many browsers also offer a private or incognito window, which avoids storing new cookies past that session; it's a good default for a one-off task on a device you don't own. When you're done with sensitive work on any shared machine, clearing cookies for that browser profile afterward is a reasonable extra step even after logging out properly.

Cookies have legitimate everyday uses — sessions, preferences, and security — that are separate from the tracking use that draws privacy attention.
A session cookie can let someone act as you until it's invalidated, which is exactly why 'stay signed in' matters on shared devices.
Logging out actually ends a session on the server; closing the tab only hides it from view.

Try the working example

javascript

function sessionPrivacyRecommendation({ isSharedOrPublicDevice, staySignedInChecked, sessionActive }) {
  if (isSharedOrPublicDevice && (staySignedInChecked || sessionActive)) {
    return {
      action: "log-out-fully",
      reason: "On a shared or public device, an active or 'stay signed in' session could let the next user reach your account. Log out fully rather than closing the tab.",
    };
  }
  if (isSharedOrPublicDevice) {
    return {
      action: "clear-cookies",
      reason: "No account session appears active, but clearing cookies on a shared device still removes leftover site data.",
    };
  }
  return {
    action: "fine-to-stay-signed-in",
    reason: "This is a personal device you control, so staying signed in is a reasonable convenience trade-off.",
  };
}

const examples = [
  { label: "Personal device", input: { isSharedOrPublicDevice: false, staySignedInChecked: true, sessionActive: true } },
  { label: "Shared library computer", input: { isSharedOrPublicDevice: true, staySignedInChecked: true, sessionActive: true } },
];

for (const { label, input } of examples) {
  console.log(label, "->", sessionPrivacyRecommendation(input));
}

You should see

The personal-device example returns action 'fine-to-stay-signed-in'. The shared-device example, with 'stay signed in' checked and an active session, returns action 'log-out-fully', warning that the next user could otherwise reach the account.

5-minute try-it

Think about a device you don't fully own — a work laptop, a library computer, a friend's phone you borrowed. For that scenario, set isSharedOrPublicDevice to true and try both combinations of staySignedInChecked and sessionActive through sessionPrivacyRecommendation. Notice which one is the only combination that returns 'clear-cookies' instead of 'log-out-fully'.

One important caution

Assuming all cookies are tracking and clearing them everywhere, which breaks logins and preferences that were never a privacy problem to begin with.

Closing the browser tab on a shared device and assuming that's the same as logging out — the session usually remains active on the server.

MDN – Using HTTP Cookies — Digital Privacy & Modern Security