# Accept All? What That Button Actually Hands Over By Suraj Mondem · Published 2026-11-05 · 9 min read Original: https://www.mondemsuraj.com/writing/accept-all > Part 2 ended at a cookie banner. Here's what a cookie really is, why one site's card can follow you to the next, what a tracking pixel sends without a click, and how your feed seems to know you. Part 2 ended at a cookie banner. You know the one. You open a recipe, a news story, a shop. Before you can read a line, a box slides up from the bottom of the screen. "We value your privacy." Two buttons. One of them is big and bright and says "Accept all." You tap it. Everyone does. The box goes away and you get on with your day. My site has never shown you that box, because it doesn't set a single cookie. Parts 1 and 2 were about everything a site can learn without one. So I wanted to know what actually changes when you say yes. This post opens the card you agreed to. What a cookie is, why one site's card can follow you to the next, what a tracking pixel sends without you clicking anything, and how your feed seems to read your mind. ## A cookie is a loyalty card Back to the shop from parts 1 and 2. The owner wants to spot regulars, and the easiest way is to hand you a card. You show it every time you come in. A **cookie** is that card. It's a small piece of text a website asks your browser to keep. Every time you come back, your browser hands it back without being asked. Usually it's just an ID, something like `id=7f3a9c`. The site looks up that ID on its own server, and there's everything it remembers about you. Most cookies are boring and useful. They're why you stay signed in. They're why your cart still has the shoes you added yesterday. They're why a site remembers you picked dark mode. Those are **first-party cookies**: the shop's own card, used in the shop that gave it to you. Here's the thing I found out first. A cookie isn't something a site reads off your device. It's something your browser carries and hands over. That's why clearing your cookies works. Throw away the card, and the shop doesn't know you anymore. > **Interactive: Cookies this page set on you.** A live count of the cookies this page has set in your browser, read from your browser when the box loads: zero, because this site does not use cookies. Beside it, the first-party cookies a typical shop keeps, as an example: a session cookie that keeps you signed in, a cart cookie and a dark-mode cookie. ## The card that works in every shop Now picture a card that works in every shop on the street. A web page is rarely built by one company. The article comes from the site. But the ad in the sidebar comes from an ad company. The share button comes from a social network. The video comes from a video site. The chat bubble, the analytics, the reviews widget: each one can come from somewhere else. Each of those other companies can hand your browser its own card. That's a **third-party cookie**: a card from a company you never visited on purpose. And here's where it adds up. The same ad company has its code on thousands of sites. When you read about running shoes on one site, it sees its card. When you check the weather on another, it sees the same card. When you look at flights on a third, same card again. None of those sites told it who you are. They didn't have to. The card connects the visits, and the company builds a list: shoes, weather in Chicago, flights to Denver. That list is a **profile**. That's the ladder from part 1, the top two steps. Who you are. What you see next. > **Interactive: One ad company, five shops.** A street of five made-up sites. A made-up ad company, AdCo, has its code on four of them. Each visit to a site with AdCo on it adds a line to AdCo's profile of you under the same card ID: local news, running shoes, weekend weather, flights. The recipe blog has no AdCo code and adds nothing. ## What "Accept all" actually turns on So what does the big button do? Most cookie banners sort cookies into a few kinds. The names change from site to site, but they usually look like this. - **Necessary.** Sign-in, cart, security. These run whatever you pick. - **Preferences.** Language, dark mode, the region you chose. - **Statistics.** Counting visits, like my counter does, but with a card. - **Marketing.** Ads, and the companies that build profiles to target them. "Accept all" turns on every kind, for the site and for every partner it lists. "Reject all" keeps only the necessary ones. The difference is mostly in that last row. And the partner list behind it is often long. Many banners have a link like "See our partners" or "Manage options." Open it once on a news site. Scroll. Then keep scrolling. > **Interactive: What the banner buttons turn on.** A made-up cookie banner with 48 partners. Accept all turns on necessary, preferences, statistics and marketing cookies and gives all 48 partners a card. Reject all keeps only the necessary ones and no partner gets a card. Manage options lets you pick; partners get a card only when marketing is on. ## A pixel tells on you without a click Cookies aren't the only way out of a page. The other one is a **tracking pixel**: a tiny piece of another company's code on the page, sometimes literally an invisible one-pixel image, that reports what you did. Think of it as a camera from another company, mounted inside the shop. You don't click it. You don't see it. When you view a product, add to cart, or press a button, it sends a note to its company. The same kind of note from part 1, only this one goes to someone else. Here's the example that shows it best. In 2022, The Markup checked the websites of the top 100 hospitals in the US. On 33 of them, Meta's pixel was sending Facebook a note when someone clicked the button to book a doctor's appointment, tied to their IP address. Nobody on those sites meant to tell Facebook who needed a doctor. The pixel was there for ads. It just did what pixels do. ## Your visit, sold in milliseconds There's one more step, and it happens faster than the page loads. When a page has an empty ad slot, it doesn't always have an ad ready. Instead, a description of the visit goes out to an auction. The page, the kind of device, a rough location, and any profile tags that came with your cards. Ad companies look at it and bid. The highest bid wins the slot. This is called **real-time bidding**, and the whole thing takes a fraction of a second. The part that bothers people is that every bidder sees the description, not just the winner. How often does that happen to one person? In 2022, the Irish Council for Civil Liberties estimated that the average person in the US has their online activity and location broadcast this way 747 times a day. In Europe, 376. They called it a low estimate, because it came from one company's figures. > **Interactive: One visit, eight bidders.** A page loads with an empty ad slot. A short description of the visit (a story about running, a phone, a big US city, likes sports and shoes) goes to eight made-up ad companies, each bids, the highest bid fills the slot, and all eight keep the description. ## Your feed doesn't need a cookie at all Now for the reel. You watch one cooking video to the end. Then another. The next morning, half your Explore page is pasta. It feels like the app read your mind. But this part isn't cookies. Inside an app, there's nothing to hand over, because you're already in the shop. The app watches what you do directly. Instagram has explained this itself. In 2023, it said Feed, Reels, Stories and Explore each have their own ranking system. Reels is mostly for finding new things, so most of what you see comes from accounts you don't follow. To pick them, it predicts how likely you are to watch a reel, like it, and share it. So watching to the end is a signal. Watching twice is a stronger one. Sending it to a friend, stronger still. You didn't tell it you love pasta. You showed it, a few seconds at a time. The web and the apps get to the same place by different roads. On the web, cards and pixels follow you between shops. In an app, you're inside one very big shop, and the owner sees everything you look at. > **Interactive: A feed that learns what you watch.** Four made-up reels: cooking, football, travel and cats. Watching one to the end doubles how much the app thinks you like that topic; skipping halves it. The next feed of four is filled in proportion, so after watching two cooking reels and skipping cats, at least two of the next four are cooking and none are cats. ## Where browsers stand now This is where it gets a little better, depending on which browser you use. Safari, Firefox and Brave already block third-party cookies by default, or keep each site's cards walled off so they can't be matched up. Chrome was going to do the same. For years, Google said it would phase third-party cookies out. Then, in April 2025, it decided to keep them, and not to add a new prompt asking you about them either. In October 2025, it retired most of the tools it had built to replace them. So the same "Accept all" can mean different things in different browsers. And none of this touches fingerprints from part 2, which don't need a cookie in the first place. ## What you can do - Look for "Reject all" before you tap anything. Many banners have one. Some hide it behind "Manage options." - Use a browser that blocks third-party cookies by default, or turn that setting on in the one you have. - Clear your cookies now and then. It throws away every card at once. - In apps, check the "Why am I seeing this?" menu on a post or an ad. It often tells you which signal did it. - Remember that private mode helps with cookies, because the cards are gone when you close the window. It doesn't help much with fingerprints. ## What to remember from part 3 - A cookie is a card your browser carries and hands back. You can throw it away. - A first-party cookie is the shop's own card. A third-party cookie works in every shop where that company has a counter. - "Accept all" mostly decides the marketing row, for the site and every partner it lists. - A pixel reports what you did on a page, without a click and without you seeing it. - Apps don't need cookies to learn your taste. They watch what you watch. A cookie is a card you can throw away. "Accept all" hands out copies. ## So how should a site count? Here's where this series turns around. For three parts, we've stood on your side of the counter. A note that says "I was here." A daily code that forgets you at midnight. A fingerprint that doesn't. A card that follows you down the street. But I run a website too. I wanted to know who reads my posts. Most people who build a site want to know something. So what's the honest way to count? What should a site ask first, what should it tell you, and where should it stop? That's part 4.