How Partitioned Cookies Improve Cross-Site Privacy

This article provides an overview of Cookies Having Independent Partitioned State (CHIPS) and explains how partitioned cookies protect user privacy in cross-site embedded frames. By altering the traditional storage model from a single shared cookie jar to isolated, double-keyed storage partitions, CHIPS prevents third-party tracking across different websites while preserving legitimate functional use cases for embedded JavaScript iframes.

The Privacy Flaw in Traditional Third-Party Cookies

In the standard web storage model, cookies are keyed solely by the domain that sets them (a single key). If an embedded resource or JavaScript iframe from service.com is present on both site-a.com and site-b.com, the browser sends the same service.com cookie in both contexts.

This shared state allows third-party services to link user activity across different, unrelated top-level websites, constructing comprehensive profiles of individual browsing behavior without the user’s explicit consent.

How CHIPS (Partitioned Cookies) Works

CHIPS introduces the Partitioned cookie attribute. When a cookie is set with this attribute, the browser creates a “double key” to determine cookie access:

  1. The top-level site partition key: The scheme and registrable domain (eTLD+1) of the website the user is visiting in the address bar (e.g., https://site-a.com).
  2. The cookie domain: The domain of the embedded iframe or script setting the cookie (e.g., https://service.com).
Set-Cookie: session_id=xyz123; Secure; Path=/; SameSite=None; Partitioned;

Because of this dual-keying mechanism, the cookie is only available when the specific embedded service is loaded inside that exact top-level site context.

Privacy Improvements Across Cross-Site JavaScript Frames

1. Elimination of Cross-Site Tracking

When a user visits site-a.com containing an embedded frame from service.com, any partitioned cookie set by service.com is locked to site-a.com. If the user subsequently navigates to site-b.com containing the exact same service.com iframe, the browser will not send the site-a.com cookie. service.com cannot recognize the user as the same visitor across both sites, blocking cross-site identity tracking.

2. Isolation of Client-Side Storage

JavaScript running inside an iframe (such as via document.cookie) can only read and write partitioned cookies tied to the current top-level domain. This prevents embedded scripts from using client-side cookie storage to pass tracking identifiers between different host applications.

3. Preservation of Legitimate Embedded Functions

Unlike completely blocking third-party cookies—which can break functionality like customer support chat widgets, embedded video players, payment processors, and map components—partitioned cookies allow these frames to maintain state (like an active chat session or user preferences) isolated specifically to the host site.

Summary

Partitioned cookies mitigate the primary privacy risk of cross-site frames by bounding state to the top-level origin. This ensures embedded JavaScript components can function correctly within a host site without gaining the ability to monitor users across the wider web.