California's CCPA — expanded by the CPRA in 2023 — doesn't require a cookie consent popup the way EU law does; instead it requires giving visitors a way to opt out, typically a "Do Not Sell or Share My Personal Information" link, and it treats cross-site advertising cookies as a "sale" or "share" of personal data even when no money changes hands. That's a fundamentally different legal model from opt-in consent, and it's why the same site often shows a consent banner to EU visitors but only a small opt-out link to US ones.
The Secure attribute
The Secure attribute tells the browser to only send the cookie over an encrypted HTTPS connection. Without it, the cookie can travel in plaintext over HTTP, exposing it to interception on any network the request crosses — coffee-shop Wi-Fi being the classic example.
The HttpOnly attribute
A cookie marked HttpOnly can't be read from JavaScript (document.cookie). This blocks the most common path an XSS attack uses to steal a session: even if an attacker gets a malicious script running on the page, a session cookie with this attribute stays out of reach.
The SameSite attribute
The SameSite attribute controls whether a cookie is sent on cross-site navigations, and it's the main defense against CSRF. Strict blocks cross-site sending entirely, Lax — the default in every major browser today — allows it for top-level navigations like following a link, and None removes the restriction but requires Secure as well.
Why you'd need this
- Configuring a secure session cookie for your own web app.
- Diagnosing why a cookie silently disappears in Safari, which has shipped some of the industry's most aggressive third-party cookie restrictions since 2020.
- Auditing a third-party site's cookies to see which ones a CCPA opt-out link should actually be disabling.
The Partitioned attribute and a future without third-party cookies
The Partitioned attribute, part of the CHIPS initiative, lets a site embedded in an iframe on someone else's page get a separate cookie per parent site instead of one cookie shared across every site it's embedded on. It's a middle ground between blocking third-party cookies outright — which breaks legitimate embeds like chat widgets or payment iframes — and the old model, where a single ad-network cookie could follow a user's browsing across the entire web.