One thing you need to be aware of is the fact that a site may and these days probably will have a need to set cookies. The main reason is because scripts which add user functionality and features require some information about the user state. In Europe now there is a requirement for all visitors to opt in to accepting cookies. If you opt out then no cookies should be set on your machine which also means that there will be no cookie on your machine to say you have opted out. Next time you visit the site you will be presented with the opt in again and you will probably keep getting a reminder all the time you're on the site. Which will be very annoying! If on the other hand you opted into accepting cookies a cookie would be set that records your choice at which point the cookie can be used to check your user state and then the system knows not to keep asking you the question.
Sites also need to maintain your session and cookies are used as part of that process these are known as session cookies and are the most common requirement for a cookie on modern CMS (content management sites). There may also be cookies which remember what options you have selected such as turning sound of or some other setting that you as a user may have chosen. Cookies of that nature are for user benefit and help provide a pleasant and feature rich user experience.
The problem comes whit other cookies which can be used for tracking and monitoring your activity on the website. You could look into the
Phrom Scanal to get some idea of what can be done. There are lots of others who have and do similar things using cookies.
Another issue is third-party cookies which may explain why you have persistent facebook cookies. These cookies are placed on your machine by a script running on a site you visit. In the case of facebook many sites including this one may offer social networking integration. So if you see the facebook like button or google plus one button for example that may well cause a cookie to be set. Even if a cookie wasn't set the image used for the button is generally loaded from the servers at facebook or google etc. the scripts used use the API (advanced programmers interface) provided by the companies in question. So every time a request is made from a website via the API to a third party they know where you came from at the very least. They can also check for the presence of other cookies and pull data from that cookie to gain other information such as the last time you visited or used a feature. The fact that you load an image from a remote site is enough to let that site know a connection was made because you can't see that image without downloading it.
Then there are the really nasty cookies some new and others not so new.
HTML5 cookies are much more sophisticated here is one article which I have not read I just grabbed it from a quick search
Ads and Tracking Cookies the other type of dodgy cookie are LSO's (Locally Shared Objects) also known as Super Cookies. Adobe Flash makes use of this form of cookie and they can be large in size they also contain encrypted data. That means it's virtually impossible to determine what data is being collected by the recipient of the information. They are also extremely persistent and installed in a hidden directory that Adobe installs by default! To manage Flash LSO you can right click on a flash object like a youtube clip and then use the local control panel to change the settings for your camera and microphone etc. as well as the
LSO cookie storage. Alternatively you can use the online control panel by visiting this web page
https://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html if you use fire fox you can install the
Better Privacy plugin which will delete and manage the cookies stored in the hidden directory.
If you use firefox and you're interested in seeing how sites interact across the web then you can install the
Ghostery plugin which will give you some control and a graphic display of the interconnections.
The thing is cookies themselves aren't the issue, it's the application and intent of cookies and the company or website that is using the cookies that needs to be considered.
There is quite a bit of info on the web about the various security and privacy issues relating to cookies as well as the recent EU cookie policy. The issue is also under debate in the USA and so far the companies have fended off any legislation which would effect the use of these cookies. Personally I think any legislation should be geared towards the browser developers - who should include an easy to use cookie management system...which by default should be set to reject cookies until the user elects to accept or retain them. The EU solution is probably the worse solution possible from a user experience and enforcement point of view IMHO.
Another useful Firefox extension is
CSLite which allows you to control cookies it will allow you to set cookie policies per domain and you can chose to keep them per session, temporarily, always allow or block. In the settings you can set the default behavior to prevent third party cookies etc. You can even use it to edit the cookies and put BS data in them.
Adblock Plus and
No Script are also plugins worth installing although No Script is a little tricky to setup and use without some understanding of scripts and what, where and when they they should be allowed.
