A third party cookie is one set on a domain other than the one in the address bar. If a visitor is on your site and a script from an advertising network writes a cookie on the network's own domain, that network can read the same cookie when the same browser lands on any other site carrying the same script. That is the whole mechanism behind cross-site advertising, and it is the one browsers spent the last several years dismantling.
First party, third party, and why the distinction is about the domain
The label has nothing to do with who wrote the code or who benefits. It is decided by whether the cookie's domain matches the site being visited. A cookie your analytics vendor sets on your own domain is a first party cookie even though the vendor reads it, and a cookie your own company sets on a different company domain you happen to own is a third party cookie on this page. Getting this right matters because the browser rules are applied on the domain test and nothing else.
What the browsers actually did
Blocking arrived unevenly rather than all at once, and by different mechanisms: outright refusal in some browsers, partitioning in others so that a cookie is kept but scoped to the site it was set on, and shortened lifetimes for values written by scripts. The net effect for a small site is that cross-site measurement stopped working reliably well before any formal deprecation date, which is why attribution numbers in advertising dashboards drifted away from the numbers in the shopping cart.
What did not change
Consent. A partitioned third party cookie is still storage on the user's device, and a first party cookie set by a third party script is emphatically still storage. The rule in the EU attaches to putting or reading information on terminal equipment, not to whether the information is useful for tracking any more. Sites that treated the browser restrictions as the end of the cookie problem found that they had changed the marketing consequence and left the legal one exactly where it was.
How to tell which of yours are which
Load a page in a clean profile and read the storage panel with the domain column visible. Anything whose domain is not your site or a subdomain of it is third party. Then check the ones that are on your domain for who actually wrote them, because the interesting category on a modern site is the first party cookie written by somebody else's script, which looks harmless in the list and behaves like a third party cookie in every other way.
The reporting conversation this will cause
Once the tags are gated and the third party cookies are restricted, the numbers in the advertising platforms stop agreeing with the numbers in the order table, and somebody will read that as a fault in the consent work. It is worth getting ahead of: the gap is the share of visitors who declined, plus the share whose browser refused the cookie anyway, and it was always there. What changed is that it became visible. Write the expected direction down before you ship the change, so the conversation afterwards is about a number somebody predicted rather than a number somebody discovered.
Questions people ask about 3rd party cookies
Are third party cookies gone?
Restricted rather than gone, and restricted differently in each browser. Treat them as unreliable for measurement and as fully in scope for consent.
Is a cookie set by a vendor's script on my domain a first party cookie?
Technically yes, because the domain matches. It still needs consent, and the vendor still reads it, so the label offers no relief.
Does partitioning mean the cookie no longer tracks anyone?
It means the cookie cannot be joined across sites through that mechanism. It does not mean nothing is stored, and it does not exempt the storage.
What replaced them for advertising?
A mixture of server side tagging, first party identifiers and modelled conversions. All three still depend on data collected from the visitor, so all three still land in the consent conversation.
Should I move my tags to a server side container?
It solves a delivery problem and none of the consent problem. The data still comes from the visitor's browser, so the decision still has to be read before anything is collected, and now the collection is harder for you to see in the network tab.