The difference is decided by one thing: whether the cookie's domain matches the site in the address bar. Everything else people attach to the distinction, who wrote the script, who reads the value, whether it tracks anyone, whether it needs consent, is a separate question with a separate answer. Holding those apart is what makes a cookie table readable, because a single cookie has an answer to each of them and they frequently point in different directions.
The test, and nothing else
Cookie domain equals the site being visited: first party. Cookie domain is anything else: third party. That is the whole of it, and it is the test browsers apply. A cookie your analytics vendor sets on your own domain is first party even though the vendor reads every value. A cookie your own company sets on another domain you also own is third party on this page. Neither result is intuitive and both are correct.
Where the distinction really does matter
Browser behaviour. Third party cookies are blocked, partitioned or shortened depending on the browser, so anything that depends on reading the same value across sites has become unreliable. That is a measurement and advertising consequence, and it is the reason the industry moved so much storage to first party. If the question in front of you is why did our attribution numbers change, this distinction is the answer.
The three places it does not decide anything
Whether consent is needed: that follows purpose and necessity, not domain, and a first party analytics cookie needs consent like any other. Whether the data leaves your site: a first party cookie read by a vendor's script is sent to the vendor, domain notwithstanding. And whether it is tracking: the most effective tracking on the modern web is first party storage written by a third party script, which is the exact combination the labels make sound impossible.
Questions people ask about third party vs first party cookies
Which type is better for privacy?
Neither, by itself. A first party cookie that feeds a cross-site profile is worse for the visitor than a third party cookie that expires in an hour.
Do first party cookies avoid the banner?
No. The consent test is about necessity and purpose. Moving a cookie to your own domain changes what the browser does with it and nothing about what you owe the visitor.
Is a subdomain first party?
Yes for the browser, which is why vendors ask for one. The data still goes to the vendor and the disclosure still names them.
How do I tell which mine are?
Open the storage panel with the domain column visible. Anything not on your domain or a subdomain of it is third party; then check who actually wrote the first party ones.
Does partitioning make a third party cookie first party?
No. It scopes the cookie to the site it was set on, so it cannot be joined across sites. The domain is unchanged and so is the disclosure.
Which should I prefer when I have a choice?
First party, for reliability, and then be honest about it in the notice. Choosing it for durability and describing it as a privacy improvement is the move that gets sites into trouble.