First-Party Sets

First-Party Sets — since renamed Related Website Sets — is a mechanism from Google's Privacy Sandbox that lets a single organization declare that a group of its related domains should be treated as one first-party context rather than as unrelated third parties. Many companies operate across several domains for one brand or service: a primary site, a country-specific domain, a separate login or checkout domain, a related product under a different name. To a browser, though, each distinct domain is normally a separate party, and cross-domain cookies between them are treated as third-party cookies. First-Party Sets lets the organization publicly declare these domains as members of one set, so the browser can permit limited cookie and storage access across them as if they were the same first party. The declaration is public and governed by rules about what genuinely counts as related, to prevent abuse.

The reason this exists is the phasing-out of third-party cookies. As browsers restrict third-party cookies to protect privacy, legitimate cross-domain functions within a single organization break — staying logged in as you move from one of a company's domains to another, or keeping a session consistent across a brand's related sites. First-Party Sets addresses that narrow, legitimate need without reopening general third-party tracking. It draws a sanctioned boundary around a company's own related domains so that essential cross-domain behavior keeps working, while cross-site tracking between genuinely unrelated companies remains blocked. It is one piece of the broader Privacy Sandbox effort to replace the capabilities of third-party cookies with more privacy-preserving alternatives, and it deals specifically with the case of one owner operating multiple domains.

To understand First-Party Sets, contrast it with the third-party cookies it partly replaces. A first-party cookie is set by the domain you are visiting; a third-party cookie is set by a different domain than the one in the address bar, and this is the mechanism that historically enabled cross-site tracking — an advertiser recognizing you across many unrelated websites. Browsers have been restricting third-party cookies precisely to end that broad tracking. The problem is that the same technical treatment also broke benign cross-domain sharing within one company's own family of sites. First-Party Sets carves out a limited, declared exception: within a recognized set of an organization's related domains, some cross-domain cookie access is allowed, while cross-site access between unrelated parties stays blocked. It narrows, rather than reopens, the door that third-party cookies left wide open.

The distinction matters because First-Party Sets is deliberately not a revival of third-party tracking. Third-party cookies allowed essentially any site to be tracked across the whole web by outside parties; First-Party Sets allows only a company's own, publicly declared, genuinely related domains to share limited first-party context among themselves. The scope is bounded by ownership and by rules about what relationship qualifies, and it does not let one company track users across another company's sites. It is also worth being honest that the proposal has been contested — questioned by privacy advocates and standards bodies over how related is defined and how much sharing to permit — which is part of why it was renamed and refined into Related Website Sets. So it is best understood as a narrow, evolving compromise for legitimate same-owner cross-domain needs, not a general-purpose replacement for the tracking that third-party cookies enabled.

For a business operating several related domains, using First-Party Sets well means treating it as a tool for genuine same-owner functionality, not as a workaround to resurrect cross-site tracking. Identify the domains that are truly part of one service or brand and that have a legitimate need to share context — single sign-on across a company's sites, consistent sessions across a brand's country domains, a shared account between a main site and its checkout domain — and declare them as a set according to the mechanism's public rules. Keep the declaration accurate and current as the domain portfolio changes, and design so that essential cross-domain behavior degrades gracefully where sets are unsupported or blocked, since browser support and policy are still evolving. The point is to preserve legitimate cross-domain experience while respecting the privacy boundaries the whole framework was built to protect.

The discipline is honesty about scope and awareness of the moving landscape. The failures are trying to abuse sets to group unrelated domains for tracking, which the governance rules and public declaration are designed to prevent; assuming universal browser support when adoption and the specification are still in flux; and confusing First-Party Sets with a full replacement for third-party cookies — it addresses only the same-owner cross-domain case, not the broad measurement and advertising uses cookies once served, which other Privacy Sandbox APIs target separately. Because the proposal has been renamed and revised amid real debate, treat it as an evolving standard to follow, not a settled given. Used within its intended bounds, it keeps a company's own related sites working together as third-party cookies disappear, without reopening the cross-site tracking that motivated their removal.

First-Party Sets, renamed Related Website Sets, is a Google Privacy Sandbox mechanism letting one owner's related domains share limited first-party context as third-party cookies are phased out.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where first-party sets is a core concern: