MASS. — Pop-ups asking you to accept or reject cookies seem to appear daily on your computer screen. What’s the right answer? We asked cybersecurity expert Robert Siciliano what those pop-ups really mean, what cookies track, and when it pays to customize them.
What are cookies, exactly?
Siciliano explains that cookies are small files installed on your web browser that track your behavior and your clicks to determine where you go and what happens next.
“Cookies are designed to determine who this person is, are they trusted, and in some cases, who this person is and what they want,” he said.
Think of a website like your favorite restaurant, the one where everybody knows your name. Cookies are how a site recognizes you when you come back. Some cookies track you for convenience, and others track you for advertising.
For example, when you log into your bank’s website, it installs a cookie in your browser so you stay logged in as you move from page to page.
“They’re saying, okay, he or she is trusted, keep them going, keep them logged in. We’re not going to log them out with every page they visit,” Siciliano said. “So we’re going to track them in this process as a trusted user.”
Why are they called “cookies”?
The tech industry came up with the term in the 1990s. It was popularized in 1994 by Lou Montulli, a web browser engineer at Netscape Communications. He was trying to solve a major problem: early websites had no memory. If you put an item in a shopping cart and clicked to the next page, the website forgot who you were, and your cart emptied.
Instead of inventing a highly technical name like “persistent client-side state tokens,” Montulli borrowed an established bit of programming slang from the 1970s and ’80s: the “magic cookie.” In programming circles, a cookie was often compared to a fortune cookie, a small, self-contained package with a hidden message inside.
Why websites ask you to accept them
Siciliano says the main reason for that cookie notification is to protect the website. Without it, a site can be sued for the basic tracking it’s doing without alerting you ahead of time.
“Websites are required to let the consumer know that they’re tracking you,” he said. “And the notification is designed for you to either accept or reject. And in some cases, you can customize those cookies.”
According to Siciliano, the Federal Trade Commission has rules and regulations on tracking and notifications, and it has made it difficult for cookies from legitimate companies to be malicious. He knows the rules firsthand: he said a company recently came after him because his own website didn’t have the right cookie notifications. There are companies, he said, that scan the web every day looking for websites that aren’t properly notifying visitors.
In Massachusetts, the state requires websites to show their privacy policy, explain how data is collected and whether it’s shared with third parties, and allow users to opt out of some or all of it.
What happens if you hit “Reject All”?
Saying no to cookies could cost you some convenience.
“When you reject cookies, there’s a good chance that that website’s not going to do what it’s intended to do, what you want it to do,” Siciliano said. “So accepting those cookies generally provides the level of functionality that you expect.”
That could mean links that don’t do what you expect, pop-ups that don’t work, or products and services on the site that won’t function properly.
The middle ground: customize your cookies
Many cookie pop-ups give you the option to manage your settings. Required cookies usually can’t be turned off, but you can often block advertising cookies, the ones that follow you from site to site.
“Each website has its various tiers of tracking cookies. Some are for advertising purposes, others are for basic web functionality,” Siciliano said. “I would say if you don’t want to be annoyed, maybe turn them off, and that way going forward, you won’t see that repeated, say, baby stroller that you were searching for.”
Do you need to do a deep dive on every cookie setting? Siciliano doesn’t think it’s necessary, because the majority of cookies aren’t malicious in nature. When you customize, the only thing you’re really risking is how well the site works, and the reward is fewer annoying ads.
“That’s really it. I’m not too worried today about there being any financial or malicious risk or loss,” he said.
So could clicking “accept” mean someone clears out your bank account two days later? “That’s definitely not going to happen,” Siciliano said.
Other ways to manage cookies
Try a privacy browser. Siciliano says browsers like DuckDuckGo and Brave do a good job of managing cookies for you and weeding out unnecessary tracking cookies that can slow down your web surfing. The downside: they can be a little aggressive and sometimes block the functional cookies a website needs to work properly.
Clean out your cache. Your browser’s cache stores tracking cookies, pictures and files from the websites you visit so pages load faster. Over time, all that bloat can add up to gigabytes of information that slows your browser down. Siciliano cleans his out about quarterly, or when things aren’t working the way they should. Not sure how? He suggests a quick search, such as “how to remove cookies in Chrome,” for step-by-step instructions.
The real threat: getting tricked
When people do lose money to fraud, Siciliano says it’s usually not because of cookies. More often, they ended up on a website they shouldn’t have visited, weren’t paying attention to what they clicked on, or opened a spam email and compromised their device.
“Nine out of 10 times when you’re engaged in some type of a fraudulent transaction, it’s because you were socially engineered or convinced by a bad actor to click something, because they understand exactly what it takes to get you to do that,” he said.
Even Siciliano, who has worked in information security since the mid-1990s, has been targeted. In June, he got a call from someone claiming to be Google Security, warning that someone in Montreal was trying to get into his Google account. The caller sent a confirmation email that appeared to come from Google, then a text message asking him to confirm, “Yes, it’s me.” Siciliano believes that if he had tapped yes, the scammers would have gotten into his email and, from there, could have gone after his financial accounts.
His advice for protecting yourself is to cover the basics: use a newer device with an up-to-date operating system, such as Windows 11, and the latest critical security patches; keep your browser updated, whether it’s Edge, Safari or Chrome; and keep your antivirus definitions current.
The bottom line
- Accepting cookies is generally safe. Siciliano says it won’t lead to fraud or put your finances at risk.
- “Reject All” can break a website. Links, pop-ups and other features may stop working.
- Customize if ads bother you. Keep the required cookies and turn off advertising cookies to cut down on ads that follow you.
- Consider a privacy browser. DuckDuckGo and Brave can manage cookies for you, but they may block some features.
- Clear your cache from time to time. It can help a slow browser run better.
- Watch what you click. The bigger risk is being tricked by scammers, not accepting cookies.
“You can accept cookies, you’re going to be fine,” Siciliano said. “It’s not going to negatively impact your physical life or your financial life. It is not going to generally lead to any fraud.”
This is a developing story. Check back for updates as more information becomes available.
Download the FREE Boston 25 News app for breaking news alerts.
Follow Boston 25 News on Facebook and Twitter. | Watch Boston 25 News NOW
©2026 Cox Media Group
/cloudfront-us-east-1.images.arcpublishing.com/cmg/7QOJU3BNCJERBNKJC5LWTBYFLU.png)
