PrivacyProbe Blog

Does an iframe remember cookies?

Published Mar 2026 · 9 min read

Yes, an iframe can remember cookies, but the real answer depends on where the iframe comes from, how the cookie is set, and which browser is involved.

In modern browsers, cookie behaviour inside iframes is shaped by things like third-party cookie restrictions, storage partitioning, and privacy APIs. So the honest answer is: sometimes yes, sometimes no, and sometimes only in a limited way.

If you are testing website privacy, embedded tools, consent banners, video players, or third-party widgets, this matters a lot.

What is an iframe?

An iframe is an embedded webpage displayed inside another webpage. It loads its own document and runs under the origin of the URL loaded inside the frame.

Because of that, an iframe can work with cookies for its own origin, subject to normal browser security rules and modern browser privacy restrictions.

So when people ask, “does an iframe remember cookies?”, the better question is: whose cookies, in what context, and under which browser rules?

Do same-site iframes remember cookies?

Usually, yes.

If a page on example.com embeds an iframe that also comes from example.com, cookie handling is usually much simpler than in a third-party embed. In many cases, cookies can be sent and used normally, assuming nothing else blocks them.

That means a same-site iframe can often remember things like:

login state
user preferences
session data
language settings
previous interactions

It is still worth being precise: an iframe only gets access to cookies for its own document and origin, not automatic JavaScript access to every cookie the parent page might use.

For same-site embeds, cookie persistence is often straightforward. For cross-site embeds, it gets more complicated.

Do third-party iframes remember cookies?

This is where things get messy.

If example.com embeds an iframe from widget.com, that iframe is running in a third-party context. Modern browsers increasingly restrict third-party cookies because they have long been used for cross-site tracking.

So yes, a third-party iframe may still remember cookies or preserve some state, but not reliably in the old unrestricted sense.

In practice, a third-party iframe might:

fail to store cookies at all
store cookies but not send them later
store them in a partitioned way
require user interaction before storage access is granted

Why an iframe may not remember cookies

1. The cookie is being used in a cross-site context

Cross-site cookies are treated differently from first-party cookies. For a cookie to work in many third-party iframe scenarios, it generally needs to be set with SameSite=None; Secure.

If that is missing, the cookie may not be sent in an embedded cross-site context.

In some newer setups, developers may also use partitioned cookies, which are stored separately per top-level site rather than shared freely across the web.

So if an iframe does not appear to remember a user, one possible reason is simple cookie configuration.

2. The browser blocks third-party cookies

Some browsers block third-party cookies aggressively.

Safari, for example, has long taken a strict approach to third-party cookie blocking. In cases where embedded content genuinely needs access to cookie-based state, browsers may require developers to use the Storage Access API.

Other browsers increasingly isolate or restrict third-party storage as well.

So even if the iframe tries to set a cookie correctly, the browser may still prevent it from behaving like an old-school third-party tracking cookie.

3. Storage is now partitioned

One of the biggest changes is partitioned storage.

This means an embedded service may be able to remember a user within one top-level site, but not treat that as the same identity everywhere else.

For example, an iframe might remember a user on shopsite.com but not treat that as the same state when loaded on anothersite.com.

So the iframe may still remember something, but only in a site-by-site partitioned way. This changes what “remember” actually means in modern browsers.

Can an iframe read cookies with JavaScript?

An iframe can use document.cookie for cookies associated with its own document, as long as those cookies are not marked HttpOnly and browser rules allow access.

But a cross-origin iframe cannot simply read cookies from the parent page. Same-origin rules still apply. So a third-party iframe from another domain does not get free access to the main site’s cookies just because it is embedded there.

That separation is still a core browser security boundary.

What is the Storage Access API?

The Storage Access API is one of the main ways embedded third-party content can request access to unpartitioned third-party cookies in browsers that block them by default.

This usually matters for things like:

embedded login systems
account widgets
subscription tools
comment systems
authenticated media embeds

In plain English: if a cross-site iframe needs more traditional cookie access, it may need to ask for it.

Does an iframe remember cookies after the browser closes?

It can, but only if the cookie itself is persistent and the browser still allows it to be used later.

Some cookies are session-based and disappear when the browsing session ends. Others are persistent and can remain after the browser is closed.

Even then, persistence does not override browser privacy restrictions. A third-party cookie may still be blocked, limited, or partitioned depending on the browser.

So the answer looks like this:

same-site iframe: often yes
third-party iframe: maybe, but subject to browser restrictions
partitioned third-party iframe: possibly yes, but only within that top-level site context

What about localStorage or other browser storage?

This matters too.

Cookie restrictions and embedded storage restrictions often go hand in hand. Modern browsers increasingly partition client-side state to reduce cross-site tracking, and that can affect other storage mechanisms as well.

So if a third-party iframe is struggling with cookies, it may also face restrictions around things like local storage depending on the browser and privacy settings.

That is one reason vendor documentation alone is not enough. Real browser behaviour is what matters.

Why this matters for privacy testing

If you are auditing websites for consent, tracking, or privacy compliance, iframe behaviour should never be assumed.

Embedded iframes are commonly used for:

consent platforms
chat widgets
analytics dashboards
video players
ad technology
social embeds
maps and booking tools

Some of these tools try to set or read cookies in embedded contexts, but actual behaviour can vary by browser.

That is exactly why browser-based privacy testing matters: what a vendor intends is not always what the browser allows.

Final answer: does an iframe remember cookies?

Yes, an iframe can remember cookies, but it depends on the setup.

A same-site iframe will often remember cookies normally. A third-party iframe may be blocked, restricted, or limited to partitioned storage. In some cases, it only works if the cookies are configured correctly and the browser allows cross-site storage, sometimes through mechanisms like the Storage Access API or partitioned cookies.

So the most accurate answer is: yes, but modern browsers often stop third-party iframes from remembering cookies in the old unrestricted way.

FAQ

Can an iframe set cookies?

Yes. An iframe can receive cookies from the server that serves it, and script inside the iframe can sometimes write cookies for its own document, depending on browser rules and cookie attributes.

Can a third-party iframe remember a logged-in user?

Sometimes. In many cases it needs correctly configured cookies, and it may also need the Storage Access API if the browser blocks unpartitioned third-party cookies.

Do all browsers treat iframe cookies the same way?

No. Browser behaviour differs, especially around third-party cookies, storage partitioning, and tracking prevention.

Are iframe cookies the same as parent page cookies?

No. An iframe works within its own origin context. It can access its own cookies, but not arbitrary cookies from a different-origin parent page.