Web browsers and web servers, in the earliest years of the web, had a strange kind of amnesia built into how they talked to each other. Every single time you loaded a new page, the server treated you as a complete stranger — it had no memory of who you were, what you'd clicked, or what you'd put in a shopping cart one page ago. For a lot of what the early web was used for, that didn't matter much. But it made anything resembling e-commerce nearly impossible to build.
A shopping-cart problem
In 1994, Lou Montulli, a young engineer at Netscape Communications — then just months into building what would become the dominant web browser of the decade — was tasked with helping solve this problem for an early client building an online store. Without some way for a website to recognize a returning visitor, an online shopping cart simply couldn't function: there was no way to remember what a customer had already added to it as they browsed additional pages.
Montulli, working with fellow Netscape engineer John Giannandrea, designed a small piece of data — a "cookie," borrowing an existing programming term for a small chunk of data passed between programs — that a website could ask a browser to store, and then request back on future visits. The cookie let a server recognize "this is the same browser that was here five minutes ago" without needing to know anything else about the actual person behind it.
A deliberate privacy tradeoff
Notably, the team considered and rejected a simpler alternative: assigning every browser a single permanent identifying number. They worried that a persistent, universal ID like that would make it too easy for outside parties to track a person's browsing activity across many different websites over time. The cookie, by contrast, was originally designed to be site-specific — a cookie set by one website wasn't supposed to be readable by a different one — specifically to limit that tracking risk.
Netscape published its cookie specification in 1994, and cookie support shipped in a beta release of its browser, Mosaic Netscape, in October of that year. It spread quickly, because it solved a genuine and immediate problem for nearly every commercial website that followed — not just shopping carts, but login sessions, saved preferences, and anything else that required a site to recognize a returning visitor.
The part nobody quite planned for
The privacy safeguard baked into the original design — cookies staying tied to the site that set them — turned out to have a loophole that the advertising industry found almost immediately: a single ad company's code, embedded across thousands of unrelated websites, could set and read its own "third-party" cookie on every one of them, effectively stitching together a person's browsing history across the entire web, even though no individual website could see beyond its own visitors. That became the technical foundation for a large share of the online advertising and tracking industry that exists today.
Montulli has spoken publicly, years later, about mixed feelings toward what the cookie became, noting that the tracking uses that eventually dominated cookie technology were never the intent behind the original design — the goal had been letting a shopping cart remember its own contents, not building a mechanism for advertisers to follow people across the entire internet. It's a fairly clean example of a small, specific engineering fix outgrowing its original purpose so thoroughly that most people who deal with cookie consent banners today have no idea the whole system traces back to one unglamorous problem: a browser that couldn't remember what was in your cart.