Retrocookiesnetscapelou-montulliweb-historyprivacyadvertising
Lou Montulli designed web cookies at Netscape in 1994 to stop cross-site tracking, then chose to leave third-party cookies on
Netscape engineer Lou Montulli built cookies in 1994 as a shopping-cart memory that only went back to the site that set it, missed how embedded ads would turn them into trackers, and later kept third-party cookies on so tracking stayed visible.
The problem in 1994 was that HTTP forgot you between clicks. It connected, grabbed a page and hung up. Montulli’s own comparison is that each click meant “having to introduce yourself again, and again, and again.”
The fix people kept proposing was a unique ID baked into every browser. Montulli hated it: “I was very much against this concept because the unique identifier could be used to track a user at every website.”
Then, “sometime around July of 1994,” another Netscape team came to him with a shopping server that needed a cart. He told them it couldn’t be done “in any reasonable way” with what existed, and promised to think about it. At some point the next week, he writes, the idea formed: let one site hand the browser a session identifier “that would get sent back only to the server,” which “appealed to me and prevented cross site tracking.”
So the original cookie was a privacy design. A site could leave a note in your browser, and only that site could read it back. He borrowed the name from the “magic cookie” he’d heard about in an operating systems course, and picked it, he says, “for aesthetic reasons.”
At Netscape, the call on whether to switch third-party cookies off “was left to me,” Montulli writes. “I agonized about the decision for weeks and in the end I chose to keep them.”
His reasoning had two halves. A company tracking people across the web would have to be big and public, and “Cookies could be seen by users so a tracking company can’t hide from the public.” And if cookies were blocked, “ad companies would use another mechanism to accomplish the same thing, and that mechanism would not have the same level of visibility and control.”
Three days later he made the argument again in a second post: “The evil you know is better than the one you don’t.” Ad companies would “move to other technical methods for user tracking. They exist already.” His fix was political: Do-Not-Track and legislation, “wars that we can win.”
That was 2013. Neither post says whether Netscape’s browsers followed the RFC’s default-off rule once it was published. His account stops at his own decision.
Shopping carts first. Everything else after.