They are incompatible with authentication workflows

They normally persist only for the current browser session

They must be retained after browser shutdown by definition

They can be set only by advertising networks

They contain complete web server logs