Rules for handling “cookies”