The cookie can only be sent in a first-party context, when the cookie matches the domain of the current site.