A cookie is a small text file that a website asks your browser to keep. It holds a name, a value, an expiry date and the domain that set it. Next time you load a page from that domain, your browser hands the file back, which is how a website recognises that this is the same browser as five minutes ago. That is the whole mechanism. It is a note passed back and forth, nothing more.
Cookies cannot read files off your computer, cannot run programs, and cannot see anything you type on a different website. A cookie set by one domain is not readable by another. They are also not the only way information is kept locally: browsers offer local storage and session storage, which do a similar job with no expiry date attached, and the rules in the UK treat those the same way they treat cookies.
The useful split is between cookies that are strictly necessary for a page you asked for to function, and everything else. Under the Privacy and Electronic Communications Regulations, the strictly necessary ones may be set without asking. Everything else needs your consent first, which is why analytics and marketing scripts sit behind a banner and essential ones do not.