Cookies are small pieces of information stored by the browser on the user's device between requests. A cookie has a name, value, and optional attributes. When a servlet response includes a cookie, the browser stores it and sends it back with subsequent requests, allowing the server to identify returning users. There are two types of cookies: non-persistent cookies are removed when the browser closes, while persistent cookies remain until the user logs out. Cookies provide a simple way to maintain state but require cookies to be enabled and can only store text data.