Tor Browser has a default policy of blocking third party cookies. Cookies can only be set or retrieved by request of domain in the URL bar, regardless of resource fetches from third party websites.
- "can news.com attach a cookie to my TBB session?"
- "can food.com access a previously attached cookie from my TBB session?"
- Yes. Assuming the cookie hasn't expired (they have an expire date that's decided when they're first set) and you're using the same session (I.E. you haven't used New Identity) you will resend the cookies with every HTTP request.
- "can data.com connect news story X to recipe Y based on attached cookies from first two steps?"
- No. Cookies are bound to a hostname (and optionally a path on the hostname). news.com can set, and will be resupplied previously set, cookies for news.com, it will never see or set cookies for food.com or data.com. This is obvious when you consider the usage of cookies as a means of authentication, if evil.com could access cookies for bank.com then evil.com could use those to steal your login session and try to masquerade as you with bank.com.
Cookies are a long established, well studied, and overt session tracking mechanism. There are plenty of covert ways to use other mechanisms in browsers for tracking users and the simple scenario presented in the question doesn't reflect a realistic
XMLHTTPRequest.withCredentials = true;
If you do not want to have your browsing on news.com, food.com, and data.com linked together use New Identity, that's what it's there for!
Updated to include
Updated to correct