Most are not harmful. However, programmers can set up tracking cookies to send them usernames and personal details. This can be used for identity theft.