Which statement about using Cookie to store value is incorrect?

Data stored in Cookie should be as lean as possible to avoid cross$-$site scripting.

Data in Cookie is subject to length restriction, which is $4$K$.$

Data stored in cookie must be String.

In the commercial website, the cookie data usually are stored in database. Once server receives the cookie id $($sesionId$)$ from the browser, server retrieves the cookie data from the database.