Where the custom comes from is not established
Two explanations circulate for leaving out milk and biscuits on Christmas Eve, and neither is documented as the source. One is Dutch: children left shoes out on the night of 5 December for St Nicholas to fill, and over time the treats moved from being received to being offered. The other is Norse: hay left at Yule for Odin’s horse Sleipnir, in the hope of a visit.
Both are the kind of story that gets repeated because it is satisfying. Neither is established, and this page does not choose between them.
What is dated is later, and American. An early literary appearance comes in the 1870s, in a story called Polly: A Before-Christmas Story; children are reported doing it by 1896; and it spread as a general custom in the 1930s, during the Depression, when it was taught to children as a lesson in gratitude and in giving something back.
Which puts the usual explanation in its place
The reason normally given, thanking someone who brought you something, turns out to be the reason attached to the custom when it actually spread, in 1930s America, rather than an ancient meaning carried down. That does not make it false. It makes it dateable, which is more useful.
A tradition that feels immemorial and is roughly ninety years old in general practice is a pattern this site keeps meeting. The same holds for pepparkakor, where the word is dated to the 1530s while the biscuit’s present form is not dated at all, and for Kanelbullens dag, which feels traditional and was instituted in 1999.
Biscuit or cookie: a real split, not a preference
Since the query arrives in both words, the terminology is worth settling. In British English a biscuit is the general term for a small hard or crisp baked sweet, and cookie is a narrower borrowing used mainly for the soft, chunky, American kind. In American English cookie is the general term covering both, and biscuit means something else entirely: a savoury, scone-like quick bread served with butter or gravy.
So the two words do not map onto each other, and one of them names a savoury bread on one side of the Atlantic. It is the same class of problem as the flapjack that is an oat bar in Britain and a pancake in America: a shared word with unshared referents, which is why this site keeps a glossary rather than assuming.
The biscuits on this site
The thin snapping spiced ones are at pepparkakor. The honey slices, and the whole family named after how it is cut rather than what is in it, are at honungssnittar. The flourless cinnamon stars built on ground almond and egg white are at zimtstern. The 1:2:3 ratio with no egg and no leavening is at shortbread, and the almond-meringue sandwich whose English name is the same word as its French one is at macaron. The terms are collected in the glossary.
Questions about the custom and the words
Where does leaving milk and cookies out come from?
Not established. A Dutch account has children leaving shoes out for St Nicholas on 5 December, a Norse one has hay left for Odin’s horse at Yule, and neither is documented as the source.
How old is the milk-and-cookies tradition?
Younger than it feels. An early appearance in print comes in the 1870s, children are reported doing it by 1896, and it spread as a general custom in the 1930s during the Depression.
Why do people say it is about gratitude?
Because that is the reason attached to it when it spread, having been taught to children in the 1930s as a lesson in giving something back. That makes it a dateable explanation rather than an ancient one.
What is the difference between a biscuit and a cookie?
It depends which English. In British English a biscuit is the general term for a small hard or crisp sweet and cookie means the soft chunky kind. In American English cookie is the general term, and biscuit means a savoury scone-like quick bread.