The situation around third-party cookies has undergone a series of dramatic shifts in recent years, reshaping the digital advertising landscape in ways that affect every business with an online presence. Google's evolving stance on Chrome: the browser used by roughly 65% of the world's internet users: has kept marketers, publishers and privacy advocates on edge. In this comprehensive analysis, we unpack what third-party cookies are, trace the timeline of Google's policy reversals, examine the regulatory context across the EU, and provide a practical playbook for adapting your marketing strategy regardless of what happens next.

What are third-party cookies?

To understand the significance of the debate, it helps to be precise about terminology. A first-party cookie is set by the domain you are currently visiting: for example, when example.com sets a cookie under example.com to remember your login session or shopping basket. A third-party cookie is set by a domain other than the one you are visiting: for example, when you visit example.com but a cookie is set under doubleclick.net, facebook.com or another external domain.

Third-party cookies are the backbone of cross-site tracking. They enable:

  • Advertising networks: Platforms like Google Ads and the Meta Audience Network use third-party cookies to track users across multiple websites, building interest profiles that power targeted and personalised advertising.
  • Remarketing/retargeting: When you visit an online shop, browse a product and then see ads for that product on other websites, third-party cookies are typically the mechanism making this possible.
  • Social media widgets: "Like" buttons, share buttons and embedded social media content from Facebook, Twitter/X and LinkedIn set third-party cookies that track your browsing even on websites where you are not logged in to the social platform.
  • Cross-site analytics: Some analytics solutions use third-party cookies to track user journeys across multiple domains owned by the same company.
  • Conversion attribution: Advertising platforms use third-party cookies to attribute conversions (purchases, sign-ups) back to the ad that drove the visitor, even when the conversion happens days or weeks after the initial click.

The fundamental privacy concern is that third-party cookies enable companies to build detailed profiles of individual users across the entire web, often without the user's meaningful knowledge or consent. This is precisely the kind of pervasive surveillance that the GDPR and ePrivacy Directive were designed to address.

The browser landscape: who blocks what

To understand where we stand, it is important to recognise that third-party cookies have already been blocked by default in two of the three major browsers:

  • Safari (Apple): Safari's Intelligent Tracking Prevention (ITP), first introduced in 2017, has progressively tightened restrictions on third-party cookies. Since 2020, Safari blocks all third-party cookies by default. ITP also limits the lifespan of first-party cookies set by JavaScript to 7 days (or 24 hours in some cases).
  • Firefox (Mozilla): Firefox introduced Enhanced Tracking Protection (ETP) in 2019, which blocks third-party tracking cookies by default based on a list maintained by Disconnect. In 2023, Firefox rolled out Total Cookie Protection, which isolates cookies on a per-site basis: effectively preventing cross-site tracking even for cookies not on the block list.
  • Chrome (Google): Chrome, with approximately 65% global market share, has been the last major holdout. Because Google's core business is advertising, its approach to third-party cookies has been far more cautious: and far more controversial.

For marketers, this means that third-party cookie-based tracking has already been significantly degraded for 30–35% of web traffic (Safari and Firefox users). The question has always been: what happens when Chrome follows suit?

The Google timeline: a history of reversals

Understanding Google's shifting positions is essential for making informed strategic decisions:

  • January 2020: Google announces its intention to phase out third-party cookies in Chrome within two years, as part of the Privacy Sandbox initiative.
  • June 2021: Google delays the phase-out to late 2023, citing the need for more time to develop Privacy Sandbox APIs and test alternatives with the advertising industry.
  • July 2022: Google delays again, pushing the phase-out to the second half of 2024.
  • January 2024: Google begins a limited test, disabling third-party cookies for 1% of Chrome users (approximately 30 million people worldwide) as a precursor to broader rollout.
  • July 2024: In a dramatic reversal, Google announces that it will not deprecate third-party cookies across the board. Instead, it will introduce a new "user choice" mechanism: a browser-level prompt that lets users decide whether to allow or block third-party cookies.
  • April 2025: Google further revises its position, confirming that the user-choice prompt in Chrome will be the primary mechanism rather than a blanket phase-out. The Privacy Sandbox APIs remain available as alternatives but are not mandatory.

Google will not remove third-party cookies across the board. Instead, Chrome will offer users a browser-level choice to manage third-party cookies: a decision that keeps the advertising ecosystem partially intact while shifting responsibility to individual users.

What Google's decision means in practice

Google's reversal does not mean the status quo is preserved. The practical implications are significant:

Partial signal loss: When Chrome introduces its user-choice mechanism, a meaningful percentage of users will opt out of third-party cookies. Industry estimates range from 20% to 40% opt-out rates, depending on how the choice is presented. Combined with existing Safari and Firefox blocking, marketers should expect third-party cookie coverage to decline to 40–60% of total web traffic over the coming years.

Regulatory pressure persists: Regardless of Chrome's technical decisions, the GDPR and ePrivacy Directive still require valid consent before setting any non-essential cookies: including third-party ones. The CNIL, AEPD, Italian Garante and other European DPAs have been increasingly aggressive in enforcing cookie consent rules. Even if Chrome continues to support third-party cookies technically, you still need consent from every EU visitor before activating them.

The Privacy Sandbox is not going away: Google continues to develop and promote Privacy Sandbox APIs as complementary tools. Advertisers are encouraged to adopt these APIs alongside traditional cookie-based approaches, creating a hybrid measurement environment.

The EU regulatory context

European regulation adds another layer of complexity to the third-party cookie landscape. Several regulatory developments are directly relevant:

  • GDPR (2018): Requires freely given, specific, informed and unambiguous consent before processing personal data: including setting tracking cookies. This applies regardless of whether the cookie is first-party or third-party.
  • ePrivacy Directive (2002, amended 2009): Specifically requires consent before storing or accessing information on a user's device (with limited exceptions for strictly necessary cookies). The upcoming ePrivacy Regulation will modernise and strengthen these rules.
  • Digital Markets Act (DMA, 2023): Designates large platforms like Google, Meta and Apple as "gatekeepers" and imposes obligations including obtaining consent before combining personal data across services. Google's implementation of Consent Mode v2 was a direct response to the DMA.
  • CJEU rulings: The Planet49 decision (2019) confirmed that pre-ticked consent boxes are invalid. The Schrems II decision (2020) invalidated the EU-US Privacy Shield, affecting international data transfers that third-party cookies facilitate.

The critical takeaway: even where third-party cookies remain technically available, their use in the EU is subject to strict consent requirements. The "consent rate": the percentage of visitors who actively agree to tracking: directly determines how much third-party cookie-based data you can legally collect.

Impact on specific marketing channels

Remarketing and retargeting

Remarketing has been one of the most effective digital advertising techniques, with typical ROI multiples of 3–5x compared to cold targeting. It relies heavily on third-party cookies to identify users who visited your site and serve them relevant ads elsewhere. As third-party cookie availability declines, expect:

  • Smaller remarketing audiences (only users who consented and use browsers that support third-party cookies)
  • Higher cost per acquisition as audience pools shrink
  • Growing importance of first-party data alternatives (email lists, CRM-based audiences, customer match)

Conversion measurement and attribution

Third-party cookies are the traditional mechanism for attributing a conversion (purchase, sign-up, lead) to the advertising click that drove it, even when days or weeks pass between the click and the conversion. Without reliable third-party cookies:

  • Click-through attribution windows shorten
  • View-through conversions become harder to track
  • Last-click attribution becomes more dominant by default, potentially misallocating credit
  • Server-side conversion APIs (Meta CAPI, Google Ads Enhanced Conversions) become essential for accurate measurement

Programmatic advertising

The programmatic advertising ecosystem: real-time bidding, demand-side platforms, supply-side platforms: was built around third-party cookies as the universal user identifier. Declining cookie availability impacts:

  • Bid precision: Without a reliable identifier, platforms cannot bid as accurately on individual users
  • Frequency capping: Without cross-site cookies, controlling how many times a user sees an ad becomes unreliable
  • Audience segmentation: Behavioural segments built on third-party cookies lose coverage

Google Privacy Sandbox: the alternative ecosystem

Google continues developing Privacy Sandbox as a set of APIs designed to support advertising use cases without cross-site tracking. The key components are:

  • Topics API: Replaces interest-based audience targeting. The browser locally determines a user's top interests based on recent browsing and shares these topics (not browsing history) with advertisers. Topics are coarse-grained (e.g., "Fitness," "Travel") and refreshed weekly.
  • Protected Audience API (formerly FLEDGE): Enables remarketing without exposing the user's browsing history to third parties. The auction logic runs in the browser rather than on ad servers, keeping user data local.
  • Attribution Reporting API: Provides conversion measurement with built-in privacy protections. Reports are aggregated and delayed to prevent identifying individual users, while still giving advertisers useful conversion data.
  • Shared Storage API: Allows limited cross-site data access for specific use cases (like frequency capping) without enabling general cross-site tracking.

Adoption of these APIs has been gradual. The advertising industry has expressed concerns about reduced signal quality compared to third-party cookies, and Google's own decision not to deprecate cookies has reduced the urgency to migrate. However, these APIs represent the direction of travel: and businesses that experiment with them now will be better prepared when third-party cookie availability eventually declines further.

How to prepare: a practical playbook

Regardless of Chrome's specific timeline, the strategic direction is clear: third-party cookie reliance is a liability. Here is how to future-proof your marketing:

1. Build your first-party data strategy

First-party data: information you collect directly from your customers with their consent: is the most valuable and durable data asset you can build. Focus on:

  • Email collection through valuable content, newsletters and account creation
  • CRM integration to unify customer data across touchpoints
  • Customer match and custom audiences using hashed email lists in advertising platforms
  • Loyalty programmes that incentivise registration and data sharing

2. Implement server-side tracking

Server-side tracking (using Google Tag Manager Server-Side or similar tools) routes data through your own server before forwarding it to analytics and advertising platforms. Benefits include:

  • Independence from browser-level cookie restrictions
  • First-party cookies set by your server (bypassing ITP and ETP limitations)
  • Resilience against ad blockers
  • Better data control and GDPR compliance through server-side data minimisation

3. Adopt server-side conversion APIs

Meta Conversions API (CAPI), Google Ads Enhanced Conversions and similar server-side APIs send conversion data directly from your server to the advertising platform, bypassing the browser entirely. This dramatically improves conversion tracking accuracy and is increasingly essential for optimising ad spend.

4. Explore Privacy Sandbox APIs

Begin testing Topics API and Protected Audience API in your advertising campaigns. Early adoption gives you a competitive advantage and prepares your team for a future where these APIs may be the primary mechanism for interest-based targeting.

5. Diversify your marketing channels

Reduce your dependence on cookie-based advertising by investing in channels that do not rely on cross-site tracking:

  • Contextual advertising (ads based on page content, not user identity)
  • Search advertising (intent-based, less reliant on cross-site data)
  • Email marketing (owned channel, fully first-party)
  • Content marketing and SEO (organic traffic that compounds over time)
  • Direct partnerships and sponsorships

6. Invest in consent rate optimisation

Since GDPR requires consent for all non-essential cookies (including third-party ones), your consent rate directly determines how much data you can legally collect. A well-designed, compliant cookie banner can achieve consent rates of 60–80%, while a poorly designed one may yield only 30–40%. The difference is enormous in terms of data coverage.

Cookie compliance remains the foundation

Regardless of changes at Google, Apple or any other browser vendor, the GDPR and ePrivacy rules apply to all cookies: third-party and first-party alike. For any non-essential cookies, whether used for analytics, marketing or social media integration, you need valid consent from the user before setting them. This requirement does not change based on browser policies; it is a legal obligation.

Consentio helps you stay in compliance with current legislation by providing a fully GDPR-compliant cookie banner with automatic cookie detection, granular consent management and built-in Google Consent Mode v2 support. Whether you rely on third-party cookies today or are building a first-party data strategy for tomorrow, proper consent management is the non-negotiable foundation of your data collection.

The businesses that will thrive in this evolving landscape are those that invest in first-party data, diversify their marketing channels, adopt server-side measurement and treat cookie consent not as a compliance burden but as a trust-building opportunity with their audience.