The Cookie That Did Not Die

In January 2020 Google announced that Chrome would stop supporting third-party cookies within two years. The industry spent five years and an enormous amount of money preparing.

Then, in July 2024, Google said it would not go ahead. In April 2025 it confirmed there would be no replacement prompt either. And on 17 October 2025 it retired Privacy Sandbox entirely — ten APIs, including Topics, Protected Audience and Attribution Reporting — with removal from Chrome scheduled through 2026.

Third-party cookies are still in Chrome today. There is no deprecation date.

This is the most instructive episode in modern adtech, and reading it correctly matters more than reading it quickly. The naive conclusion — so nothing changed, the work was wasted — is wrong in a way that will embarrass you in a room of practitioners. What follows is what actually happened, and what actually changed.

What a third-party cookie was for

Worth being exact, because the thing that was almost removed was narrower than most summaries suggest.

A cookie is a key-value pair a browser stores and sends back on later requests to the same host. First-party means the host matches the site you are looking at — that is your login session, your cart, your preferences. Nobody proposed removing those.

A third-party cookie is set by a host other than the page you are on. When publisher.com loads a tracking pixel from adtech-vendor.com, the vendor can set a cookie against its own domain. Load a pixel from the same vendor on othersite.com, and the vendor recognises the same browser.

That recognition is the entire mechanism. From it the industry built:

• Frequency capping — do not show this person the same ad nine times.
• Retargeting — they looked at the shoes and did not buy.
• Conversion attribution — this impression preceded that purchase.
• Audience segments — behaviour observed across many sites.

Note that frequency capping and attribution are operational uses, not targeting. They are also the ones that break most visibly, which is why publishers and buyers felt the squeeze from Safari and Firefox years before Chrome was ever in question.

The part people forget: Chrome was last

Safari shipped Intelligent Tracking Prevention in 2017 and was blocking third-party cookies entirely by 2020. Firefox enabled Enhanced Tracking Protection by default in 2019.

So by the time Chrome announced its plan, roughly a third of Western web traffic had already lost third-party cookies. The industry had been building workarounds for three years. Chrome's announcement did not create the problem; it threatened to make the existing problem total.

This matters for the ending. When Chrome reversed, it did not restore addressability on Safari or Firefox. It only stopped the loss from reaching 100%.

What Privacy Sandbox tried to do

Google's proposed replacements were genuinely interesting engineering, which is part of why their failure is worth studying.

Topics replaced behavioural segments with a coarse interest taxonomy computed in the browser. Chrome observed the sites you visited, mapped them to a few hundred human-readable topics, and shared at most three per week with callers. No cross-site identifier left the device.

Protected Audience (previously FLEDGE) moved retargeting into the browser. An advertiser could add you to an interest group locally; when you later hit a publisher page, Chrome ran a small on-device auction among bidders who had registered interest. The advertiser never learned the identity of the person.

Attribution Reporting gave aggregated, noise-added conversion counts rather than event-level joins.

The design principle was consistent and defensible: keep the decisions and strip the identity.

Why it failed

Three reasons, in roughly descending order of weight.

Adoption was negligible. Buyers tested, published a paper, and went back to what worked. Protected Audience required rebuilding a bidder around a browser-side auction with an entirely different latency and debugging model, in exchange for a signal weaker than what they already had on 60% of traffic.

The signal quality genuinely was worse. Three topics a week is not an audience segment. Noise-added aggregate attribution cannot settle an argument about whether a campaign worked. Practitioners said this from the start and were right.

Antitrust. The CMA in the UK held formal commitments over the deprecation. Regulators in multiple jurisdictions were examining whether a browser vendor who also sells ads should be allowed to decide which signals the ad market may use. Google's stated reasons for retirement were adoption and the evolving regulatory landscape; the second phrase is doing a great deal of work.

So what did change

Here is the honest ledger, and it is the point of the whole article.

Nothing changed about the law. GDPR and ePrivacy never cared whether a cookie was first or third party; they cared about consent for non-essential storage and processing. A consent banner was never a Chrome requirement. US state privacy laws continued to multiply throughout. Cookie reversal changed exactly none of this.

Nothing changed on Safari or Firefox. Still blocked by default. Still about a third of traffic.

Nothing changed about the incentive to own first-party data. Publishers who spent 2021–2024 building logged-in audiences, registration walls and newsletters came out of it with an asset. Those who waited for Google to solve it came out with nothing.

The industry rebuilt itself in the meantime. This is the decisive bit. Five years of forced preparation produced infrastructure that is now in production and is not going away:

• Universal IDs — UID2, RampID, ID5 and others, built on hashed email from an authenticated session. CTV adoption in particular is now broad: AMC, Disney, Dish, FreeWheel, NBCUniversal, Roku and Paramount have all integrated UID2, because streaming has the logged-in users that the open web does not.
• Data clean rooms — around two thirds of organisations now use one in some capacity. Amazon Marketing Cloud defined the category.
• Contextual targeting, seriously this time — not the keyword blocklists of 2012 but genuine page understanding. It never needed an identifier, which is why it was the one approach that worked identically on every browser.
• Sell-side curation — audience decisioning moving to the SSP, where the publisher's own first-party data lives. Supply-side targeting spend doubled year over year in 2025.

So the correct summary is not the cookie survived. It is: the cookie survived, and by then it no longer mattered as much, because five years of preparation had built the alternatives and a third of traffic was using them anyway.

What this means for how you build

Three durable conclusions, each of which has a later article behind it.

Do not architect on the assumption that unpartitioned third-party cookies will always be available. Chrome's reversal was a decision, not a guarantee, and the same company may decide otherwise. Browser vendors have removed capabilities before.

Authentication is the actual asset. Every durable identity approach — UID2, RampID, clean room matching, retail media's closed loop — resolves to someone having logged in somewhere. That is why CTV and retail media have better addressability than the open web, and why their economics are diverging from it.

Measure, do not assume. The whole episode is a case study in an industry acting confidently on a prediction. The antidote is in Stage 5: run a holdout, measure the lift, and find out whether the segment you are paying a $2 CPM for does anything at all.

Key takeaways

• Third-party cookies are still in Chrome. There is no deprecation date, and the Privacy Sandbox replacement was retired on 17 October 2025.
• Chrome was the last browser standing: Safari has blocked them since 2017, Firefox since 2019. 30–50% of traffic was already unaddressable.
• Privacy Sandbox failed on adoption and signal quality, with antitrust pressure in the background — not because the engineering was bad.
• Consent law, Safari, Firefox and the value of first-party data were all unaffected by the reversal.
• The five years were not wasted: universal IDs, clean rooms, real contextual and sell-side curation are in production because of them.

Next

Universal IDs, Honestly takes the leading replacement apart — how a UID2 is minted from an email address, what happens at each hop, and what a "match rate" is actually measuring when a vendor quotes you one.