For five years, Google promised to switch off third-party cookies in Chrome. Then it didn’t. In July 2024 the company dropped the phase-out in favour of user choice, in April 2025 it confirmed Chrome would keep them by default without any standalone prompt, and in October 2025 it began retiring most of the Privacy Sandbox technologies that were supposed to replace them.
You could read that as good news for the old way of doing things. It isn’t. Safari has blocked every third-party cookie by default since 2020, Firefox has blocked known trackers since 2019, and in Europe a large share of users simply click “Reject all” on the consent banner. On any given website, the slice of the audience you can still follow from one site to another keeps shrinking, whatever Chrome decides.
Marketing without third-party cookies is not a scenario to prepare for. For most of your traffic, it is already how things work. What follows covers what these cookies are, how browsers and regulators changed the rules, and the solutions marketers now use in digital advertising to target, measure and re-engage people without following them across the web.
- First-party vs third-party cookies: what actually differs
- Why third-party cookies lost their reach, even though Chrome kept them
- What changes for advertisers and publishers
- How does marketing without third-party cookies work?
- First-party data: the foundation of privacy-compliant marketing
- Server-side tracking and Consent Mode: rebuilding measurement
- Contextual advertising: targeting the page, not the person
- Alternative identifiers: shared IDs with explicit consent
- Probabilistic and modelled approaches
- Web Push: a direct opt-in channel that never relied on cookies
- A privacy-first marketing playbook in 8 steps
- Comparison table of third-party cookie alternatives
- Stop waiting for Chrome
- FAQ: marketing without third-party cookies
First-party vs third-party cookies: what actually differs
A cookie is a small text file a browser stores when someone visits a page. What matters is who sets it. A first-party cookie is set by the site the user is on: it keeps a basket filled, remembers a language, keeps a session open, feeds the site’s own analytics. A third-party cookie is set by a different domain, usually through scripts or tags embedded in the page (an ad server, a social button, a retargeting pixel). Because that same domain is present on thousands of websites, it can recognise the same browser everywhere and build a cross-site browsing history.
That cross-site memory is what powered behavioural targeting, retargeting, frequency capping and multi-touch attribution for twenty years. It is also exactly what browsers and privacy regulators decided to limit.
| First-party cookie | Third-party cookie | |
|---|---|---|
| Set by | The website the user visits | Another domain (ad server, tracking script) |
| Typical use | Session, basket, preferences, site analytics | Cross-site tracking, retargeting, attribution |
| Safari and Firefox | Accepted (with limits on lifetime in Safari) | Blocked by default |
| Chrome | Accepted | Accepted, subject to user settings |
| Consent in the EU | Not needed for strictly necessary uses; needed for analytics and ads | Always needed |
The distinction matters for the rest of this article: almost every strategy that works today relies on data the user shares with you directly, in a first-party context, with clear consent.
Why third-party cookies lost their reach, even though Chrome kept them
The short answer to “when will third-party cookies be fully deprecated?” is that, in Chrome, nobody can give you a date anymore. The longer answer is that deprecation by browsers was only one of three forces, and the other two never stopped.
Browsers moved first
Apple and Mozilla did not wait for Google. The timeline of third-party cookie deprecation across browsers looks like this:
- 2017: Safari launches Intelligent Tracking Prevention (ITP), which limits cross-site tracking.
- 2019: Firefox enables Enhanced Tracking Protection by default and blocks known tracker cookies.
- January 2020: Google announces it will phase them out of Chrome “within two years”, a deadline then pushed back several times.
- March 2020: Safari blocks all third-party cookies by default.
- January 2024: Chrome disables third-party cookies for 1% of its users as a test.
- July 2024: Google abandons the phase-out and announces a user-choice approach instead.
- April 2025: Google confirms Chrome will keep its current setting and will not add a separate consent prompt.
- October 2025: Google announces the retirement of most Privacy Sandbox APIs, including Topics and Protected Audience.
On the European market, Safari represents a large part of mobile traffic, especially among audiences with higher purchasing power. Those users have been invisible to third-party tracking for years.
Regulation made consent the real gatekeeper
In the EU, the GDPR and the ePrivacy Directive require prior consent before any non-essential cookie is set. In practice, that consent is collected by a consent management platform (CMP), the banner that lets people accept or refuse. A tracking cookie dropped before the user’s answer, or a refuse button harder to find than the accept button, is a violation.
Regulators enforce it. In September 2025 France’s CNIL fined Google €325 million over advertising cookies and ads inserted into Gmail. The Digital Services Act adds further limits: no targeted advertising based on sensitive data, none aimed at minors, and more transparency on why a given user sees a given ad.
Users learned to say no
Once the refuse button sits next to the accept button, a meaningful share of visitors uses it. Add ad blockers and privacy-focused browsers, and the share of traffic that can be tracked across sites becomes a minority on many sites. Chrome keeping third-party cookies does not bring those users back.
What changes for advertisers and publishers
For publishers, the issue is revenue. Inventory that can be matched to a known profile sells at a higher CPM; anonymous inventory sells for less. The IAB estimated years ago that the loss of cross-site identifiers could cost publishers over $10 billion in ad revenue worldwide. The exact figure is debatable, the direction is not: every visitor who cannot be identified is a less valuable impression unless the publisher brings something else to the table, such as context, first-party segments or direct channels.
For advertisers, the pain shows up in measurement first. Retargeting pools shrink, attribution models lose touchpoints, conversions go missing in Safari, and affiliate programmes struggle to credit the right partner. Part of the budget goes “dark”: the money is spent, the outcome is real, but the analytics no longer connect the two.
There is an upside that marketers tend to underestimate. Companies that rely less on invisible tracking also show fewer intrusive banners, collect data people actually agreed to share and build trust with their audience. Marketers who adapted early on Safari traffic generally discovered that their campaigns still worked, just measured differently.
How does marketing without third-party cookies work?
It works by replacing one tool with several solutions, and marketers who expect a single drop-in replacement usually end up disappointed. The third-party cookie did two jobs at once: it identified the user across sites (for targeting) and it connected ad exposure to conversion (for measurement). Without it, those jobs are split between:
- first-party data collected with consent on your own site, app and CRM;
- server-side tracking and conversion APIs to rebuild measurement on your own infrastructure;
- contextual advertising, which targets the page instead of the person;
- alternative identifiers based on logins or hashed emails, shared between partner platforms;
- probabilistic and modelled methods, from lookalike audiences to marketing mix modelling;
- direct opt-in channels like email, SMS and Web Push, where the user subscribes once and you reach them without any tracking.
None of these cookieless solutions is a perfect substitute. Combined, they cover more than the third-party cookie ever did on Safari or on users who refuse consent.
First-party data: the foundation of privacy-compliant marketing
First-party data is information you collect directly from your users: first-party cookies set by your own website, account data, purchase history, newsletter preferences, on-site behaviour. You own it, you know how it was collected, and it describes the real relationship people have with your brand. That makes it more reliable and easier to keep compliant than data bought from a broker.
How to collect more of it
Give people a reason to identify themselves: an account that saves their basket, content reserved for subscribers, a loyalty programme, a configurator that remembers their choices. Ask for preferences directly (zero-party data) rather than guessing them. And make the consent interface clear, because a user who understands what you collect and why is more likely to say yes.
Then put the data in one place. A customer data platform (CDP) unifies information from your site, CRM and apps into a single profile you can segment and activate. Questions you once answered with purchased audience data (“which visitors are close to buying?”) can now be answered with your own analytics.
Its limit, and how clean rooms help
First-party data covers your existing audience. It will not help you find people who have never visited you, and not every visitor will log in. Data clean rooms address part of that gap: two companies, typically an advertiser and a publisher or retailer, match their customer bases in an encrypted environment without either side seeing the other’s raw data. WPP’s acquisition of InfoSum in 2025 shows how seriously agencies take the approach. The match produces an audience you can target, with no personal data leaving its source.
Among first-party channels, Web Push notifications deserve a specific mention: a visitor subscribes in one click from the browser, without giving an email address, and becomes a contact you can re-engage directly. We come back to it below.
Server-side tracking and Consent Mode: rebuilding measurement
Measurement is where the absence of third-party cookies hurts most, and also where the fixes are the most technical.
Server-side tagging and conversion APIs
With server-side tracking, events are no longer sent from the user’s browser straight to each ad platform through third-party scripts. They go first to a server you control (a server-side tag manager container, for example), which then forwards them to Google, Meta or your analytics tool. Because the data is sent from your own domain in a first-party context, it survives browser restrictions better, you decide what is shared with each vendor, and pages load fewer scripts.
Conversion APIs (Meta Conversions API, Google enhanced conversions) follow the same logic: you send conversions from your server, with hashed identifiers such as an email address the customer gave you at checkout. Server-side does not remove the need for consent; it gives you a cleaner, more controlled way to transmit data from users who agreed.
Consent Mode
Google Consent Mode reads the user’s choice from your CMP and adjusts how Google tags behave. If the visitor accepts, tags work normally. If they refuse, tags send cookieless pings with no identifier, and Google uses modelling to estimate the conversions it can no longer observe. Consent Mode v2 has been required since March 2024 for advertisers who want to keep using audience and measurement features with users in the European Economic Area. Setting it up correctly, with a certified CMP, is now the baseline of any analytics setup in Europe.
Contextual advertising: targeting the page, not the person
Contextual targeting is the oldest form of online advertising, and the most robust without third-party cookies. Instead of showing an ad based on the user’s history, you show it based on the content of the page they are reading: running shoes on a marathon training article, mortgage offers on a property guide, cookbooks on a recipe blog. No personal data is needed, so no consent is required for the targeting itself. Digital formats like display banner advertising work very well in this setup.
Why it works again
The person reading the page has told you, by reading it, what they care about at this very moment. At that point in time, it is often a better signal than a cookie set three weeks earlier. Modern contextual platforms no longer rely on keyword lists alone: language models analyse meaning, tone and images, and avoid sensitive pages for brand safety.
Where it falls short
Two readers of the same article see the same ad. You lose the individual personalisation, and some niche targets are hard to match with enough relevant content to scale. Contextual works best for awareness and prospecting, less for retargeting.
Adrena’tips: list the budget lines that depend on behavioural audiences today and move a test share to contextual on comparable placements. Compare cost per visit and conversion rate over a few weeks rather than click-through rate alone.
Alternative identifiers: shared IDs with explicit consent
Several ad tech companies are building alternative identifiers to help advertisers keep addressable audiences: a common ID, usually derived from a hashed email or a login, that partner websites and platforms agree to recognise. The best-known are Unified ID 2.0, initiated by The Trade Desk, ID5 and LiveRamp’s RampID.
The benefit is clear for advertisers: a deterministic, cross-site identifier based on a user who logged in and agreed to the terms. The limits are just as clear. These IDs only work on sites where users log in, they require broad cooperation between competing companies, and regulators will judge them on the quality of consent. An identifier that follows people everywhere without real transparency is a third-party cookie with a different name.
Adrena’tips: if you test audience matching with a hashed customer base, check that your privacy policy and consent text actually cover this use. Tell customers plainly that their email may be used to show them relevant ads on partner sites.
Probabilistic and modelled approaches
When you cannot know who someone is, you can still estimate what they are likely to do. Probabilistic methods replace individual tracking with statistics.
Fingerprinting: legal, but risky
Device fingerprinting identifies a browser through its characteristics (screen, fonts, IP address, configuration). Google reversed its long-standing position and has allowed advertisers using its platforms to rely on such techniques since February 16, 2025. Regulators like the UK ICO were openly critical, and in Europe fingerprinting is subject to the same consent requirements as cookies. Users cannot easily see or refuse it, which is exactly why it erodes trust. Use it for fraud prevention or frequency capping, with clear disclosure, not as a quiet way around the CMP.
Cohorts and interest groups
Chrome’s Topics API was meant to replace individual profiles with broad interest categories computed in the browser. Adoption stayed low and Google has announced its retirement along with most of the Privacy Sandbox. The idea survives elsewhere: publishers and SSPs build their own anonymous cohorts from first-party and contextual signals, then sell them as curated deals.
Machine learning and statistical measurement
Lookalike models start from your best customers (first-party data) and find people with similar characteristics on large platforms. For measurement, marketing mix modelling and incrementality tests (exposing one group to a campaign and keeping a comparable group unexposed) estimate the real effect of each channel without following anyone. You lose granularity: you will no longer credit every sale to a specific click. You gain a view of what actually drives growth.
Adrena’tips: track aggregate indicators such as total revenue, new customers and lifetime value alongside platform-reported conversions. When the two diverge, trust the experiment, not the dashboard.
Web Push: a direct opt-in channel that never relied on cookies
Some channels never depended on third-party cookies in the first place. Push notifications sent through the browser are one of them. A visitor accepts notifications in one click via the browser’s native prompt; from then on, the website can send messages to that browser even when the visitor is no longer on the site. There is no email to collect, no account to create, no cross-site identifier.
In a privacy-first setup, that brings several advantages:
- Consent is built in: the browser itself asks the question, and the user can unsubscribe at any time from the settings.
- No third-party tracking: messages are delivered by the browser’s push service to a subscription linked to your own website.
- Direct reach: notifications appear on desktop and mobile, outside the inbox, which explains engagement rates that often outperform email.
- Re-engagement scenarios: welcome series, abandoned basket, new content, inactivity, all triggered from first-party behaviour on your site. It is one of the most effective levers for reducing churn.
Web Push also covers part of what retargeting used to do, without the cross-site tracking: you bring back people who already showed interest, because they asked to hear from you. And it plugs naturally into marketing automation workflows you may already run for email.
Adrena’tips: ask for the subscription at a moment that makes sense, after an article has been read or when a product is added to the basket, not on page load. Then segment subscribers by the content they viewed to keep messages relevant.
A privacy-first marketing playbook in 8 steps
- Map your dependencies. List every tool, partner and campaign that uses third-party cookies or cross-site scripts (retargeting, DMP, affiliate tracking, analytics). Estimate what you lose on Safari and on users who refuse consent today; that is your real exposure.
- Clean up consent. Use a certified CMP, make refusal as easy as acceptance, set up Consent Mode v2, and check that no tag fires before the user’s choice.
- Move tracking server-side. Deploy server-side tagging and conversion APIs so that measurement relies on your own domain and your own data.
- Grow first-party data. Accounts, newsletters, loyalty, preference centres: every login and opt-in is an audience you will still have in five years.
- Open direct channels. Email, SMS and Web Push let you reach people who chose to hear from you, with no dependence on browsers’ cookie policies.
- Test contextual and alternative IDs. Run comparable campaigns and measure them on outcomes, not on clicks.
- Measure differently. Combine platform data with incrementality tests and marketing mix modelling. Accept that attribution will be less granular and more honest.
- Keep watching. Browser policies, Google’s decisions and regulators’ positions keep moving. Assign someone to follow them, because the next change will not be announced long in advance, and cookieless solutions evolve just as fast.
Comparison table of third-party cookie alternatives
The table below summarises the main options covered above, the data they use and the consent they require.
Stop waiting for Chrome
For years, many marketers treated the end of third-party cookies as an event on the calendar, something to prepare for once the date was confirmed. The date never came, and it no longer matters. The reach of third-party tracking was already shrinking on Safari, on Firefox and with every user who refused consent, and that will not reverse.
The companies that do well in this environment are not the ones that found a clever replacement for the third-party cookie. They are the ones that stopped needing it: a solid first-party data base, measurement they control, media bought on context, and direct channels where the audience opted in. That is more work than dropping a pixel on a page. It is also a marketing setup no browser update can take away.
FAQ: marketing without third-party cookies
What are third-party cookies and why are they being phased out?
A third-party cookie is set by a domain other than the website the user is visiting, usually an ad server or a tracking script embedded in the page. Because the same domain is present on many sites, it can follow a browser from one site to another. Safari and Firefox block them by default for privacy reasons, and European law requires consent before they are set. Chrome still accepts them, but their reach keeps shrinking.
How does marketing without third-party cookies work?
It splits the two jobs third-party cookies used to do. Targeting relies on first-party data collected with consent, contextual advertising and alternative identifiers based on logins. Measurement relies on server-side tracking, conversion APIs, Consent Mode and statistical methods such as incrementality tests. Direct opt-in channels like email and Web Push let you reach people without any tracking at all.
What strategies can marketers use to adapt to a cookieless future?
Start by mapping what depends on cross-site tracking today. Then clean up consent with a certified CMP, move tracking server-side, grow first-party data through accounts and subscriptions, open direct channels such as Web Push, test contextual campaigns and measure results with incrementality tests rather than last-click attribution.
What role do first-party cookies play in privacy-compliant marketing?
First-party cookies are set by your own website. They keep sessions open, remember preferences and feed your own analytics. Combined with account and CRM data collected with consent, they form the base of privacy-compliant marketing: data you own, collected transparently, describing the real relationship people have with your brand.
When will third-party cookies be fully deprecated?
There is no date for Chrome. Google abandoned its phase-out plan in 2024, confirmed in 2025 that Chrome would keep third-party cookies by default, and has since retired most Privacy Sandbox technologies. Safari and Firefox already block them by default, and many European users refuse them through consent banners, so their practical reach is already limited.
