Third-Party Cookies in Chrome: What Changed and What to Do in 2026

For five years, marketers planned for a world without third-party cookies in Chrome. That world never arrived. In July 2024 Google dropped its plan to deprecate them, ending a process marked by repeated delays and regulatory scrutiny ¹. By October 2025 it had gone further and retired most of the Privacy Sandbox technologies that were meant to replace cookies, citing "low levels of adoption" ².

So are cookies back to normal? Not quite. Safari and Firefox still block cross-site tracking by default, Chrome users can switch cookies off, and consent rules have not changed. This article sets out what happened, where things stand in 2026, and what a sensible measurement plan looks like now.

How Google changed course, step by step

The reversal happened in stages rather than in one announcement.

1. July 2024: no forced deprecation. Google's VP of Privacy Sandbox, Anthony Chavez, announced that instead of removing third-party cookies, Chrome would introduce an experience letting people make an informed choice they could change at any time. Google had already delayed its phase-out plan a third time in April 2024, and the UK Competition and Markets Authority (CMA) and Information Commissioner's Office said they would review the new approach ¹.
2. April 2025: no new prompt either. Google then said it would "not be rolling out a new standalone prompt for third-party cookies". Users can continue to manage cookies in Chrome's Privacy and Security settings, and Incognito mode continues to block third-party cookies by default. Google pointed to "divergent perspectives" across the ecosystem as part of its reasoning ³.
3. October 2025: most Privacy Sandbox APIs retired. Google announced it would retire Topics, Protected Audience, the Attribution Reporting API, IP Protection, Private Aggregation (including Shared Storage), Related Website Sets and several other technologies, on both Chrome and Android ².
4. October 2025: regulator steps back. The CMA released Google from the commitments it had given on Privacy Sandbox, saying competition concerns no longer arose now that cookies were staying ⁴.

What is left of the Privacy Sandbox in 2026

The retirements are now working their way through Chrome's normal release process. With the Chrome 144 beta in December 2025, Google confirmed it was deprecating and planning to remove the Topics API, the Protected Audience API and the Shared Storage API, with the Attribution Reporting API also scheduled for deprecation and removal ⁵. Any ad tech partner still relying on these APIs for targeting or remarketing needs a different route.

A few pieces survive. Google said it will keep supporting CHIPS (partitioned cookies) and FedCM (federated sign-in), will maintain Private State Tokens for fraud prevention, and will continue to work on an interoperable attribution standard through the W3C's Private Advertising Technology Working Group ².

Technology	Purpose	Status
Topics API	Interest-based targeting	Deprecated, removal planned 5
Protected Audience	Remarketing without third-party cookies	Deprecated, removal planned 5
Attribution Reporting API	Privacy-preserving conversion measurement	Deprecation and removal planned 5
IP Protection	Hiding IP addresses from third parties	Retired 2
CHIPS and FedCM	Partitioned cookies, federated login	Still supported 2
Private State Tokens	Anti-fraud signals	Maintained 2

Safari and Firefox never waited for Google

Chrome's decision does not mean third-party cookies work everywhere. Apple's WebKit team announced in March 2020 that Safari blocks cookies for cross-site resources by default, describing it as the first mainstream browser to do so. The same update also capped script-writable storage such as LocalStorage at seven days without user interaction on a site ⁶.

Firefox takes a different but equally restrictive approach. Its Total Cookie Protection, rolled out by default from 2022, creates a separate "cookie jar" for each website, so a tracker sees activity only within one site rather than across the web ⁷.

In practice, this means a portion of every audience is already invisible to cookie-based tracking, and that portion is often skewed towards iPhone and Mac users. Any reporting that relies on third-party cookies will under-count conversions from those users, whatever Chrome does.

Why "cookies are staying" is the wrong conclusion

It is tempting to read the reversal as permission to carry on as before. Three reasons argue against that.

• User choice still applies. Chrome users can block third-party cookies in settings, and Incognito blocks them by default ³. Cookie availability in Chrome is high but not guaranteed.
• Consent law is unaffected. In the EEA and UK, cookies for advertising still require valid consent. Google's change concerns browser technology, not regulation.
• The underlying pressures remain. eMarketer noted that many marketers still report difficulty tracking behaviour across channels and with attribution, citing Supermetrics research in which 66% named cross-channel tracking as a concern and 57% named attribution and measurement ⁸.

The real lesson of 2024-2025 is that browser policy can change direction with little notice. A measurement setup that depends on any single browser behaviour is fragile.

What advertisers should actually do

The practical agenda looks similar to the one the industry was preparing for a cookieless Chrome, minus the urgency.

• Build first-party data properly. Collect email addresses, phone numbers and CRM identifiers with clear consent and a reason for customers to share them. eMarketer's advice after the October 2025 announcement was to strengthen first-party data foundations and test alternative identity solutions ⁸.
• Use platform tools that match on first-party data. Google's enhanced conversions, for example, send customer data such as email addresses, hashed with the SHA256 algorithm, to improve the accuracy of conversion measurement, both for online sales and for offline sales that started as website leads ⁹.
• Move remarketing off third-party cookies where you can. Customer-list audiences and contextual targeting work across all browsers and do not rely on APIs that are being removed.
• Ask your ad tech partners for a plan. Any demand-side platform or measurement vendor that tested Topics, Protected Audience or Attribution Reporting needs to explain what replaces them ⁵.
• Measure with methods that do not need user-level tracking. Marketing mix modelling and incrementality experiments give a view of performance that holds up when cookies are blocked or consent is declined.
• Keep consent management in good order. Cookie banners, consent signals and data retention policies matter as much in 2026 as they did before Google's reversal.

Key takeaways

• Google abandoned forced third-party cookie deprecation in July 2024 and dropped plans for a standalone choice prompt in April 2025 ¹³.
• In October 2025 Google retired most Privacy Sandbox APIs, including Topics, Protected Audience and Attribution Reporting, while keeping CHIPS, FedCM and Private State Tokens ².
• Safari and Firefox still block cross-site cookies by default, so cookie-based measurement under-counts part of every audience ⁶⁷.
• Consent rules in Europe are unchanged by Google's decision.
• First-party data, server-side and hashed-data conversion tools, and model-based measurement remain the durable foundation.

What this means for your brand

Treat third-party cookies in Chrome as a useful signal that may not last, not as a foundation. Audit which of your campaigns and reports depend on them, and check whether any partner relied on the retired Privacy Sandbox APIs. Invest in consented first-party data and in conversion tools that use it, such as enhanced conversions. Then add a measurement layer, such as experiments or mix modelling, that does not need cross-site tracking at all. That combination works whichever way browser policy moves next.

Sources

1. Under pressure, Google halts third-party cookie deprecation in Chrome - The Current, July 2024
2. Update on Plans for Privacy Sandbox Technologies - Google Privacy Sandbox, October 2025
3. Next steps for Privacy Sandbox and tracking protections in Chrome - Google Privacy Sandbox, April 2025
4. Google free from Privacy Sandbox commitments as CMA rules out competition concerns - Campaign, October 2025
5. Chrome 144 beta - Chrome for Developers, December 2025
6. Full Third-Party Cookie Blocking and More - WebKit, March 2020
7. Firefox rolls out Total Cookie Protection by default to more users worldwide - Mozilla, June 2022
8. Google's Privacy Sandbox elimination ends the quest for a cookieless Chrome - eMarketer, October 2025
9. About enhanced conversions - Google Ads Help, 2026

Figures and product details are as reported by the sources listed, at the time of writing. Platforms change quickly, so check the latest documentation before acting on any single number.