Third-Party Cookie Deprecation

I keep getting the same questions. Are you worried about third-party cookies going away? Are you planning for deprecation day?

I am planning a little bit, but I am not panicking. A meaningful chunk of the web has been cookieless for years. Apple began limiting cross-site tracking in Safari with Intelligent Tracking Prevention. Firefox flipped third-party cookie blocking to default in 2019. Chicken Little cried, marketers adjusted, and the sky did not fall.

The push did not start with browser teams. These decisions were not conceived inside Chrome, Safari, or Firefox. GDPR set a global baseline for consent and purpose limitation in 2018, and California followed with CCPA. If you buy media at scale, you are already feeling the effects in attribution windows, retargeting depth, and what it takes to prove incrementality. You are adapting.

Google's Privacy Sandbox emerged to keep some relevance and reach without handing every buyer a cross-site ID. FLoC gave way to Topics, which keeps interest signals on device and shares a small window of recent topics with participating sites. These cohorts show what the open web will value when individual tracking fades: on-device signals, aggregation, and controls.

Here is my take. I do not expect Google to fully deprecate third-party cookies. Google sits on both sides of the transaction, demand and sell-side, and the open web is a massive supply source for it. Google will not cannibalize its own revenue. If you are waiting for Deprecation Day, you will be waiting.

So what actually changes for marketers who want performance and proof instead of cookie drama?

First, invest in the identity you control. First-party data is the asset that does not depend on a browser vendor's roadmap.

Second, plan for addressability across both quantitative and qualitative signals. Topics and Protected Audiences may sound useful, but they are not a replacement for a qualified audience strategy.

Third, stop looking for a single source of truth. Run always-on holdouts to quantify lift, refresh your MMM on a fixed cadence, and use platform conversion signals as inputs rather than gospel. Where cookies persist, use them. Where cookies are constrained, emphasize contextual relevance and frequency quality over sheer reach.

Supply deserves attention too. The open web remains a vast channel, leaning more on context, attention, and publisher audience segments. Diversify the buys going into the pipes so you are not over-exposed to any single publisher. The privacy bar keeps rising, and it is going to keep rising after this news cycle ends.

The web you buy will stay mixed for the foreseeable future, and I would suggest longer than that. Put your dollars into identity, make testing the norm, and remember that creative built with an audience in mind will complement the targeting strategy rather than compensate for it.

Sources

1. John Wilander, “Intelligent Tracking Prevention 2.3,” WebKit, Sep 23, 2019. (WebKit)

2. Marissa Wood, “Today’s Firefox Blocks Third-Party Tracking Cookies and Cryptomining by Default,” Mozilla Blog, Sep 3, 2019. (Mozilla Blog)

3. Vinay Goel, “Get to know the new Topics API for Privacy Sandbox,” Google Keyword Blog, Jan 25, 2022. (blog.google)

4. European Commission, “Legal framework of EU data protection,” stating GDPR applies since May 25, 2018. (European Commission)

5. Schiff, A. "Google says it won't deprecate cookies in Chrome after all (?!)" AdExchanger, July 22, 2024. (AdExchanger)