Google keeps third-party cookies in Chrome, and your plan should not change much
Google says it will offer a user choice in Chrome instead of phasing out third-party cookies. Why first-party data work is still the right priority and what to stop doing.
On July 22, Google's Privacy Sandbox lead Anthony Chavez wrote that Chrome would no longer go ahead with deprecating third-party cookies. Instead, Google proposed "a new experience in Chrome that lets people make an informed choice that applies across their web browsing," which people could adjust at any time. Google also said it is discussing the path with regulators, naming the UK's Competition and Markets Authority and Information Commissioner's Office.
If you have spent a year preparing for a cookieless Chrome, the temptation is to relax. Our view is that you should relax about the deadline and not about the work.
What is actually decided, and what is not
Three things are clear from Google's post. The plan to deprecate third-party cookies is dropped in favor of a user choice. The Privacy Sandbox APIs remain available for developers, and Google says it will keep investing in them. And Google is planning IP Protection for Chrome's Incognito mode as an additional privacy control.
What is not decided is the design of the choice, when it arrives, or how many users will block cookies when asked. Google describes this as a proposal it is discussing with regulators. Any forecast of the share of cookie-enabled traffic in Chrome next year is a guess, including ours.
Why the work still pays
The reasons to build first-party measurement were never only about Chrome's schedule. Three of them are unchanged:
- Your users are not all in one browser. Your measurement has to hold up in every environment they use, not only in the largest.
- A user choice is still a choice. If people are offered an explicit prompt, some will decline, and your reporting needs to cope with the gap.
- Consent rules are tightening elsewhere. Google said it would tighten enforcement of its EU user consent policy from March, and signals you collect with consent are worth more than signals you scrape without it.
The difference now is urgency. A fixed date made first-party work an emergency. Without one, it becomes a sequence you can plan sensibly.
What to stop doing
- Stop treating the Privacy Sandbox as a migration target. Its APIs are staying available, but an available API is not a reason to restructure campaigns around it.
- Stop rushing a vendor swap. If you were about to replace a working tool because of the old deadline, you can take more time to evaluate it.
- Stop reporting on a cookie-dependent view as if it were stable. It was never guaranteed, and it is now less urgent, not more reliable.
What to keep doing
Keep the first-party work that has independent value:
- Send conversion events from your server as well as the browser, using your own identifiers where users consented.
- Clean and refresh the customer lists you upload to ad platforms, and remove users who have withdrawn consent.
- Maintain a consent setup that passes your audit, because that is useful in any scenario.
- Run incrementality tests, such as geo holdouts, on at least your largest channel, so you have a reference measurement that does not depend on cookies at all.
For mobile app advertisers, the news has a smaller direct effect. App install attribution does not run through Chrome cookies. The web touches you at the edges: landing pages, web-to-app flows, remarketing pools built from site visitors. Look at those, and leave the rest of your stack alone.
A practical way to do this is a short browser matrix. Open your landing page, your web-to-app link and any embedded checkout in Chrome, Safari and Firefox, with third-party cookies allowed and then blocked. Record, for each combination, whether the page loads, whether your analytics tags fire, and whether the link lands the user in the right store listing. The result is a one-page table of what depends on cookies. It costs an afternoon and it holds up whatever Google decides later.
Practical takeaway
Write down which of your measurements break if third-party cookies disappear and which break if a quarter of users decline them. Fix the second list first, since it is the likelier outcome under a choice-based model. Then revisit the plan when Google publishes the details of the Chrome experience.