Google’s Cookie U-Turn: What It Means for Advertisers

The Cookie Saga Nobody Saw Coming

If you followed digital advertising news over the last few years, you’ll remember the constant noise around third-party cookies. Deadlines, delays, industry warnings to “get ready for a cookieless future.” Agencies and advertisers spent real time and money preparing for a change that, as it turned out, never came.

This post was originally written in January 2024, when Google’s phase-out of third-party cookies in Chrome felt imminent. A lot has changed since then, and we have updated it to reflect where things actually stand. If you made decisions based on the original version, this is worth reading.

What Are Third-Party Cookies, and Why Did Anyone Want to Kill Them?

Before getting into the drama, it helps to understand what we are actually talking about.

When you visit a website, that site can store a small file in your browser called a cookie. A first-party cookie is set by the site you are on, used for things like keeping you logged in or remembering your basket. A third-party cookie is set by a different domain entirely, typically an ad network or analytics platform (eg, Google Ads & Google Analytics) embedded on that page.

Third-party cookies are how advertisers have historically tracked users across different websites. Visit a pair of trainers on one site, see an ad for those exact trainers following you around the internet for the next fortnight? That is third-party cookies doing their job. From a user privacy perspective, it is easy to see why that raised eyebrows. From an advertiser’s perspective, it has been the backbone of retargeting, cross-site attribution, and audience building for decades.

Other browsers had already started acting. Safari introduced Intelligent Tracking Prevention back in 2017, and Firefox followed suit with Enhanced Tracking Protection. By the time Google made its announcement, Chrome was the last major holdout, which is significant, given that Chrome holds over 65% of the global browser market.

Google’s Original Plan

Google first announced its intention to phase out third-party cookies in Chrome in January 2020, setting an initial target of 2022. The plan was to replace them with the Privacy Sandbox initiative, a set of browser-based APIs designed to enable privacy-preserving advertising without needing to identify individual users across sites.

2022 came and went. So did the next deadline, and the one after that. The timeline shifted to 2024, then to early 2025. A significant part of the reason for those delays was regulatory pressure. The UK’s Competition and Markets Authority opened a formal investigation into the Privacy Sandbox, raising concerns that removing third-party cookies could hand Google an unfair advantage, giving it a bigger leg up through its own first-party data, while reducing the ability of competitors, publishers, and ad tech platforms to operate effectively. The CMA required Google to address those concerns before it could proceed.

In January 2024, Google restricted third-party cookies for 1% of Chrome users as a limited test. Most people in the industry took that as the starter pistol firing. The full phase-out felt like a matter of months away.

The U-Turn

On 22 July 2024, Google announced it would not be deprecating third-party cookies after all. Anthony Chavez, VP of the Privacy Sandbox initiative, confirmed that rather than removing third-party cookies, Google would introduce a new experience in Chrome, allowing users to make an informed choice about their own tracking preferences.

The wider industry largely read it as a retreat. Years of delays had made clear that the disruption was greater than originally anticipated, Privacy Sandbox adoption had been low, and the regulatory scrutiny had made a clean phase-out practically impossible to execute without significant consequences for the ad ecosystem.

That proposed user-choice prompt was then quietly dropped too. In April 2025, Google confirmed it would not be introducing a standalone cookie consent prompt in Chrome. Instead, it would maintain its existing privacy and security settings, where users can already manage their cookie preferences if they choose to look for them.

By October 2025, Google had also formally retired a significant portion of the Privacy Sandbox APIs that had been built to replace cookie functionality. Low adoption across the industry, combined with the shift away from the original deprecation plan, had made the broader rollout unworkable.

As things stand today, third-party cookies remain enabled by default in Chrome.

So Is Everything Back to Normal?

Not exactly, and this is the part that matters most for advertisers.

Third-party cookies surviving in Chrome does not mean the underlying privacy shift has reversed. Safari and Firefox have blocked them by default for years. GDPR and UK data protection law still require meaningful consent for non-essential tracking. Users are increasingly privacy-aware, and opt-in rates on cookie consent banners remain low across the board. Even within Chrome, any user can block third-party cookies through their browser settings right now.

There is also the regulatory dimension to keep in mind. The ICO has been clear that analytics and advertising cookies require prior consent under PECR, regardless of what Chrome does or does not do at a browser level. What Google decides about its own browser does not change your compliance obligations.

The practical reality is that third-party cookie reach has been eroding for years and will continue to do so, not because Google forced it, but because of browser fragmentation, regulation, and user behaviour. The “cookieless future” was never going to be one big switch being flicked. It is a slow fade that is already well underway, and Google’s reversal has not stopped that.

What This Means For You: The Key Takeaways

Before getting into the practical steps, here is the plain-English version of where things stand and what it actually changes for your business.

• Third-party cookies are still live in Chrome, but your reach was already shrinking. Safari and Firefox have blocked them for years, and combined they account for a significant share of your audience. The U-turn did not undo that.
• Your compliance obligations have not changed. GDPR and PECR still require prior consent for non-essential cookies regardless of what Chrome does. If your consent banner is not up to scratch, that is a legal issue, not just an SEO one.
• Low opt-in rates are a real problem. Even where consent banners exist, a large portion of users decline. That means a meaningful slice of your audience is already invisible to third-party tracking, right now, in Chrome.
• The Privacy Sandbox alternatives are gone. Google wound down the APIs that were supposed to replace cookies in October 2025. There is no privacy-preserving replacement coming. First-party data is the only reliable long-term signal.
• Your competitors who have prepared are ahead of you. Businesses that spent the last few years building first-party data strategies, implementing server-side tracking, and cleaning up their consent management are in a stronger measurement position regardless of what Chrome does next.
• Google can change its mind again. It has done so multiple times on this issue. Building your measurement infrastructure around signals you own and control is the only position that is immune to that.

What Should Advertisers Actually Be Doing?

The lesson from the last five years of cookie drama is not “panic when Google says something is changing.” It is “build an advertising and measurement infrastructure that does not depend on any single data signal you do not control.”

The advertisers in the strongest position right now are those who have invested in the following, regardless of what Google does or does not do with Chrome:

First-party data collection.

Email lists, CRM data, logged-in user behaviour, and purchase history all belong to you. They are not subject to browser policy changes. Building strategies around data you own directly is the most durable long-term position available, and it compounds over time.

Server-side tracking.

Moving tracking events to the server rather than relying on client-side browser cookies reduces data loss from ad blockers, browser restrictions, and consent refusals. It also improves the accuracy of what you are able to measure, particularly for conversion data flowing back into Google Ads.

Contextual targeting.

Serving ads based on the content a user is currently viewing, rather than their cross-site browsing history, is both privacy-friendly and increasingly effective. It requires no individual identification whatsoever and holds up regardless of what happens at the browser level.

Consent-led measurement frameworks.

Making sure your consent management is robust, that you are capturing meaningful opt-ins where required, and that your reporting accounts for data gaps rather than pretending they do not exist. Google’s own Consent Mode is worth implementing properly if you are running Google Ads, as it allows modelled conversions to fill gaps where consent has not been granted.

None of this is new advice. But the cookie saga has made it more urgent, because the window for “we will deal with this when we have to” has already closed for most businesses.

So What Does This All Mean for You?

Google’s reversal is not a green light to stop thinking about privacy-first marketing. It is a reminder that the platforms you rely on can change the rules at any time, and that the only sustainable strategy is one built on signals you own and data practices that would hold up under any regulatory or technical shift.

Third-party cookies are still here for now. But the advertisers who treated the last five years of “get ready for cookieless” as a genuine prompt to evolve their measurement and data strategy are in a considerably stronger position than those who waited it out and breathed a sigh of relief in July 2024.

If you want to talk through what a first-party data strategy looks like for your business, get in touch with the Repeat Digital team.