Third-party cookies: identity, privacy and what replaces them

1. What exactly is a third-party cookie?

A cookie is a small name–value record that a server asks a browser to store and return on eligible later requests. It can preserve a login session, a shopping basket, a language choice or an advertising identifier. “First party” and “third party” describe the context in which that cookie is used—not two different cookie formats.

If the cookie’s domain and scheme match the site shown in the address bar, it is same-site or first-party. If they differ, it is cross-site or third-party. A news page at publisher.example might embed an advert, video, analytics tag or sign-in component from service.example. A cookie sent to that embedded service is third-party in that visit. MDN’s current third-party-cookie guide uses this site-context definition.

A cookie is also not the same thing as “all tracking.” A browser or server may recognise activity through account login, URL parameters, IP and device characteristics, local storage, mobile advertising identifiers, customer records or statistical inference. Removing third-party cookies closes one important channel; it does not make a service anonymous.

2. How one identifier follows a browser across sites

When the browser requests an embedded third-party resource, the third party may respond with a Set-Cookie header. On a later eligible request to that domain, the browser returns the cookie. To permit cross-site use, current cookie syntax normally requires SameSite=None; Secure. Secure protects transport over HTTPS; it does not make cross-site profiling private.

One ad-tech company rarely sees the entire market. Historically, companies matched their identifiers through redirects or server calls—a practice called cookie syncing. A supply platform might learn that its identifier A17 corresponds to a buyer’s identifier B94, allowing bid requests and later measurement to refer to the same browser. The result was an identity graph assembled across intermediaries, not one universal cookie.

Three boundaries matter. A cookie generally identifies a browser profile, not a verified human. Deleting cookies or changing devices breaks continuity. Shared devices can merge people, while one person using several devices can appear as several identities. Logged-in platforms may bridge some of those gaps, which is one reason account relationships became strategically valuable.

3. The five jobs third-party cookies performed

These jobs should not be collapsed into “personalisation.” Frequency capping can improve user experience; attribution helps budget allocation; fraud prevention protects both sides of a market. Conversely, the same portable identity can reveal visits to health, financial, political or other sensitive pages. The browser cannot infer the commercial purpose merely from the cookie.

Nor does attribution prove causality. A cookie can show that an exposed browser later purchased; it cannot by itself show that the advert caused the purchase. Incrementality requires a credible counterfactual, usually a randomised holdout or a carefully designed quasi-experiment.

4. Why the model became unacceptable

The central privacy problem is invisible reuse of state across contexts. A person may understand that a shop remembers its basket, yet not expect an advertising domain embedded in that shop to recognise the same browser on hundreds of other sites. The scale, duration and downstream combination of those observations make meaningful anticipation and consent difficult.

Cookie banners did not resolve the architectural problem. They moved a complex network of parties and purposes into a repeated interface that users often dismiss. The European Data Protection Board’s cookie-banner task-force report addressed common practices such as missing reject options, pre-ticked boxes and misleading link design. Browser restrictions instead change what the software permits by default.

In the UK, the rules cover more than cookies. The ICO’s final April 2026 storage and access technologies guidance applies PECR—and where relevant UK GDPR—to cookies, tracking pixels, fingerprinting, web storage, scripts and tags. Non-exempt access generally requires clear information and valid consent; strictly necessary and newer statutory exceptions are purpose-specific. A server-side implementation does not remove data-protection duties.

That last point is crucial. Moving a browser event through a first-party domain or sending it from the advertiser’s server may improve reliability and governance, but it can still disclose personal data to an advertising platform. “First-party,” “hashed,” “server-side” and “clean room” describe architecture or controls; none automatically establishes necessity, consent, anonymity or fairness.

5. What browsers actually do in 2026

Safari’s tracking-prevention documentation states that ITP blocks all third-party cookies by default. Mozilla describes Firefox’s default Total Cookie Protection as a separate cookie jar for each site. MDN’s June 2026 browser summary states that Chrome blocks third-party cookies in Incognito or when the user explicitly enables blocking, not by default.

Blocking and partitioning differ. Blocking denies the embedded cookie. Partitioning double-keys it by both the embedded domain and the top-level site. With CHIPS, for example, a chat widget can remember state within one publisher without carrying that state to an unrelated publisher. MDN reports broad current support for partitioned cookies.

Browsers preserve escape valves for legitimate functions. The Storage Access API lets eligible embedded content request access to unpartitioned cookies, usually in a user-mediated, site-specific context. FedCM moves federated login towards a browser-mediated flow. These are functionality tools, not general replacements for cross-site behavioural advertising.

6. Chrome’s reversal and the rise and retreat of Privacy Sandbox

Chrome matters because browser policy can change the addressable supply available to advertisers and publishers. It also sits inside Alphabet, whose businesses include Google Ads, publisher tools, YouTube, Search and a large logged-in identity base. That combination made both the privacy design and its competitive effects unusually consequential.

Google’s April 2025 announcement is explicit that Chrome would maintain its current approach to third-party-cookie choice and would not launch a standalone prompt. Its October 2025 technology update cites low adoption and expected value when retiring the advertising APIs. The living feature-status page, updated 14 August 2026, separates the retiring APIs from supported privacy and identity primitives.

This history contains a wider lesson. A replacement needs more than technical availability. Advertisers, publishers, ad-tech intermediaries and browser vendors must integrate it; its privacy guarantees must survive scrutiny; its auction and measurement utility must justify cost; and competing browsers must converge sufficiently for the open web to rely on it.

7. The competition argument: privacy can redistribute power

The privacy case against unrestricted cross-site identifiers is strong. The competition question is different: if those identifiers disappear, which firms retain comparable information inside their own services? A logged-in search, social, video or retail platform can observe behaviour and outcomes in a first-party environment. A stand-alone ad-tech company or small publisher usually has a narrower view.

The UK’s CMA investigated whether Google’s original Privacy Sandbox plan could transfer important functions into Chrome and favour Google’s ad-tech services. After Google abandoned the Chrome-wide restriction and standalone prompt, the CMA concluded in October 2025 that those specific competition concerns no longer arose and released the commitments. This was not a finding that privacy and competition can never conflict; it reflected the plan Google ultimately chose not to implement. See the CMA’s case record.

The CMA’s 2025 testing summary offers a useful but time-bound counterfactual. In 2024 tests, publisher revenue per impression was around 30% lower without third-party cookies even when the then-current Privacy Sandbox was available. Results varied, retargeting-focused businesses were more exposed, and the CMA identified important limits: low adoption, participation imbalances, leakage between test groups and an evolving product. Google later retired the APIs. The result should therefore be read as evidence that signal loss had material economic value—not as a forecast of a future market that will use different tools.

8. What replaces the third-party cookie?

The answer is a stack, not an identifier. Each layer should be judged by the job it performs, the parties that receive data and the privacy risk it creates.

Google’s enhanced conversions illustrate identity-rich matching: hashed first-party customer data is compared with signed-in Google account data to improve measurement. Amazon Marketing Cloud illustrates clean-room collaboration: advertisers query pseudonymised Amazon Ads and their own signals, with only aggregate outputs available. Both can be useful, but both deepen the strategic importance of platform-held identity or commerce data.

The open-web standards effort continues. The W3C Private Advertising Technology Working Group, chartered through November 2026, is developing interoperable features for advertising with strong technical privacy assurances, beginning with private attribution. A working group and draft specification are evidence of serious coordination—not proof of universal deployment.

9. Who is structurally advantaged?

Meta’s 2025 Form 10-K identifies loss of data signals, advertising consent and changes in measurement as material risks. Alphabet’s 2025 Form 10-K likewise says privacy practices and technologies that impede personalised advertising can affect its ad services. These are risk disclosures, not quantified forecasts.

The likely shift is from a relatively portable open-web identifier towards several controlled environments: publisher relationships, advertiser customer data, and large platforms’ authenticated graphs. That can improve accountability if data remains bounded and purposeful. It can also create new gatekeepers whose measurement claims are difficult for buyers to verify independently.

10. An investor and operator checklist

The debate should not be framed as relevant advertising versus no advertising. The real design space concerns how much information leaves a context, whether individuals can understand and control that movement, which measurement can be aggregate, and whether buyers and publishers can participate without surrendering the market to a few closed platforms.