Third-Party Cookies 2026: After Privacy Sandbox

For years the industry braced for the death of the cookie. Conference tracks, webinars, panicked deadlines. Then the opposite happened. In April 2025 Google confirmed it would not force third-party cookies out of Chrome. In October 2025 it retired most of Privacy Sandbox — roughly ten APIs including Topics, Protected Audience and Attribution Reporting — citing low adoption. Deprecation began in January 2026 with Chrome 144 and removal wrapped up around Chrome 150 in July 2026.

So can advertisers relax and go back to 2019-era measurement? No. Because the biggest source of missing data in 2026 was never Chrome. Here is what actually changed, where your audiences and conversions are really leaking, and what to do about it inside Google Ads.

The factual timeline

Date	Event	What it means for advertisers
April 2025	Google drops the standalone opt-out prompt and keeps third-party cookies on by default	The cookie deadline is gone; no emergency migration needed
October 2025	Privacy Sandbox retired: Topics, Protected Audience, Attribution Reporting, IP Protection, Related Website Sets and others, citing low adoption	Anyone who built measurement on those APIs must rebuild
January 2026 (Chrome 144)	Deprecation of the retired APIs begins	Code calling them stops returning data
July 2026 (Chrome 150)	Removal completed	Fallback logic must already be in place
Still supported	CHIPS (partitioned cookies), FedCM (federated sign-in), Private State Tokens (anti-fraud signals)	Useful for embedded widgets and fraud defence

Separately, the UK Competition and Markets Authority closed its three-year Privacy Sandbox investigation — there was no longer anything to investigate.

Third-party cookies survived in Chrome. But Chrome is not the whole internet, and cookies are not the only way to lose data. Cancelling the deadline did not cancel Safari, ITP, consent law or ad blockers.

Where your data actually leaks in 2026

Take your real traffic mix and add up the loss sources. The total is usually higher than people expect.

1. Browsers that never waited for Google

Safari has blocked third-party cookies since 2020 and aggressively caps the lifetime of client-set first-party cookies through ITP. Firefox isolates trackers. Brave blocks by default. Together this is commonly 15–35% of traffic depending on geography and vertical — treat that as a directional benchmark and measure your own: iOS-heavy markets sit at the top of the range, Android-heavy markets well below it.

2. Consent

For EU/EEA and UK traffic, nothing is collected without explicit consent. That is a legal boundary, not a technical one, and it is entirely independent of Chrome’s decisions. The working answer is Consent Mode v2 with conversion modelling, not switching the banner off and hoping.

3. Blockers and extensions

uBlock, AdGuard, built-in mobile browser filters. Their share among technical audiences runs well above the market average.

4. Your own site architecture

This is the most underrated leak of all. A hop between domains, a redirect that eats query parameters, a form in an iframe, a hosted checkout — and the data disappears with privacy playing no part whatsoever. Diagnosis and setup in our guide to cross-domain tracking in Google Ads and GA4.

5. Short-lived client-side cookies

Even first-party cookies written by JavaScript last seven days in Safari, and in some scenarios one. For long sales cycles — B2B, high-ticket services — the identifier is long dead by the time the deal closes. The fix is server-set cookies plus storing the identifier in your own database.

What to do: priorities, not panic

The good news: almost everything worth building “in case cookies die” is worth building anyway. Only the motivation changed — from “otherwise everything breaks” to “otherwise you measure worse than your competitor.” Work in this order.

Priority 1 — first-party data, returned to the ad account

The most durable asset is an identifier you hold, not one the browser holds. In practice:

Capture the GCLID on first visit into a hidden form field, then store it with the lead in your CRM.
When the deal closes, send the outcome and its value back to Google Ads via offline conversion import or Data Manager.
Upload customer lists into Customer Match for exclusions and similar audiences.

None of this depends on Chrome, Safari or ad blockers — the data moves from your server.

Priority 2 — enhanced conversions

Enhanced conversions are the fastest way to improve data completeness without rebuilding infrastructure. A hashed email or phone number sent alongside the conversion lets Google match it to a click even when the cookie did not survive the journey. Implementation usually takes hours, and the effect is measurable immediately.

Priority 3 — server-side measurement

A server container gives you longer-lived cookies, resilience against blockers, and control over what leaves your infrastructure. This is not a privacy workaround — consent still applies — it is a way to stop losing the users who already consented. Architecture in our guide to server-side tagging with sGTM.

Priority 4 — Consent Mode v2 and modelling

If you advertise into the EU, the consent platform must pass signals to Google rather than simply blocking tags. Block everything and you lose not just some conversions but the ability to model the missing ones at all. The gap between “banner blocks all tags” and “banner passes consent signals” is usually double-digit in the reports.

Priority 5 — incrementality instead of faith in last click

When part of your data is modelled by definition, arguing about whether a conversion “really” came from paid stops being a spreadsheet exercise. It becomes an experiment: geo holdout, channel on/off, measure the delta. Methodology in incrementality and geo experiments.

What changed for targeting without third-party cookies

The practical headline: remarketing and lookalike targeting in Google Ads did not break. Audiences still build, dynamic remarketing still runs, customer lists still upload. But the emphasis shifted.

Owned lists now beat third-party segments. Data you collected is more accurate and does not depend on someone else’s infrastructure.
Modelled audiences gained weight. GA4 predictive audiences are built on behaviour inside your own property rather than cross-web tracking, so they were hurt least.
Context is back. Targeting by page content and by search intent requires no user identification at all. In 2026 that is a first-class layer, not a fallback.
Many remarketing lists shrank. Not because of Chrome, but because of Safari and consent. If lists never reach minimum size, fix collection, not the platform.

What changed for measurement

The central shift is the modelled share of conversions. Google increasingly infers a conversion statistically rather than observing it. Consequences you can act on:

Stop trying to reconcile Google Ads and GA4 to the unit — different models, different windows. A 10–15% spread is normal.
Track the trend, not the absolute. As long as the modelled share is stable, period comparisons remain valid.
Feed the algorithm quality, not volume. More observed conversions with identifiers means less guesswork and a more predictable Smart Bidding learning period.
Never count one purchase twice — duplicate conversions distort training more than undercounting does.

Calculate your own blind spot in an hour

Arguing about priorities without a number is pointless. Here is how to produce one:

Safari + Firefox + Brave share. Open the browser report in GA4 for the last 28 days and sum their share of paid traffic. That is your technical blind segment, where client-set cookies last days rather than months.
Consent refusal rate. Take it from your consent platform if it reports it. If not, compare GA4 sessions against server-side page loads; the gap gives you an upper bound.
Ads-to-CRM gap. Pull closed deals attributed to paid search for a quarter and Google Ads conversions for the same window. The percentage difference is everything lost across the whole journey.
Modelled conversion share. For some conversion types Google Ads exposes how much is modelled. The higher it runs, the fewer real signals you are supplying.

Four numbers turn “should we invest in tracking” into “here is how many deals we cannot see.” That is the only argument that works on both finance and engineering.

What it means by business type

E-commerce

Losses concentrate at checkout and the gateway return, not in privacy policy. The priority is a server-side purchase event fired from the payment provider’s webhook, carrying an order ID for deduplication. Product remarketing keeps working, but its volume scales directly with your consent rate.

B2B and long sales cycles

Here cookies are almost always dead by the time a deal closes — the cycle outlasts their lifetime. The only durable pattern is GCLID in the CRM plus closed-deal import. Everything else is cosmetic. Splitting primary and secondary conversions pays off too: optimising toward “form submitted” on a long cycle means buying volume rather than revenue.

Mobile apps

Web cookies were never the mechanism — attribution runs on app identifiers and SDKs. Chrome’s decisions barely touch this; consent requirements very much do.

Local businesses

The core conversions are calls and directions, which do not depend on third-party cookies at all. The weak link is connecting a call back to a click, so accurate call tracking matters far more here than the entire cookie storyline.

Five myths still getting in the way

“Cookies are gone, remarketing is dead.” They are not, and it is not. Check actual list sizes before drawing conclusions.
“Sandbox shut down, so privacy is over as a topic.” A set of APIs shut down. Legislation, ITP and blockers all remain.
“Server-side tagging is a way around consent.” It is not. A server container must honour the same consent signals; its value is preserving data from users who did consent.
“An Ads/GA4 discrepancy means something is broken.” A 10–15% spread is permanently normal — different models, different windows.
“We will buy an identity solution and be done.” Capture the GCLID in your CRM first. It costs nothing and delivers more than most add-ons.

The three surviving Sandbox components, and where they fit

CHIPS (Cookies Having Independent Partitioned State) are partitioned third-party cookies, readable only in the context of the embedding site. Relevant if you ship a widget, chat, calculator or player that needs state inside someone else’s page. Not an advertising targeting tool.

FedCM handles federated sign-in (“Continue with…”) without third-party cookies. Worth attention if you run accounts: a logged-in user is the most reliable identifier that exists.

Private State Tokens carry trust signals that separate humans from bots without revealing identity. Useful against click fraud — an adjacent topic covered in invalid clicks and budget protection.

How to explain this to your team and vendors

A specific 2026 difficulty is the noise. Half the articles ranking in search were written before April 2025 and still warn about the cookie apocalypse; the other half were written after October 2025 and declare the topic closed. Both lead to bad decisions — the first pushes pointless emergency migrations, the second cancels work you actually need.

The framing that works internally: the deadline is gone, the problem is not. Three talking points usually end the debate:

Chrome kept cookies, but plenty of our traffic is not Chrome — and losses there have always existed. Pull the number from your own browser report.
Consent requirements never changed and do not depend on browser policy. The legal track runs independently.
First-party data is not a privacy project; it is the only way to measure a long sales cycle. That argument lands with sales and finance in a way privacy arguments never do.

If an agency handles this for you, ask for the four numbers above rather than a privacy deck: Safari/Firefox share, consent refusal rate, the Ads-to-CRM gap, and modelled conversion share. A vendor who cannot produce them is working blind, whatever the proposal says.

Seven Google Ads settings worth checking tonight

These close in an evening and deliver more than any strategic discussion about privacy.

Enhanced conversions for web. Tools → Conversions → the action → diagnostics. A “not recording” status points at field transmission, not at the checkbox.
Enhanced conversions for leads. A separate feature, and essential for anyone closing deals offline.
Consent Mode. Check tag diagnostics for incoming consent signals. “No consent detected” on European traffic is a direct loss of modelled conversions.
Auto-tagging. Must be on. Without it there is no GCLID, and every offline conversion import collapses.
GA4 link and audience import. Confirm the link is active and remarketing lists are actually filling rather than sitting at zero.
Membership duration. When audience volume falls, extending membership duration beats rewriting targeting.
Conversion windows. On long cycles the default window silently cuts off deals — see conversion windows and lag.

One caveat: do not switch enhanced conversions on blindly without checking which fields you actually send. A badly captured email from a form field produces a low match rate and creates the false impression that the feature does not work.

What not to do

Do not roll server-side measurement back to the client because cookies survived. Every other reason you built it still applies.
Do not rewrite integrations around Topics or Protected Audience — those APIs no longer exist. Strip any remaining calls and verify the fallback path actually runs.
Do not switch off your consent banner where it is legally required. Google’s cookie decision does not amend GDPR, ePrivacy or local law.
Do not chase identity vendors first. Capturing the GCLID in your CRM and enabling enhanced conversions is cheaper and delivers more.
Do not postpone a measurement review until the new site ships. Every migration breaks what already worked — the sequence is in our site migration checklist for paid traffic.
Do not assume audiences will refill on their own. Check actual list sizes; if they are flat, collection is the problem.

A sprint-sized plan

Quantify your cookieless share: Safari plus Firefox plus consent refusals. That is your real blind spot.
Confirm no retired Sandbox API calls remain in your code.
Enable enhanced conversions if you have not.
Verify the GCLID is stored with every lead in the CRM.
Set up closed-deal import back into Google Ads.
Check Consent Mode: signals flowing, tags degrading rather than vanishing.
Walk your funnel manually and confirm nothing is lost between your own domains.
Schedule a recurring Ads / GA4 / CRM reconciliation.

The full sweep order is in our Google Ads account audit checklist. If you are building the foundations from scratch, start with the Google Ads guide, and for a worked review of your own setup there is structured hands-on Google Ads services.

FAQ

Are third-party cookies definitely safe now?

Google dropped forced deprecation and the standalone prompt, and retired Privacy Sandbox. Nobody promised “never”, but the current position is that cookies stay. Strategically, do not depend on them where it matters most.

Why was Privacy Sandbox shut down?

The stated reason was low adoption. The industry never moved to Topics or Protected Audience in meaningful volume, and once the deadline vanished the incentive disappeared entirely.

What happens to code that calls the retired APIs?

Those calls stop returning data and in some cases throw. Remove them and confirm your fallback branch works instead of failing silently.

Is server-side tagging still worth the investment?

Yes, for different reasons than before: longer-lived identifiers, resilience to blockers, and control over what data leaves your stack.

My remarketing list stopped growing. Is that cookies?

Probably not. Check in order: consent refusal rate, Safari share, tag coverage across all pages, and cross-domain hops. In 2026 those are far more common causes.

What is CHIPS and do I need it?

Partitioned cookies for embedded content. Needed if you publish a widget that lives on other people’s sites; not relevant for a typical advertiser.

Do enhanced conversions replace cookies?

No, but they cover part of the loss, working for users who can be matched on hashed contact data.

How do I justify tracking budget now that the deadline is gone?

With numbers. Measure your own cookieless share and show the gap between Ads conversions and CRM deals. That money is already leaking today, regardless of Chrome.

Do I need a consent banner if I do not target the EU?

Requirements follow your audience’s jurisdiction, not your company’s. Check the laws of the markets you buy traffic in — a legal question, not a Google Ads setting.

Does any of this affect Performance Max?

Indirectly but heavily. PMax depends entirely on conversion signal quality; better data means smarter budget allocation inside the campaign.

How much data does a typical advertiser lose?

It varies by geography and vertical. The 15–35% blind-traffic range is a common benchmark, but the only number that matters is the one your own Ads/GA4/CRM reconciliation produces.

Where do I start with limited resources?

Enhanced conversions and GCLID capture in the CRM. Two cheapest steps, biggest measurable effect on data completeness.