Chrome keeps third-party cookies after all

Google announced it will not ship the standalone prompt asking Chrome users whether to disable third-party cookies. The cookies stay. The Privacy Sandbox APIs remain available but are no longer the replacement for anything.

This ends a five-year process that reshaped the web advertising industry's roadmap and consumed an enormous amount of engineering attention across the entire ecosystem.

the timeline, compressed#

• 2020 — Google announces third-party cookies will be phased out within two years.
• 2021 — FLoC proposed. Universally criticized. Withdrawn.
• 2022 — Topics API replaces FLoC. Deadline slips.
• 2023 — Privacy Sandbox APIs ship. Deadline slips again.
• 2024 — UK CMA oversight formalized. Google announces a "user choice" prompt instead of deprecation. Deadline slips.
• 2025 — No prompt. Cookies stay.

why it failed#

Not primarily technical. The Privacy Sandbox APIs — Topics, Protected Audience, Attribution Reporting — were real engineering and some of the ideas were genuinely clever.

They failed because of an unresolvable structural conflict. Google needed the replacement to satisfy simultaneously:

• Privacy advocates, who wanted cross-site tracking to stop.
• Publishers, who needed their ad revenue not to collapse.
• Advertisers, who needed measurement to still work.
• Regulators, who needed to be convinced Google was not using a privacy initiative to advantage its own first-party data — which it has enormous amounts of and which is unaffected by any third-party cookie change.

That last constraint was the killer. Any third-party cookie deprecation strengthens Google's relative position, because Google has logged-in users everywhere and its competitors do not. The CMA was never going to wave that through, and Google was never going to ship something that hurt its own ad business.

Meanwhile Safari and Firefox blocked third-party cookies years ago and the web did not end. It just meant the tracking moved to fingerprinting, first-party data exchanges, server-side tagging, and CNAME cloaking — which are all worse for users because they are invisible and unblockable.

the lesson worth extracting#

Privacy improvements that come from the browser with the dominant market share and an advertising business will always be structurally compromised. That is not a claim about anyone's intentions. It is a claim about incentives, and incentives are more predictable than intentions.

The improvements that actually shipped came from browsers without advertising businesses. Safari's ITP. Firefox's Total Cookie Protection. Those did not require a five-year multi-stakeholder process because there was no internal conflict to resolve.

for developers#

Nothing you need to do. If you built for a cookieless future, that work is not wasted — Safari and Firefox users are already there, and they are a meaningful share of traffic for most sites.

If you are choosing an analytics stack, the interesting development of the last two years is that first-party server-side measurement is now easier and better than third-party client-side measurement for almost everything, cookies or not. Fewer requests, no ad blockers, better data, and you own it.

That transition was going to happen regardless of what Chrome decided.