The funeral keeps getting postponed. The patient keeps fading anyway.
If you’ve ever pulled a retargeting report, noticed your iPhone audience barely registers, and thought “that can’t be right,” you already understand this story better than most of the headlines about it. That gap is the death of third-party cookies showing up in your reporting.
For six years, our industry treated the cookieless future like an asteroid with a date attached. Google announced it in January 2020: Chrome would phase out third-party cookies within two years. Conferences were themed around it. Vendors were funded on it. Agencies built decks about it.
Then the date moved. Then it moved again. And in 2024, Google called the whole thing off. Chrome still serves third-party cookies today.
So was it all hype? That’s the wrong conclusion, and it’s an expensive one. We’ve had some version of this conversation with clients every quarter since 2020, and the read hasn’t changed much.
The cookie didn’t die on a Tuesday with a press release. It’s fading slowly: browser by browser, privacy law by privacy law, bid request by bid request. If you buy or sell media programmatically, that difference matters, because the fade is already showing up in your CPMs, your match rates, and your attribution reports.
Here’s where things actually stand.
The short version
- Chrome kept third-party cookies, but Google shut down most of the Privacy Sandbox, the replacement it spent five years building.
- About one in three browser page views in North America already happens somewhere cookies don’t work.
- That unaddressable inventory sells for roughly a third of what addressable inventory sells for.
- Twenty US states now have privacy laws in effect, so consent, not Chrome, increasingly decides what you can use.
- Programmatic keeps growing regardless. The money is simply moving toward deals, CTV, and retail media.
What the death of third-party cookies actually costs you
A third-party cookie is set by a domain other than the site someone is visiting, usually an ad server, a DSP, an SSP, or a data provider. Because that same company can read its cookie across thousands of sites, it can recognize a browser as it wanders around the web.
Unglamorous, but it quietly held up most of the open web:
- Audience targeting built on browsing behavior
- Retargeting the person who left three pairs of shoes in a cart
- Frequency capping, so that person doesn’t see the same ad forty times
- Cookie syncing, so your DSP and the SSP agree on who they’re bidding on
- Attribution, connecting an impression on one site to a purchase on another
Pull the cookie out and every one of those gets fuzzier. That’s what people mean when they say “signal loss.” It sounds abstract until your CAC moves.
How we got here: six years of chicken
| When | What happened |
|---|---|
| January 2020 | Google says Chrome will drop third-party cookies within two years. |
| 2021–2023 | The deadline moves to 2023, then to late 2024. Nobody is surprised anymore. |
| January 2024 | Chrome cuts off third-party cookies for 1% of users as a test. |
| July 2024 | Google abandons the phase-out and floats a “user choice” prompt instead. |
| April 2025 | Google drops the prompt too. Cookie settings stay buried where they’ve always been. |
| October 2025 | Google retires most of the Privacy Sandbox, including Topics, Protected Audience, and Attribution Reporting, citing low adoption. |
| 2026 | Chrome begins deprecating the retired APIs, with removal targeted for mid-year. |
A few plumbing-level pieces survived, mainly CHIPS for partitioned cookies, FedCM for logins, and Private State Tokens for fraud. The parts built for targeting, remarketing, and measurement are gone. The UK’s competition regulator, which had been supervising the whole plan, closed its case afterward.
So the transition Google promised, from cookies to Google-built alternatives, is dead. The cookieless present, on the other hand, is doing fine.
Chrome says yes. The rest of the internet says no.
A third of North America is already out of reach
Chrome is dominant, not universal. Here’s StatCounter’s August 2026 data:
| Browser | Worldwide | North America | Third-party cookies by default? |
|---|---|---|---|
| Chrome | 69.39% | 55.06% | Allowed (blocked in Incognito) |
| Safari | 15.83% | 28.98% | Blocked |
| Edge | 5.36% | 7.30% | Allowed, with tracker limits |
| Firefox | 2.98% | 3.89% | Blocked or partitioned |
Safari and Firefox together are about 19% of page views worldwide and roughly 33% in North America. That’s before you count Brave, ad blockers, Incognito sessions, people who changed their settings, and everyone who clicks “reject all” on your consent banner.
For a US campaign, that means a third of your potential audience is effectively invisible to cookie-based targeting. Not “will be.” Is.
Apple keeps tightening, too. Safari has blocked third-party cookies since 2020, caps a lot of script-set first-party cookies at seven days, and with Safari 26 turned on Advanced Fingerprinting Protection for all browsing by default. If your backup plan was fingerprinting, that plan is getting worse every release.
Here’s the part that shows up in the P&L
Unaddressable impressions don’t just underperform. They’re worth less to everyone.
Research from Digiseg and AdExchanger found addressable impressions averaging a $12.74 CPM, while Safari and iOS impressions averaged $3.78 and non-consented impressions $2.44.
Same ad slot. Same human. More than three times the price difference, based entirely on whether the buyer can recognize them.
Read that from either side of the table:
Publishers, you’re discounting your iPhone audience, which is often your most affluent one, because buyers can’t put a name to it.
Advertisers, there’s cheap reach sitting there for anyone who can target and measure it without a cookie. That’s an arbitrage, and it won’t stay open forever.
Consent is the real gatekeeper now
Even when Chrome allows a cookie, the law might not.
As of August 2026, 20 states have comprehensive privacy laws in effect, with Indiana, Kentucky, and Rhode Island joining in January, and 12 states now require you to honor Global Privacy Control signals. There’s still no federal law, so if you sell nationally, you’re navigating a patchwork. In Europe, GDPR and ePrivacy have required consent for years, no matter what the browser does.
The pool of cookies you can legally use is smaller than the pool Chrome technically hands you. That gap keeps widening.
Nobody waited for Google anyway
This is the part we find most telling. The market adapted before the deadline it was supposedly waiting on ever arrived. IAB’s State of Data research found:
- 71% of brands, agencies, and publishers growing their first-party data, up from 41% two years earlier
- 95% expecting signal loss and privacy legislation to keep coming
- 73% expecting their ability to attribute and measure to get worse
Roughly two-thirds of US data and ad professionals had adopted data clean rooms as well.
When Google reversed course, all of that investment didn’t unwind. Nobody ripped out their CDP and went back to buying third-party segments. The reasons for building it never went away.
What this means for programmatic in 2026
Programmatic isn’t shrinking. EMARKETER expects US programmatic ad spend to top $200 billion this year, with most of it transacted through direct deals rather than the open auction. Its own H1 outlook now treats AI, not cookie deprecation, as the industry’s main disruption.
What’s changing is where the dollars land.
Deals over the open exchange. PMPs, programmatic guaranteed, and curated packages are winning because buyers want quality supply and sellers can attach first-party signals that work in any browser.
Retail media. US retail media spend is heading toward $70 billion this year. Purchase data means logged-in audiences and closed-loop measurement that never needed a cookie.
CTV. Households, logins, and IP addresses. No cookies involved.
Contextual, but good this time. It’s not 1998 keyword blocking anymore. AI reads the page for meaning, tone, and suitability in real time, and it performs identically in Safari and Chrome.
New identity plumbing. Universal IDs built on consented, hashed emails, publisher-provided IDs, and seller-defined audiences are replacing cookie syncing.
Measurement that doesn’t need a trail of crumbs. Server-side tagging, conversion APIs, modeled conversions, clean room matching, incrementality tests, and media mix modeling.
One more thing: Google just dodged a breakup
Worth knowing, because it shapes the pipes everything above runs through.
On September 2, 2026, Judge Leonie Brinkema issued her remedies decision in the DOJ’s ad tech antitrust case and rejected every structural remedy. Google doesn’t have to sell AdX or open-source the auction logic in its publisher ad server. The court went with behavioral remedies instead.
The full opinion is still sealed while the parties argue over redactions, and a proposed final judgment is due in early October, so the specifics aren’t public yet. Early reporting points to interoperability requirements and limits on practices that squeeze publisher revenue.
The practical read: the programmatic pipes stay roughly as they are. If the final rules force Google’s tools to play nicer with competitors, publishers get more routing options. Either way, the thing that actually differentiates you is your own data.
What to do about it
This is roughly the checklist we work through with clients, whichever side of the exchange they’re on.
If you’re buying:
- Find out how exposed you are. Break your site traffic out by browser, then list which campaigns quietly stop working without cookies. Retargeting and third-party segments first.
- Earn first-party data instead of renting audiences. Logins, subscriptions, loyalty, quizzes, anything with a real value exchange. Run a proper consent platform and honor GPC.
- Move measurement server-side. Server-side tagging plus conversion APIs recover conversions the browser eats.
- Test identity and clean rooms if your scale justifies them. Universal IDs recover addressability in Safari. Clean rooms let you match with retailers and publishers without handing over raw data.
- Put real test budget into contextual, PMPs, CTV, and retail media. Not a token 5%. Enough to read the results.
- Change how you prove it worked. Geo holdouts, incrementality tests, MMM. Last-click on a shrinking cookie base is measuring your own blind spot.
If you’re selling:
- Get people to log in. Authenticated audiences are the asset. Everything else is inventory.
- Stop dumping your Safari traffic into the open exchange at a discount. Package it with contextual and first-party signals and sell it through deals.
- Invest in curation and direct relationships. That’s where buyer demand is going.
Frequently asked questions
Are third-party cookies going away in 2026?
Not in Chrome, at least not by default. Google abandoned the phase-out in 2024 and dropped its choice prompt in 2025. But Safari and Firefox already block them, privacy laws restrict how they’re used, and plenty of people opt out, so their real reach keeps shrinking.
Is Google’s Privacy Sandbox still happening?
No. Google retired most of the Privacy Sandbox APIs in October 2025, including Topics, Protected Audience, and Attribution Reporting, citing low adoption. Chrome started deprecating them in early 2026. Only a few infrastructure pieces remain, such as CHIPS, FedCM, and Private State Tokens.
How much web traffic is already cookieless?
Per StatCounter’s August 2026 figures, Safari and Firefox make up about 19% of browser page views worldwide and roughly 33% in North America. The real number is higher once you add Brave, ad blockers, private browsing, and consent rejections.
What replaces third-party cookies in programmatic?
No single thing does. It’s a stack: first-party data, universal IDs built on consented identifiers, contextual targeting, clean rooms, retail media data, CTV signals, and modeled or aggregated measurement.
Do I still need cookie consent if Chrome allows third-party cookies?
Generally yes. GDPR, ePrivacy, and the growing list of US state laws apply regardless of browser behavior. Check with your legal team about what applies to you.
Did the court break up Google’s ad tech business?
No. In September 2026, the judge rejected the DOJ’s request to force a sale of AdX and opted for behavioral remedies instead. Details are expected once the opinion is unsealed.
The bottom line
The death of third-party cookies turned out to be a slow fade, not a funeral. Chrome still serves them. That just matters less every quarter, because a third of your audience never sees them, the law keeps narrowing what you can do with them, and the inventory they can’t reach is being bought and measured in completely different ways.
The teams winning right now aren’t the ones refreshing Google’s blog for the next announcement. They’re the ones who stopped waiting somewhere around 2022.
Want a second opinion on how exposed your programmatic setup is? At Sophisticated Marketing Solutions, we plan and run programmatic display, CTV, and digital audio campaigns built on first-party data and contextual signals, so your targeting and measurement keep working in every browser. No sales scripts, just strategy. Book a strategy call →
Written by William Campos, owner of Sophisticated Marketing Solutions, a Mesa, Arizona agency running paid search, programmatic, and SEO for brands across the Phoenix metro and nationally. Connect on LinkedIn →
Sources
StatCounter Global Stats · EMARKETER programmatic forecast · IAB State of Data · Digiseg/AdExchanger CPM research · US state privacy law tracker
