For more than 4 years, Google said Chrome would stop supporting third-party cookies.
It didn’t happen. In July 2024, Google dropped the plan. In April 2025, it confirmed that third-party cookies stay in Chrome. In October 2025, it retired most of the Privacy Sandbox, the set of tools that was supposed to replace them.
Here’s the tl;dr:
- Third-party cookies still work in Chrome. Users can block them in Chrome’s settings, and Incognito mode blocks them by default.
- Safari and Firefox already limit them. Safari blocks third-party cookies by default, and Firefox keeps each site’s cookies separate. So a large share of your visitors are “cookieless” today.
- Privacy laws didn’t change. In the EU and UK, you still need consent before you set non-essential cookies, first-party or third-party.
- The smart move is the same as before: collect first-party data with consent, use contextual ads, and run a cookie banner that blocks trackers until visitors agree.
What changed with Google’s third-party cookie plan?
| Date | What Google did |
|---|---|
| 22 August 2019 | Announced the Privacy Sandbox, a set of tools to support ads without cross-site tracking |
| 14 January 2020 | Said Chrome would phase out third-party cookies “within two years” |
| 25 January 2022 | Replaced its first proposal, FLoC, with the Topics API |
| 2021 to 2024 | Delayed the phase-out 3 times |
| 4 January 2024 | Turned off third-party cookies by default for 1% of Chrome users, as a test |
| 22 July 2024 | Dropped the phase-out. Proposed a user-choice prompt instead |
| 22 April 2025 | Dropped the prompt too. Third-party cookies stay, and users manage them in Chrome’s settings |
| 17 October 2025 | Retired most Privacy Sandbox APIs, including Topics and Protected Audience, because of “low levels of adoption” |
Sources: Chromium blog, January 2020, Privacy Sandbox, July 2024, Privacy Sandbox, April 2025, Privacy Sandbox, October 2025.
In April 2025, Google gave its reason: there were “divergent perspectives on making changes that could impact the availability of third-party cookies.” Advertisers, publishers, and regulators couldn’t agree.
What happened to the Privacy Sandbox?
The Privacy Sandbox was a set of browser APIs. The goal was to let advertisers target and measure ads without following people from site to site.
In October 2025, Google said it would phase out most of them. The retired list includes:
- Topics: grouped users by interest. It replaced FLoC in 2022.
- Protected Audience: ran retargeting auctions in the browser. Early proposals like TURTLEDOVE and SPARROW fed into it.
- Attribution Reporting: measured ad conversions.
- IP Protection, Shared Storage, Private Aggregation, and Related Website Sets.
Chrome started removing them in 2026. Chrome 144 (January 2026) listed Protected Audience, Shared Storage, and Private Aggregation for removal. (Chrome 144 release notes)
A few parts stay because other browsers use them too: CHIPS (partitioned cookies), FedCM (federated sign-in), and Private State Tokens (fraud checks).
So if you read that FLoC or the Privacy Sandbox will replace cookies, that’s out of date.
What are cookies?
Cookies are small text files a website saves in the visitor’s browser. They remember logins, carts, language settings, and what people do on the site.
There are 2 main types of cookies, based on who sets them.
First-party cookies
The site you visit sets these, under its own domain. They keep you logged in, remember your cart, and power the site’s own analytics.
Example: you add a book to your cart on a store, close the tab, and come back the next day. The book is still there. That’s a first-party cookie.
Third-party cookies
A different domain sets these, through a script, pixel, or embed on the page. Ad networks, social media buttons, and video embeds are common sources.
They’re mostly used for ads. And they last after you leave the site.
How third-party cookies work
A third-party cookie follows the visitor across sites.
Here’s how. An ad network puts its script on thousands of websites. Each time you visit one of them, the script reads the same cookie in your browser. Visit by visit, the network builds a profile of what you look at.
Example: you browse a store and look at a brown hat and a pair of brown shoes. You buy only the hat. Over the next week, you see ads for those brown shoes on news sites, blogs, and social media. You never visited those sites with the shoes in mind. The ad network’s cookie told them.
A first-party cookie can’t do this. It remembers what you did on 1 site only.
That cross-site profile is why advertisers like third-party cookies. It’s also why privacy laws treat them strictly. A profile can show health searches, money problems, or political interests, even when each visit looks harmless.
What this means for your website
Google’s U-turn changes less than the headlines suggest.
- Chrome users can still block third-party cookies. The setting is under Privacy and Security, and Incognito mode blocks them by default.
- Safari has blocked third-party cookies by default since March 2020.
- Firefox turned on Total Cookie Protection for all users in June 2022. It gives each site its own cookie jar, so a cookie can’t follow people across sites.
- Consent rules didn’t move. Under the GDPR and the ePrivacy Directive, you need consent before you set non-essential cookies. That applies to first-party analytics cookies too, not only third-party ones.
So plenty of your visitors already browse without third-party cookies. And many more say no on your cookie banner.
The practical result: any marketing that depends only on third-party cookies already misses part of your audience. That was true before Google’s U-turn, and it’s still true now.
How to plan and prepare
The goal is to get reliable data from people who agree to share it, and reach the rest without tracking them.
1. Find out what your site sets today
Run a cookie scan. List every cookie and script on your site, who sets it, what it’s for, and how long it lasts.
Most site owners find a few surprises. A YouTube embed, a chat widget, or an old ad pixel can set third-party cookies you didn’t know about. You can also check cookies in Chrome by hand, page by page.
On WordPress, WPLP Cookie Consent runs the scan for you. It finds the cookies and scripts on your site, including third-party ones from embeds and ad pixels, and sorts them into categories.
2. Build a first-party data strategy
First-party data is information people give you directly, on your own site. It doesn’t depend on any browser’s cookie policy.
Ways to collect it:
- Newsletter sign-ups and gated guides
- Customer accounts and purchase history
- Surveys, quizzes, and feedback forms
- Preference centers, where people choose the topics and emails they want
Ask for consent, and say what you’ll do with the data. People share more with a brand they trust, and a clear consent record protects you if a regulator asks.
3. Use contextual advertising
Contextual ads match the page, not the person. They don’t need a profile of the visitor.
Example: an ad for hiking boots on a page about mountain trails. The reader is already thinking about hiking. No tracking needed.
Contextual targeting works in every browser, including Safari and Firefox, and for visitors who reject cookies.
4. Use privacy-friendly analytics
Some analytics tools can run with fewer cookies, or none, and keep data on your own server. Matomo, for example, can be self-hosted. See privacy-friendly analytics for the options.
These tools don’t remove the consent rules by themselves. Check what each tool sets, and how the rules apply in each country you sell in.
5. Run a consent banner that blocks until people agree
A consent management platform shows the banner, blocks non-essential scripts until the visitor agrees, and keeps a record of each choice.
On WordPress, WPLP Cookie Consent does all 3. Its banner holds back scripts and embeds until the visitor agrees, and you can whitelist the scripts the site needs to run, like login and cart cookies. Each decision is logged in your own WordPress database.
This matters more after Google’s U-turn, because third-party cookies still load in Chrome unless you block them. A banner that only shows a notice while the scripts run doesn’t meet EU rules.
If you run Google Ads or Google Analytics, use Google Consent Mode v2 so your Google tags follow each visitor’s choice. WPLP Cookie Consent has it built in.
6. Keep your cookie policy current
List the cookies you use, why, and for how long. Update the list each time you add a tool. Link the policy from your banner and your footer.
WPLP Legal Pages creates the cookie policy and privacy policy your banner links to.
FAQs
No. Google dropped that plan in July 2024 and confirmed in April 2025 that third-party cookies stay in Chrome. Users can still block them in Chrome’s settings, and Incognito mode blocks them by default.
Mostly no. In October 2025, Google retired most Privacy Sandbox APIs, including Topics, Protected Audience, and Attribution Reporting, because few sites used them. CHIPS, FedCM, and Private State Tokens stay.
Nothing replaces them in Chrome, because they’re staying. For visitors who block them, or who browse in Safari or Firefox, websites rely on first-party data, contextual ads, and consented analytics.
Yes, if you have visitors from the EU, the UK, or other places with consent rules. Google’s decision is about how Chrome works. It doesn’t change the law. You still need consent before you set non-essential cookies.
Scan your site for cookies, block non-essential scripts until visitors agree, collect first-party data with consent, and test contextual ads. For WordPress steps, see how to prepare a WordPress site for the end of third-party cookies.
Conclusion
Google’s cookieless future didn’t arrive. Third-party cookies stay in Chrome, and most of the Privacy Sandbox is gone.
Your job didn’t change, though. Safari and Firefox still limit third-party cookies, Chrome users can block them, and privacy laws still require consent.
So build on data you can count on: first-party data people agree to share, contextual ads that need no tracking, and a consent banner that does what the law asks.
Not sure what your site loads before visitors say yes? Run a free compliance audit and find out.
Related reading
