The third-party cookie phase-out is the multi-year, browser-led effort to stop supporting the cookies that track users across different websites. Safari and Firefox already block them by default. Google reversed its full Chrome phase-out in 2024 and 2025 in favor of a user-choice model.
So the deadline vanished, yet the phase-out did not. In October 2025 Google also discontinued most of its Privacy Sandbox ad-targeting APIs, the purpose-built cookie replacement. Chrome kept third-party cookies while cross-site tracking keeps declining, which is why first-party data plus documented consent is the durable answer.
What Is the Third-Party Cookie Phase-Out?
The third-party cookie phase-out is the multi-year, browser-led move to stop supporting third-party cookies. These are the cookies that let advertisers and analytics vendors track visitors across different websites. It is not one clean event. Safari and Firefox already block these cookies by default. Google delayed its own Chrome plan for years before reversing it entirely in 2024 and 2025.
People also call this cookie deprecation, the "death of third-party cookies," or third-party cookies "going away." All three describe the same shift, not one shutdown. Most confusion here comes from treating "phase-out" as a single deadline instead of three separate browser decisions made years apart.
Third-Party vs First-Party Cookies: What Is Actually Changing
A first-party cookie is set by the site you are visiting. A third-party cookie is set by a different domain embedded in that page, and it is this single distinction that resolves most of the confusion.
| Cookie type | Who sets it | What it is used for | Affected by the phase-out? |
|---|---|---|---|
| First-party cookie | The site you are directly visiting | Login sessions, shopping carts, on-site analytics, saved preferences | No. Every major browser supports first-party cookies by default. |
| Third-party cookie | A different domain embedded in the page (ad networks, tracking pixels) | Cross-site tracking, ad retargeting, audience profiles across many sites | Yes. This is the cookie type browsers restrict or phase out. |
A first-party cookie stays scoped to the domain that set it, so only that site can read it back. A third-party cookie works differently: any site that embeds the same third-party script can read it. That is what lets one ad-tech vendor aggregate a visitor's behavior across every site carrying its code.
Google Analytics is the clearest example of why this distinction matters. GA4 sets a first-party cookie on your own domain, so a standard GA setup is not directly affected by the phase-out. Cross-site audience matching and some ad-platform measurement still lose signal as third-party tracking declines industry-wide. That loss happens because the measurement depends on third-party cookies elsewhere in the ad stack, not on the GA cookie itself.
Third-party cookies being "blocked" in a browser means the browser refuses to send that cookie back to the domain that tried to set it. The site you are visiting still works. The tracking script embedded on it simply stops accumulating cross-site data. Read more on first-party and third-party cookie behavior directly from Mozilla.
If you need a refresher on what a cookie is before going further, start there.
Why Browsers Started Phasing Out Third-Party Cookies
Browsers restrict third-party cookies because of user-privacy pressure, regulatory scrutiny, and competitive precedent. Safari and Firefox already blocked them, and Google eventually followed with its own, later reversed, Chrome plan.
Third-party cookies let a single ad-tech vendor aggregate a visitor's browsing behavior across every site that embeds its script. That builds a cross-site profile the visitor never explicitly agreed to, and it is the specific behavior privacy advocates, regulators, and competing browsers targeted.
Three forces pushed browsers toward restriction:
- User-privacy expectations against invisible, cross-site profiling.
- Regulatory pressure from data protection laws like GDPR, ePrivacy, and CCPA/CPRA, which require a lawful basis for tracking.
- Competitive precedent, since Safari and Firefox already blocked third-party cookies by default before Google proposed doing so in Chrome.
Google's own Chrome plan additionally faced direct regulatory intervention. The UK Competition and Markets Authority scrutinized the deprecation for its effect on ad-market competition. That scrutiny contributed to the delays and reversal covered next. Privacy laws still require cookie consent before you set non-essential cookies, regardless of which browser a visitor uses.
The Chrome Timeline: From Deprecation Plan to U-Turn
Google's plan was announced in 2020 and delayed repeatedly. Google reversed it in 2024 and 2025, then narrowed it further in October 2025 when it discontinued most of the Privacy Sandbox's ad-targeting APIs.
| Period | What happened |
|---|---|
| 2020 to 2024 | Google announces the phase-out, then delays it multiple times |
| 2024 to 2025 | Google reverses the full deprecation for a "user choice" model |
| October 2025 | Google discontinues most Privacy Sandbox ad-targeting APIs |
| Ongoing | Safari and Firefox continue blocking by default, unaffected by any of this |
2020 to 2024: The Announced Phase-Out
Google announced in 2020 that it would phase out third-party cookies in Chrome, initially targeting a full removal by the end of 2022. That date slipped repeatedly as Google built out its Privacy Sandbox alternative and negotiated with regulators. A limited test began in the first quarter of 2024, disabling third-party cookies for 1% of Chrome users. The test let developers check for breakage before any wider rollout.
2024 to 2025: Google's Reversal and the "User Choice" Model
On July 22, 2024, Anthony Chavez, Google's VP of Privacy Sandbox, announced Google would not deprecate third-party cookies after all. Instead, Chrome would let users make an informed choice about cross-site tracking through existing browser settings. That choice stays adjustable at any time.
In April 2025, Google confirmed it would not even ship a new standalone Chrome prompt for it. The existing Privacy and Security settings remain the only control surface. The deadline vanished, but third-party tracking keeps declining for privacy and regulatory reasons that predate this one Chrome decision.
Google Discontinues Most Privacy Sandbox Ad APIs (October 2025)
In October 2025, Google discontinued most of the Privacy Sandbox's ad-targeting replacement technologies. The list includes the Topics API, Protected Audience API, Attribution Reporting, Shared Storage, and Related Website Sets. Google cited low adoption and continued regulatory pressure.
Google kept a narrower set of privacy-infrastructure pieces still in active use: CHIPS (partitioned cookies), the Federated Credential Management API, Fenced Frames, and storage partitioning. The practical result: Chrome kept third-party cookies, and Google wound down its purpose-built ad-tech replacement for them at the same time. No single technical successor to third-party tracking exists today.
Where Safari and Firefox Already Stand
Safari has blocked third-party cookies by default since 2017 through Intelligent Tracking Prevention. Firefox has blocked them by default since 2019, rolling Total Cookie Protection out to all users by 2022. Roughly half the web already runs without third-party cookies today. That is why the "phase-out" has already been a working reality outside Chrome for years, independent of anything Google decides.
What Is the Privacy Sandbox?
The Privacy Sandbox is Google's initiative for privacy-preserving browser technologies. It was originally proposed as an alternative to third-party cookies for ad targeting, measurement, and fraud prevention. It remains active in narrowed form: some pieces continue, and Google discontinued its main ad-targeting APIs in October 2025.
The Privacy Sandbox originally proposed several browser-native APIs to replace third-party cookies for advertisers. Three defined its ad-targeting core.
- Topics API: assigned visitors to broad interest categories locally, without sharing raw browsing history.
- Protected Audience API: ran ad-targeting auctions on-device instead of through cross-site tracking.
- Attribution Reporting: measured whether an ad campaign led to a purchase without tying that purchase back to an identity.
Google discontinued all three of these in October 2025, citing low adoption and continued regulatory pressure. Narrower infrastructure pieces remain active: CHIPS (partitioned first-party cookies for embedded content), the Federated Credential Management API for sign-in, Fenced Frames, and storage partitioning. None of these is a direct, one-to-one replacement for third-party ad tracking. See Google's current Privacy Sandbox status directly.
What the Phase-Out Means for Tracking, Advertising, and Analytics
Cross-site tracking is in long-term decline industry-wide, even with Chrome keeping third-party cookies for now. The practical impact on marketing operations is real, regardless of Chrome's exact stance.
Tracking. Cross-site retargeting and frequency capping both depend on identifying the same visitor across unrelated sites. Both weaken as more of the web, including Safari, Firefox, and privacy-conscious users in every browser, blocks third-party cookies.
Advertising. Programmatic ad targeting and view-through measurement lose signal without reliable cross-site identifiers. That is why Google's own advertising guidance still points partners toward durable, privacy-safe solutions regardless of the Chrome timing change.
Analytics. A standard Google Analytics setup keeps working because GA4 sets a first-party cookie on your own domain. Cross-site audience matching and some ad-platform attribution still degrade. That measurement typically depends on third-party cookies elsewhere in the ad stack, not on the first-party GA cookie itself.
Server-side tracking moves data collection from the browser to a server the business controls. It is one adaptation tactic marketers use to recover some of this lost signal without relying on third-party cookies. Google's advertising guidance confirms that durable, privacy-safe measurement remains the direction, regardless of Chrome's exact cookie timing.
The Shift to First-Party Data and Consent
The durable answer to the phase-out is first-party data: information collected directly from your own audience on your own channels, paired with explicit, documented consent.
First-party data is anything a business collects directly from its own audience through its own channels. Examples include website behavior, account activity, purchase history, and email or SMS engagement. Zero-party data is the narrower case where a visitor voluntarily hands over information, such as a stated preference or a survey answer. The business does not infer it from behavior.
First-party data is only a durable asset when it is collected lawfully. That is the throughline most phase-out content skips. A working model needs four pieces together.
- A consent banner that records each visitor's choice, not just displays it.
- Signaling that choice to Google tags through Consent Mode, so first-party analytics and ads keep functioning within the visitor's actual consent.
- A consent log that timestamps and stores every choice for GDPR, ePrivacy, and CCPA/CPRA evidence.
- A defined lawful basis before any non-essential cookie, first-party or third-party, gets set.
Web visitor behavior and CRM records both count as first-party data once a business collects them directly. They still need a documented, lawful consent basis behind them. First-party data is only an asset when its collection meets cookie compliance rules. A large first-party dataset built without valid consent creates legal exposure, not a safe alternative to third-party tracking.
How Consently Helps You Run on First-Party Data and Consent
Consently is the consent layer for a first-party, privacy-first website. It collects, signals, and documents visitor consent so first-party data and analytics stay both lawful and usable as third-party tracking declines.
Consently's Customizable Cookie Banner captures each visitor's choice and signals it to Google tags through Google Consent Mode v2. First-party analytics and ads keep working within that visitor's actual consent as third-party tracking declines elsewhere. The banner is built to match your site's branding rather than looking bolted on.
Behind that banner, Consently's automatic cookie scanning finds every cookie and tracker your site sets, so nothing runs before a visitor consents to it. Consent logs then record each visitor's choice with a timestamp, giving you evidence for GDPR, ePrivacy, and CCPA/CPRA reviews. Consently also supports IAB TCF v2.3 for ad-tech consent signaling alongside Google's Additional Consent framework.
This is the same model the phase-out rewards, regardless of what any single browser decides next. Own the first-party relationship, and keep the consent behind it documented. See how Consently's cookie consent banner works.
FAQs
Are third-party cookies going away?
Safari and Firefox already block them by default. Google reversed its full Chrome phase-out in 2024 and 2025, so they remain in Chrome for now while cross-site tracking keeps declining.
Did Google get rid of third-party cookies in Chrome?
No. In 2024 and 2025 Google scrapped the deprecation plan and chose a user-choice model. It confirmed in April 2025 it would not add a new standalone Chrome prompt for it.
What is the difference between a first-party and a third-party cookie?
A first-party cookie is set by the site you are visiting, covering login, cart, and on-site analytics. A third-party cookie is set by a different domain embedded in the page and enables cross-site tracking.
Does the third-party cookie phase-out affect Google Analytics?
Basic Google Analytics is not directly affected because it uses a first-party cookie. Cross-site audience matching, view-through attribution, and some ad measurement still weaken as third-party tracking declines.
What is replacing third-party cookies?
Mainly first-party and zero-party data plus consent. Google's Privacy Sandbox APIs and server-side approaches were partial, evolving alternatives, and Google discontinued most of the Sandbox's ad-targeting APIs in October 2025.
What should businesses do about the third-party cookie phase-out?
Build a first-party data strategy on owned channels, add a consent banner with Consent Mode signaling, and keep documented consent records. Test your site against Chrome's third-party-cookie-phaseout flag to check for breakage either way.
