Third-party cookies are small data files set in a user's browser by a domain other than the website the user is currently visiting. They are the technical mechanism behind cross-site user tracking — enabling retargeting ads, cross-publisher audience segmentation, and multi-touch attribution. Safari and Firefox block them by default; Chrome introduced user-facing controls following its 2024 reversal of full deprecation plans.
Third-party cookies have been the plumbing of digital advertising for 30 years. The industry built retargeting, audience segmentation, frequency capping, and cross-channel attribution on top of them. That plumbing is now leaking, and the fallout affects every marketing team that runs paid social, programmatic, or display campaigns.
What are third-party cookies?
An HTTP cookie is a small key-value data file a web server instructs a browser to save. It's the mechanism that keeps you logged in, remembers your cart, and stores your preferences.
The distinction between first-party and third-party comes down to who sets the cookie:
- First-party cookie: Set by the domain you are actively visiting (example.com sets a cookie on example.com). Used for session management, authentication, and site personalisation. Trusted by all browsers.
- Third-party cookie: Set by a domain that is embedded in the page you're visiting, but is not the domain in your address bar. When you visit example.com and it loads an ad from doubleclick.net, doubleclick.net can set a cookie in your browser — even though you never navigated there directly.
That third-party cookie persists across every other site that also loads doubleclick.net. This is how advertisers build user profiles across the web: they see you on news sites, travel sites, e-commerce sites, and sports sites — all using the same cookie to stitch together a profile.
How cross-site tracking works
The cross-site tracking chain for a typical retargeting campaign:
- You visit a product page on a shoe retailer's website. The page loads a Meta Pixel — a JavaScript snippet from meta.com that fires a "ViewContent" event.
- Facebook's servers set a third-party cookie in your browser identifying you with a Facebook user ID.
- You scroll your Facebook feed the next day. Facebook's ad system recognises your cookie, knows you viewed shoe X, and serves you a retargeting ad for shoe X.
- You click the ad, return to the retailer, and purchase. Facebook's Pixel fires a "Purchase" event. The third-party cookie matches your pre-click and post-click identifiers, completing the attribution.
This entire chain depends on the third-party cookie surviving step 1 long enough to be matched in step 4. In Safari and Firefox, it doesn't — cookies set by third-party domains expire after 7 days (Safari ITP) or are blocked entirely (Firefox ETP).
How each browser blocks them in 2026
| Browser | Third-party cookie status | Market share (approx.) |
|---|---|---|
| Safari | Blocked by default since 2017 (ITP) | ~19% |
| Firefox | Blocked by default since 2019 (ETP) | ~3% |
| Chrome | Available with user controls (reversed deprecation, 2024) | ~65% |
| Edge | Balanced mode by default (some blocking) | ~5% |
Google announced in July 2024 that it would not proceed with a full Chrome third-party cookie deprecation as planned. Instead, Chrome introduced a user-facing IP Protection and cookie choice prompt. Third-party cookies remain available in Chrome for users who don't opt out — but regulatory pressure and opt-out rates mean the effective addressable audience is shrinking.
Impact on digital marketing
The weakening of third-party cookies has real effects across every major digital marketing channel:
Retargeting
Retargeting campaigns that rely on pixel-based tracking have seen reduced match rates and audience sizes. A user who visited your product page on Safari is invisible to Meta's retargeting if ITP has cleared the cookie before the attribution window closes.
Attribution
Multi-touch attribution models that stitched together cross-site journeys via cookies are increasingly blind. Conversions that happen on different devices or in different browser sessions show up as "direct" or "unattributed" — making ROAS calculations less reliable.
Audience segmentation
Third-party data segments sold by DMPs (Data Management Platforms) — "in-market for cars", "frequent travellers" — are less accurate when the cross-site browsing data used to build them is incomplete.
Frequency capping
Ad frequency capping across publisher sites depends on third-party cookies to identify the same user across sites. Without them, the same user can be served the same ad dozens of times on different sites, degrading ad experience.
What replaces third-party cookies?
The industry is fragmenting around several alternatives:
- First-party data. Email addresses, logged-in user IDs, CRM data. The most reliable tracking signal available — you own it, it doesn't depend on browser behaviour, and it works across devices. Building first-party data infrastructure is the single most important adaptation marketers can make.
- Server-side tagging. Moving pixel firing from the browser to your own server removes the dependency on browser cookie policies. The server fires conversion events directly to ad platforms via API, not via browser-side JavaScript. Accuracy recovers significantly.
- Google's Privacy Sandbox APIs. The Protected Audience API enables interest-based targeting without exposing individual browsing history. The Topics API assigns users to interest cohorts browser-side. Attribution Reporting enables conversion measurement without cross-site tracking.
- Contextual advertising. Targeting based on the content of the page being viewed rather than the history of the user viewing it. Contextual had been declining for a decade; it's seeing a strong revival as audience targeting weakens.
- Unified ID solutions. Identity graphs built on hashed email addresses (like Trade Desk's Unified ID 2.0) create pseudonymous identifiers that enable cross-publisher matching without browser cookies — but require user opt-in.
What marketers should do now
- Audit your measurement gaps. Check your ad platform attribution windows and compare to Safari traffic share. If 20% of your users are on Safari and your attribution model relies on 30-day cookie windows, you're likely missing a significant portion of conversions.
- Implement Conversions API (CAPI). Meta, Google, TikTok, and LinkedIn all offer server-side conversion APIs. Implementing CAPI alongside browser pixels improves signal redundancy and recovers attributed conversions on browsers where pixels fail.
- Build your email list aggressively. First-party data is the most durable signal in a cookieless world. Every email address is a cross-device, cross-browser identifier you own.
- Test contextual campaigns. Allocate budget to contextual buys on high-intent publisher sites relevant to your audience. Compare cost per acquisition to audience-based campaigns.
- Invest in modelled attribution. Google Ads' data-driven attribution and Meta's modelled conversions use machine learning to estimate conversions that aren't directly attributable. Use these rather than last-click for strategic budget decisions.
Frequently asked questions
Not fully dead, but dramatically weakened. Safari and Firefox have blocked third-party cookies by default since 2017 and 2019 respectively. Google reversed its Chrome deprecation plans in 2024, keeping third-party cookies in Chrome but introducing user-facing privacy controls. Effective reach has fallen significantly.
First-party cookies are set by the domain you are visiting — they store your login session, cart contents, and preferences. Third-party cookies are set by a different domain embedded on the page, typically an ad network or analytics provider, enabling tracking across multiple websites.
Ad networks are shifting to contextual targeting, first-party data partnerships, privacy-preserving APIs like Google's Privacy Sandbox, and server-side conversion tracking. The industry is fragmenting, with each platform building more walled-garden measurement systems.
Build first-party data collection through email lists, loyalty programmes, and gated content. Implement server-side tagging for conversion tracking. Invest in contextual advertising. Use modelled attribution in platforms that offer it.
Privacy Sandbox is Google's initiative to replace third-party cookie-based advertising with privacy-preserving APIs. Key APIs include Protected Audience (for interest-based advertising), Topics API (for interest cohort signals), and Attribution Reporting (for conversion measurement without cross-site tracking).
Related glossary terms
Sources
