“Cookieless future” is just a buzzword – Here is all you need to know about the end of third-party cookies

Cookies have been a vital part of web browsing for years. While some cookies provide essential functionalities like maintaining visitor sessions, third-party cookies have been controversial due to their ability to track users across the web without their knowledge or consent. People have grown more conscious about using and sharing their data, and many feel uneasy about the vast amount of personal data amassed through cookies.

Apprehensions surrounding third-party cookies have come to the forefront, spurring legislative changes. This has motivated tech giants like Google, Apple, and Mozilla to transition their browsers away from third-party cookies.

However, while other types of cookies face different restrictions, such as a limited lifespan, they are not going away. Although alternatives to cookies have been popping up, they have yet to be widely adopted. Thus, we don’t know what the future of marketing and advertising will look like.

Today, we will explore the challenges of the demise of third-party cookies for marketers, businesses, site owners, and consumers. We will look into new methods of tracking users and collecting analytics data and show you how to navigate a future that will not be so cookieless after all.

What are cookies

Cookies are small pieces of data stored on a user’s device that contain information about their interactions with websites.

Cookies are used for various purposes, such as:

• Session data management.
• Personalization and authentication.
• Tracking user behavior for analytics.
• Tracking users across different websites for targeted advertising.

Types of cookies and their differences

There are two main types of cookies: first-party and third-party cookies.

First-party cookies

First-party cookies are set by the website the user is currently visiting.

They are usually used to enhance user interactions with websites. For one, they help maintain sessions and remember login credentials, preferences, and shopping cart items. They also enable the personalization of content and advertising based on browsing history and interests and collect analytics data for website improvement.

Some first-party cookies provide essential functionalities on a website and aren’t considered invasive.

Third-party cookies

Third-party cookies are created by domains other than the one that the user is visiting.

Third-party cookies gain access to your visitors’ browsers through external services embedded in your site, such as:

• An embedded YouTube video.
• A social media widget.
• An ad widget from an ad display network.

Third-party cookies are used for cross-site tracking, retargeting, and serving curated ads to users via ad platforms or social media based on browsing history and other online behavior across different websites.

These cookies enable brands and vendors to gather a significant amount of personal information about a user, making it possible to create detailed user profiles. They can also be used for malicious purposes, such as tracking users to steal their personal information or deliver malware.

On the other hand, they let websites provide certain functionalities, such as live chats. However, the absence of third-party cookies does not typically affect a website’s core functionality.

Why are third-party cookies being phased out

When cookies were first created in 1994, sites gained the ability to track information across pages, which enabled many useful functionalities, such as running online shops. At the same time, the vast potential for abusing the technology and violating user privacy and security became clear.

These concerns were so apparent that in February 1996, the Financial Times published the first article about the dangers of cookies.

Third-party cookies allow advertisers and trackers to follow users across the web and collect sensitive information without explicit consent, which can breach trust between all parties. Because of the widespread use of cookies, data is scattered across various apps, websites, and services, making it difficult to control what happens with it.

Consequently, cybercriminals can use cookies to impersonate users, gather financial data, steal passwords, and engage in other nefarious online activities.

Internet users have been sensitive to the unauthorized collection and use of their personal data, viewing it as an invasion of their privacy. For example, users have been turning to ad block extensions to protect themselves from intrusive ads and trackers online. As of 2022, 37% of internet users worldwide had adopted ad blockers.

Concerns about third-party cookies have led to increased scrutiny and regulatory efforts to respect user privacy. Regulations like the CCPA & CPRA and GDPR view cookies containing identifiers as personal data. These privacy laws specify the requirements for gathering consent to track and collect user data online.

Under the jurisdiction of these laws, websites must, among others:

• Obtain explicit user consent before firing cookies, collecting or storing data on users’ browsers, or processing personal data for tracking and advertising.
• Clearly inform end users about the tracking technologies they use, detailing the providers, purposes, and duration of data collection.
• Keep consent records and provide the data in case of an audit or data subject access request.
• Allow users to change or revoke their consent preferences as easily as they gave consent.

These regulations impose severe fines and penalties on data collectors who don’t adhere to their requirements.

For years, cookies have been integral to the online experience. However, as major browsers withdraw support for third-party cookies, they’re paving the way for marketing and advertising that don’t rely on them.

The deprecation of third-party cookies in Chrome

Compared to other browsers, Chrome has been slower in imposing restrictions on third-party tracking. Third-party cookies power digital advertising, which is a vital component of Google’s business. Also, given Chrome’s 67% market share, Google’s approach to cookies impacts the entire industry.

• In January 2020, Google announced that it would phase out support for third-party cookies in Chrome, beginning with trials on conversion measurement and personalization by the end of 2020.
• In July 2022, Google announced a two-year delay to the end of 2024 for the of third-party cookies.
• Testing started in January 2024 with the rollout of a new Tracking Protection feature. Google restricted third-party cookies for 1% of Chrome users worldwide.
• In April 2024, Google announced it will not complete third-party cookie deprecation during the second half of Q4 as it previously expected and postponed it until 2025.
• On July 22, 2024, Google announced that it will not deprecate third-party cookies in Chrome. Instead, Google will introduce a new experience in Chrome that lets users make an informed choice about their web browsing, which they can adjust at any time.

Despite Google’s recent change of heart on third-party cookies, the technology has declined in prevalence due to the associated privacy concerns and is unlikely to recover. The quality and reach of third-party cookies have been continuously decreasing. If users get the option to opt out of tracking, they may additionally contribute to the technology becoming a thing of the past.

For years, the web has been moving away from third-party cookies in favor of more privacy-first technologies. Due to Google’s continuous promise to move away from third-party cookies and their deprecation in other major browsers, marketers had to adjust their approach by considering alternative solutions. The online advertising industry, which is particularly affected by cookie-related changes, still needs to adopt new ways of targeting users. 

While other browsers aim to transition away from third-party cookies, Google’s “cookieless” alternatives don’t necessarily focus on privacy. Google wants to preserve control over the majority of online advertising and the revenue generated from it. As the world’s largest ad platform, Google is strongly interested in maintaining its ad-targeting capabilities.

When Google announced it wouldn’t be deprecating third-party cookies in Chrome, the company vaguely explained its next steps. Google stated that it has been discussing its new path with regulators and will engage with the industry as it rolls out. The company will also continue working on the Privacy Sandbox API, which it has been developing as a privacy-focused alternative to third-party cookies.

What will replace the third-party cookie in Chrome?

Introduced in August 2019, the Privacy Sandbox is centered around developing measures to support advertising functionalities without relying on tracking users across websites.

The Privacy Sandbox has been an iterative process, with different APIs developed and deployed for testing. This process reached a breakthrough when the Privacy Sandbox initiative announced the release of six new APIs for Chrome in July 2023.

These APIs include:

• Topics
• Protected Audience
• Attribution Reporting
• Private Aggregation
• Shared Storage
• Fenced Frames

Here are their specifics:

Topics

Topics allow the browser to infer a selection of recognizable interest categories based on recent browsing history to enable sites to serve relevant ads. Unlike third-party cookies, Topics will only share users’ general interests, rather than granular behavior, across multiple sites.

Protected Audience

Protected Audience enables advertisers to run ad auctions using JavaScript code within the browser. Advertisers can also run targeted remarketing campaigns to custom audiences or groups of people with a common interest.

Attribution Reporting

Attribution Reporting allows measuring conversions from ad clicks and views, and ads on other platforms without tracking user activity across websites. It employs two types of reporting:

• Event-level reports – Providing detailed conversion data without revealing user identities.
• Summary reports – Presenting summarized data across large groups of users.

Private Aggregation

Private Aggregation makes it possible to generate aggregate data reports using data from Protected Audience and cross-site data from Shared Storage.

Shared Storage

Shared Storage allows sites to store and access unpartitioned cross-site data. This data must be read in a secure environment to prevent leakage.

Fenced Frames

Fenced Frames enable securely embedding content onto a page without sharing cross-site data.

Privacy Sandbox and the ad industry

There are mixed opinions about the Privacy Sandbox. Although it’s a viable alternative to third-party cookies, it will only operate in Chrome. While Chrome has a majority of market share, other browsers are still responsible for large chunks of traffic. Chrome is also not representative of traffic from other browsers and devices, where users may behave differently.

The identifiers created with Privacy Sandbox aren’t owned and stored by the advertisers, so they can’t be passed and activated in other systems.

According to a report by IAB Tech Lab:

“In its current form, the Privacy Sandbox may limit the industry’s ability to deliver relevant, effective advertising, placing smaller media companies and brands at a significant competitive disadvantage.”

In the end, Privacy Sandbox will not be the only solution to the deprecation of third-party cookies, but it is one of the alternatives that advertisers can consider. You can monitor the Privacy Sandbox timeline, as various proposals are currently in different development and testing stages.

The phase-out of third-party cookies by other vendors

Many browser vendors have been employing restrictions on user tracking for years.

Apple

Apple has implemented Intelligent Tracking Prevention (ITP) in Safari. ITP blocks third-party cookies by default and restricts first-party cookies and other browser storage options.

Additionally, Apple has introduced App Tracking Transparency (ATT). This user privacy framework requires all iOS apps to request permission via a pop-up to access the Identifier for Advertisers (IDFA) or device ID and track users across apps and websites.

Firefox

Firefox offers Enhanced Tracking Protection, which lets users block cookies and storage access from third-party trackers. Thus, users can decide what level of privacy they want to set up in their browsers.

Brave

Brave has been a privacy-focused browser from the start, blocking third-party cookies by default. It also enables many additional privacy and security features, allowing users to customize their privacy settings more granularly.

What does the demise of third-party cookies mean

Organizations that rely on third-party cookies will face challenges as certain functionalities won’t be available.

Activities that will be impacted include:

• Audience buying based on third-party data.
• Data activation on the web.
• Retargeting on the web.
• View-through advertising attribution.

The phase-out of third-party cookies signifies a massive transformation in digital advertising, making it more challenging for advertisers to track users across different websites.

As cookies become a thing of the past, the focus is on developing new technologies and methodologies that align with the evolving digital advertising ecosystem and enable marketers to deliver relevant and personalized content.

How to navigate the future without third-party cookies

The “cookieless future” refers to an impending reality in which third-party cookies are no longer part of marketers’ toolkit. It’s a landscape without access to user data collected through third-party cookies, impacting how we perform user tracking, generate leads, retarget ads, and understand user behavior.

This future, although challenging, presents an opportunity for innovation and growth in the digital marketing sector.

Focusing on first-party cookies

If your company uses first-party cookies as its primary marketing fuel, your activities won’t be affected much. These cookies will continue to work and remain an option, delivering measurable benefits even in the face of the changes concerning third-party cookies.

There are many first-party cookie-based methods you can still use in your marketing, such as:

• Web analytics. You can track users visiting your domain and collect analytics insights to improve user experience and drive better marketing results for your business. That’s possible with analytics tools that use first-party cookie identifiers, such as Google Analytics or Piwik PRO.
• Product analytics. Analyzing user journeys in digital products is based on a first-party identifier, like a first-party cookie or mobile app identifier generated by the SDK. In both cases, platforms like Mixpanel or Piwik PRO will function normally and provide useful data.
• Marketing tools. Most marketing tools already utilize first-party cookies, meaning you can use them despite changes to third-party cookies. For example, you can benefit from A/B testing tools (like AB Tasty, Optimizely or Convert) or marketing automation platforms (like SALESmanago, Hubspot or Marketo).
• On-site personalization and remarketing. You can personalize user experience on your website by applying first-party data-based technologies, be it Optimizely or Piwik PRO Customer Data Platform.
• Retargeting and tracking on iOS and Android. You can still retarget and track users across native mobile apps on iOS and Android using mobile identifiers.

Creating a first-party and zero-party data strategy

If you want your company to prioritize customers’ privacy and trust, you should focus on first-party data collection, supplemented by zero-party data.

First-party data is collected through direct interactions between the audience and the brand. It includes personal details, contact information, behavioral data from different channels, social media activity, purchase history, consent records, and more. Companies can enhance their first-party data approach by integrating analytics with data from other tools, such as CRM, marketing automation tools, email software, and many more.

Another valuable type of data is zero-party data, which refers to information intentionally and proactively shared by individuals with a company or organization. Zero-party data can be collected from customer reviews or comments, product-related preferences, newsletter opt-ins, or notification settings.

First-party and zero-party data are valuable because their collection relies on transparent, consent-based data practices and help establish trust between the company and its customers. These types of data are also accurate and reflect your customers’ behavior, making them relevant and practical when applied to initiatives like marketing or advertising campaigns.

“Cookieless future” and advertising

The ad tech industry stands to lose from the demise of the third-party cookie.

Ad tech vendors and digital advertisers have been using third-party cookies for features like:

• Identification.
• Frequency capping.
• Measuring performance and attribution.
• Audience activation.
• Cookie-syncing or matching between, for example, demand-side platforms and supply-side platforms.

The advertising industry needs to adopt effective methods that don’t raise privacy and transparency concerns like third-party cookies did. Striking that balance is often challenging as new industry standards must be created.

Some alternatives for digital advertisers include:

Contextual targeting

Contextual targeting is a form of targeted advertising that focuses on aligning ads with the content of a particular page. For example, it may involve placing an ad for kitchen utensils on a recipe site or an ad for a tour operator on a travel site.

Ads are segmented based on keywords, site topics, language, and location, and then matched with relevant content. By making ads reliant on a page’s context, brands can reach audiences with ad placements that are likely to resonate with visitors. Research from Sapio Research and DV shows that 69% of consumers are more likely to look at an ad if it’s relevant to the content they are reading.

Contextual targeting is a more privacy-friendly alternative to behavioral targeting, which is based on personal browsing data. Previously, contextual targeting faced issues with the quality and efficiency of classifying content. However, thanks to AI, modern contextual targeting can understand the nuances of content, thereby increasing engagement and effectiveness.

Contextual targeting offers numerous benefits in the “cookieless” world, such as:

• It offers the ability to reach large, diverse audiences, including acquiring new customers.
• It respects user privacy and doesn’t feel intrusive.
• It can help users find what they want and increase their purchase intent.
• It’s easy to start and optimize.
• It doesn’t rely on third-party cookies or users’ personal data.
• It can positively impact brand perception and reputation.
• It works across different channels.

Data clean rooms

A data clean room is a collaborative environment where two or more participants upload their first-party data and compare it to the aggregate data added by other companies.

Data clean rooms allow brands and advertisers to glean insights from each other’s first-party data under strict controls. They can use data clean rooms to:

• Run targeted advertising campaigns.
• Apply frequency capping.
• Perform audience analysis and enrichment.
• Measure and report on campaign performance.
• Run attribution.

All the data stays within the data clean room. Even though user-level data is added to a data clean room, it is not exposed to other companies.

There are different types of data clean rooms:

• Clean rooms as a service – Many data clean rooms exist as a service, meaning they are provided by independent vendors or platforms. These clean rooms are often the most flexible regarding what data can be used and how users can configure it. Examples include AppsFlyer, Habu, InfoSum, LiveRamp, and Snowflake.
• Private clean rooms – This generally includes large publishers with massive amounts of user data and content, like Disney, Spotify, and TikTok. These companies have proprietary private clean room technologies to monetize their customer base and create their own walled-garden advertising ecosystem.
• Walled garden data clean rooms – Walled gardens operate within a closed ecosystem and are owned and offered by big tech providers such as Google, Facebook and Amazon. They provide hashed and aggregated data to companies that use their advertising platforms, typically without the ability to combine data from other sources.

By securely aggregating and connecting customer data sets in a clean room environment, marketing teams can draw insights from a wide range of sources to better understand their customers while meeting data privacy requirements halfway.

Cookieless identifiers

Ad tech vendors and the ad tech ecosystem are developing alternative universal IDs to replace third-party cookies. Without third-party cookies, ad tech and data companies can’t perform cookie syncing like they used to.

The advertising industry needs to find alternative ways to create IDs, such as turning a person’s login details (e.g., email address) into an ID.

The selected ID alternatives must:

• Work across all digital channels.
• Provide the consumer with greater control.
• Operate in transparent ways.
• Better explain its value to consumers.

Balancing these aspects is challenging; hence, no solutions have been widely adopted yet. At the same time, this could mean that Big Tech companies will manage to increase their market share with their solutions at the expense of independent ad tech.

Here are some potential identifiers that have been introduced:

Universal IDs

A universal ID is a unique user ID that allows ad tech companies to identify users across different websites and devices. Universal IDs can operate within one environment, such as browsers, or identify users across various environments, such as browsers and mobile devices.

While universal IDs perform the same functions as third-party cookies, the difference is in how they are composed. Universal IDs are created using probabilistic data (e.g., IP address, browser type and model, and user-agent string), deterministic data (e.g., email address or phone number), or both. They help solve issues with cookie syncing and user identity.

Some notable universal ID solutions include:

Unified ID 2.0

Unified ID 2.0 is an identity framework that operates through a single sign-on to capture a user’s email address and consent once they visit a publisher’s page that supports UID 2.0. This consent is applied to targeted advertising across all publishers within the UID 2.0 network. Once the user logs in and consents, a hashed and encrypted identifier is created.

ID5

ID5 provides the advertising ecosystem with a stable encrypted user ID that replaces cookies and Mobile Ad IDs (MAIDs). Publishers, advertisers, and ad tech platforms can use these IDs to recognize users and deliver campaign objectives across different types of devices.

ID and device graphs

ID resolution services like ID and device graphs rely on taking and merging first-party IDs.

These IDs are taken from online and offline channels, such as websites, mobile apps, and customer and data platforms (such as CRMs, CDPs, and DMPs), and sent to the ID graph. Next, they are matched with other IDs in the graph using a combination of deterministic and probabilistic methods.

The main goal of ID and device graphs is to piece together IDs to create a centralized view of consumers rather than use these IDs for online media buying. Thus, companies can identify customers across different devices and channels and run various cross-device activities, such as ad targeting, personalization, and attribution.

For ID and device graphs to be lawful, users sharing their data must provide valid consent.

Piwik PRO and the demise of third-party cookies

The phase-out of cookies won’t impact the web analytics capabilities in Piwik PRO, but it may affect your use of third-party tracking scripts.

Here are the specifics of how cookies work in Piwik PRO:

First-party cookies

Piwik PRO exclusively utilizes first-party cookies for data collection. Users can continue to rely on our analytics platform without concerns about the removal of third-party cookies. Even without third-party cookies, you won’t see any difference in collecting analytics data from Chrome users.

Third-party scripts

Tag Manager allows you to implement third-party scripts like Meta Pixel or LinkedIn Insight Tag. Third-party scripts on your website can set both first- and third-party cookies. As a result, some scripts may not work as before without third-party cookies. This could lead to issues like incorrect campaign displays and difficulties in collecting campaign data.

Handling these issues depends on how ad tech companies like Facebook or Google Ads approach the transformation and what alternative solutions they provide for their pixels and other tracking tags. At Piwik PRO, we will do our best to adapt to any changes the vendors make.

For now, the consensus on the new ad tracking methods is not there yet. There are already things you can do to prepare for restrictions on third-party cookies:

• You can export goal conversions from Piwik PRO to Google Ads or Bing Ads. These exports will be helpful if Google Ads or Bing Ads cannot collect this data due to the lack of support for third-party cookies.
• The Meta Pixel has the option to rely on first-party cookies, which you can adjust in the pixel’s settings.
• Use the Piwik PRO Customer Data Platform to activate your data in other marketing tools and create targeted campaigns, send personalized emails, show relevant ads, and more.

Cookieless tracking

Piwik PRO also offers cookieless tracking, which involves alternative user tracking mechanisms, such as with a session hash.

Since cookies play a pivotal role in recognizing and tracking returning visitors along with their browsing sessions, cookieless tracking has certain limitations and can impact the precision of data.

However, cookieless tracking helps you align with strict cookie requirements. It still lets you collect valuable analytics data, such as events and traffic sources. This makes it a great option if you can’t use cookies for tracking purposes due to privacy laws.

Getting ready for the end of third-party cookies

To make your company well-prepared for the future, make sure to:

• Revisit all your tools and understand your first-party and third-party cookie situation. Analyze what role these cookies have in your current marketing and advertising strategy.
• Develop a first-party data strategy. Focus on trust and transparency in your relationship with users. You can support your efforts by showing users the value exchange behind sharing their data.
• Make sure you adopt any relevant data privacy and transparency measures. Implement a consent management system (CMP) to collect and manage user consent.

• Adjust your KPIs to focus on quality metrics. Prioritize engagement and conversion metrics. Focus on KPIs that reflect direct engagement and conversion on your site, such as session length, conversion rate, and goal completions.
• Get familiar with alternative marketing and advertising methods. Monitor the status of developments, like the Privacy Sandbox, and consider how they could fit into your company’s strategy.

Even without third-party cookies, you can benefit from a range of Piwik PRO’s features to collect, draw, and use valuable insights from your data. Reach out to us if you want to know more: