Chrome Keeps Third-Party Cookies. Your Identity Strategy Still Needs Work

The announcement

On April 22, 2025, Anthony Chavez, the vice president leading Google's Privacy Sandbox, wrote that Chrome will keep its current approach to third-party cookies. In his words, Google has made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies. Users can continue to manage cookies in Chrome's privacy settings. The post also said IP Protection for Incognito mode, where third-party cookies are already blocked, is planned for the third quarter, and that Google will gather feedback and share an updated roadmap for Privacy Sandbox technologies in the coming months.

Chavez cited divergent views among publishers, developers, regulators and the ad industry on changes that could affect the availability of third-party cookies, as well as the changing regulatory landscape and increased adoption of privacy-enhancing technologies.

How we got here

The timeline explains why many in the industry greeted the news with a mix of relief and fatigue:

• January 2020: Google announced plans to phase out third-party cookies in Chrome within two years.
• 2021 to 2024: The deadline slipped several times, while Privacy Sandbox APIs were developed under oversight commitments made to the UK Competition and Markets Authority.
• January 2024: Chrome restricted third-party cookies for 1% of users as a test.
• July 2024: Google dropped the plan to deprecate cookies outright and proposed instead an approach built on user choice, which was expected to include a new prompt.
• April 2025: No new prompt. The existing settings remain.

What this changes, and what it doesn't

For publishers, the immediate effect is that Chrome traffic keeps working roughly as it does today. Cookie-based targeting, frequency capping, retargeting and measurement remain available for most Chrome users who have not changed their settings. The fear of a sudden, large drop in addressable Chrome inventory in 2025 is off the table.

But several things did not change:

• Safari and Firefox still block third-party cookies by default. On many sites, particularly those with large iPhone audiences, a big share of traffic has been cookieless for years, and it typically monetizes at lower rates.
• Privacy law keeps expanding. U.S. state laws give residents the right to opt out of targeted advertising, and European consent rules apply regardless of browser. A cookie that exists is not the same as a cookie you may use.
• In-app and CTV never had cookies. Growth channels for many publishers already run without them.
• Buyers are building for a cookieless future anyway. Many DSPs and advertisers have invested in alternative IDs, contextual targeting and clean-room approaches, and they will keep using them.

Where Privacy Sandbox stands

Google's statement said the Privacy Sandbox APIs may play a different role than originally planned, and that it will share an updated roadmap. For publishers who tested Topics, Protected Audience or Attribution Reporting, the practical advice is to pause further investment until that roadmap is clear. Keep what you learned, but don't commit engineering time to APIs whose future adoption by buyers is uncertain.

Also note the one concrete change Google did confirm. IP Protection in Incognito mode is designed to limit third parties' access to users' IP addresses in that mode. Incognito traffic is already cookieless, so the practical effect is on IP-based signals: expect less precise geolocation and fewer IP-derived identifiers for that slice of traffic, and check how your fraud detection and geo-targeting handle it once it launches.

An identity plan that works in every browser

1. Measure your cookieless share

Know what percentage of your impressions arrive without a usable third-party cookie, by browser and by device, and what those impressions earn compared with cookied impressions. That gap is the size of the opportunity for everything below.

2. Build first-party relationships

Logged-in users, newsletter subscribers and registered members give you consented, durable identifiers. Where your ad server supports it, a publisher-provided identifier (such as Google Ad Manager's PPID) helps with frequency capping and audience targeting within your own inventory without relying on third-party cookies.

3. Use alternative IDs selectively

Prebid's user ID module supports many identity providers. Adding them costs page weight and data-sharing obligations, so test each one: turn it on for a portion of traffic, measure incremental revenue on cookieless browsers, and keep only those that pay for themselves. Make sure consent signals govern whether each ID is used.

4. Invest in context

Accurate, granular content signals are valuable in every browser and every privacy regime. Pass good page categories, keywords and content metadata in bid requests, and consider seller-defined audiences built from your own first-party data, packaged in standardized taxonomies buyers can read.

5. Sell what you know directly

Private marketplace deals built on your audience and context let you capture the value of your own data rather than leaving it to third parties to infer.

The real takeaway

The cookie question has been a distraction for five years. The strongest publishers used that time to build direct relationships with readers, better contextual data and cleaner consent practices. Those investments pay in Safari today, in Chrome for users who opt out, and in every future scenario.

Chrome's decision removes a deadline, not a direction. Build your identity strategy as if cookies were already gone, and treat them as a bonus where they still work.

If you are unsure how much of your revenue depends on third-party cookies, start with the measurement. It is a quick analysis, and it tells you where to invest next.