Data Strategy · Analysis
Chrome kept third-party cookies. Privacy Sandbox was shut down. Six years of industry preparation for a deadline that never arrived — and the case for owning your own data is stronger than it was.
For most of six years, the entire digital advertising industry organised itself around a single approaching event. Google was going to remove third-party cookies from Chrome. Privacy Sandbox would replace them. Everyone needed a first-party data strategy before the deadline, and an enormous quantity of consulting was sold on that premise.
Then it didn’t happen. On 22 April 2025, Google announced it would maintain its existing approach to third-party cookie choice in Chrome and would not roll out the standalone prompt it had proposed. No phase-out. No deadline. Cookie controls stayed where they were, in Chrome’s privacy settings.
Six months later it went further. On 17 October 2025, Google announced the retirement of most Privacy Sandbox technologies — Topics, Protected Audience, Attribution Reporting, IP Protection, Related Website Sets and others. Chrome began deprecating those APIs in version 144 in January 2026, with removal targeted for version 150 in July. Only a small set survives: CHIPS, FedCM, Private State Tokens. The UK’s Competition and Markets Authority subsequently released Google from its Privacy Sandbox commitments and closed a four-year investigation, on the basis that Google was no longer removing third-party cookies.
If you spent 2021 through 2024 being told to prepare urgently, you were preparing for something that was cancelled. That’s worth saying plainly before anything else, because a lot of writing on this subject has quietly moved on without acknowledging it.
So Was It All Pointless? No, and here’s the distinction
The deadline was fictional. The condition was not, and this is the reframing that matters.
Safari has blocked third-party cookies by default since 2020. Firefox partitions all cookies through Total Cookie Protection. Brave blocks everything. Together that’s roughly 17–20% of global traffic that has been effectively cookieless this entire time, independently of anything Chrome ever did or didn’t do.
The cookieless future was cancelled. The cookieless present has been here for years.
And Safari’s Intelligent Tracking Prevention does more than block third-party cookies — it caps cookies set via JavaScript at a seven-day lifespan. A returning visitor on day eight looks like a new user. That single mechanism quietly corrupts returning-visitor metrics and any attribution window longer than a week, for every iOS user you have, right now.
“The cookieless future was cancelled. The cookieless present arrived years ago and nobody sent a memo.”
Then there’s the part that never depended on browsers at all. Your legal obligations are unchanged. ePrivacy Article 5(3) applies regardless of whether a cookie is first-party or third-party. CCPA’s treatment of sale and sharing is unaffected by Chrome’s product decisions. Anyone who was waiting for cookie deprecation to force a consent overhaul was waiting for the wrong event, and the obligation was there the whole time.
The Argument That Survives Why own your data anyway
Strip out the deadline urgency and the case for first-party data is actually cleaner, because it now rests on things that are permanently true rather than on a countdown.
It’s the only data you control. Every platform-mediated audience — a custom audience, a retargeting pool, a lookalike — exists at the platform’s discretion. Terms change, accounts get suspended, features get retired. An email list is portable. That asymmetry is the whole argument and it has nothing to do with cookies.
It’s accurate in a way inferred data isn’t. Declared preferences and observed purchases beat behavioural inference, consistently. A customer who told you what they want is better information than a model’s guess.
It works across the fragmented browser landscape. A logged-in customer is identifiable on Safari, Firefox and Brave equally, because identity is established by the relationship rather than by a cookie.
It compounds. Third-party data was rented. First-party data accumulates, and its value grows with tenure. A five-year customer history is an asset you couldn’t buy.
It’s the input to everything else. Enhanced conversions, customer match, server-side tagging, retention modelling, marketing mix modelling — all of them are downstream of having reliable first-party data. It’s infrastructure, not a channel.
What to Actually Build In order
One: A reason for people to identify themselves
This is the whole foundation and it isn’t a technology problem. Accounts, logins, subscriptions, saved baskets, order tracking, useful email — you need a genuine reason for someone to tell you who they are, and it has to be worth something to them.
Most first-party data strategies fail here rather than at the technical layer. An organisation buys a customer data platform before establishing why anyone would identify themselves to it, then discovers the platform is very good at managing a small amount of data.
Two: Consistent identity resolution
A single identifier that follows a customer across your properties. Usually a hashed email address, which has the advantage of being stable and of working with the major platforms’ matching features. This is what turns three fragmented records into one customer.
Three: Reliable collection
Working analytics, working conversion tracking, and consent handling that’s correct rather than merely present. If you have European users and run Google Ads audiences, Consent Mode is a requirement rather than an option.
Four: Somewhere to keep it
Your system of record, and eventually somewhere you can join data across systems. GA4’s free BigQuery export is the cheapest credible starting point — no sampling, indefinite retention, and it costs nothing to enable. It captures only from the moment you switch it on, which makes enabling it early the single highest-return five minutes in this article.
Five: Activation
Feeding hashed customer data back to advertising platforms through enhanced conversions and customer match. This is where first-party data stops being an archive and starts affecting performance — and it’s the step that recovers a meaningful share of the conversion signal lost to blockers and privacy settings.
The Data Worth Collecting And the data that’s just liability
“Collect first-party data” is advice that leads directly to collecting everything, which is both a compliance exposure and a way of burying the useful signal in noise.
The data that earns its storage:
Identity and contact. A stable identifier and permission to use it. Everything else depends on this existing.
Transaction history. What they bought, when, for how much, how often. The single most predictive dataset you will ever hold, and you already have it.
Declared preferences. What they told you they want. Small in volume, disproportionately reliable, and almost nobody collects it because inferring feels more sophisticated than asking.
Service history. Support contacts, returns, complaints, resolutions. Strongly predictive of churn and almost never joined to marketing data, which is one of the clearest arguments for having somewhere to join things.
Consent state and its provenance. What they agreed to, when, and through what mechanism. This is data about data and it’s the record you’ll need if anyone ever asks.
The data that’s mostly liability:
Granular behavioural streams you have no plan for. Every scroll, hover and micro-interaction, retained indefinitely, queried never. Storage is cheap and regulatory exposure isn’t.
Sensitive categories collected incidentally. Health, financial detail, anything about children, anything a form field captured because it was easier to ask than not to. If you’re not certain you need it, not collecting it is free.
Enriched third-party attributes appended to your own records. Bought demographic and firmographic data attached to first-party records makes the resulting dataset a hybrid you may not be able to explain the provenance of — which is exactly the position the GDPR provenance obligation makes uncomfortable.
A reasonable discipline: for every field you collect, be able to name the decision it informs. Fields that fail that test are cost and exposure carried for no return.
What to Stop Worrying About
| The advice | Status in 2026 | What to do |
|---|---|---|
| Migrate to Privacy Sandbox APIs | Obsolete | Most were retired; Chrome is removing them |
| Prepare for the Chrome cookie deadline | Cancelled | No deadline exists. Plan without one |
| Build a data clean room | Niche | Genuine at large scale; overkill below it |
| Buy a CDP | Premature for most | Establish why people identify themselves first |
| Handle Safari and Firefox cookie loss | Still true | Was always the real issue; unchanged |
| Consent management | Still required | Legal obligation, independent of browsers |
| Own an email list | More true than ever | The one asset no platform can revoke |
| Server-side tagging | Case narrowed | Justified by ad blockers and ITP, not by cookies |
Consent Is Now the Binding Constraint Not browsers
With the browser deadline gone, the real limiter on data collection is the one that was always there: whether people agreed.
This deserves treating as a design problem rather than a legal checkbox, because consent rate is now a direct input to how much data you have. Two organisations with identical traffic and identical technical setups can differ by a factor of two in usable data purely on how they ask.
Ask at a moment that makes sense. A consent banner blocking a page before anyone knows what the site is gets dismissed reflexively. The same request after someone has read an article and found it useful performs differently.
Say what you actually do with it. Specific beats comprehensive. “We use this to remember your preferences and measure which articles people find useful” outperforms three paragraphs of category definitions, because it’s readable.
Make declining genuinely easy. Beyond being required in most jurisdictions, dark patterns produce consent that’s legally fragile and behaviourally worthless — people who clicked accept to make a box disappear are not people who agreed to anything.
Instrument your consent rate and treat it as a metric. Most organisations have no idea what theirs is. It’s measurable, it varies enormously with implementation, and improving it is generally cheaper than any technical workaround for the data you lost by not asking well.
Configure Consent Mode properly if you advertise into Europe. Google gates audience features behind it for EEA traffic, and a correct implementation preserves modelled measurement for users who declined rather than simply losing them.
The reframing: consent isn’t the obstacle standing between you and first-party data. It’s the mechanism by which first-party data becomes yours to use, and it’s worth designing as carefully as any other conversion on the site.
The Lesson Worth Extracting Beyond this particular episode
There’s a more useful takeaway here than “cookies survived,” and it’s about how to respond to the next announced platform deadline — because there will be one.
The industry spent six years and an enormous amount of money preparing for a change that a single company could cancel unilaterally, and did. The organisations that came out best weren’t the ones who prepared hardest. They were the ones who built things valuable regardless of the outcome.
An email list was worth having whether or not Chrome removed cookies. A logged-in customer relationship was worth having either way. Accurate first-party measurement was worth having either way. Meanwhile, teams who rebuilt their audience strategy around Topics API or Protected Audience specifically now have nothing to show for it, because those APIs are being removed from the browser.
The general principle: when a platform announces a change, invest in the capability rather than the compliance. The capability — knowing your customers directly — retains value under every scenario. The compliance artefact retains value only under the announced one, and announced scenarios are revocable at the announcer’s convenience.
This applies well beyond cookies. It applies to every platform dependency in a marketing operation, and the test is simple: if this platform changed its terms tomorrow, what would I still have?
What This Means for Publishers Specifically A different position entirely
Most writing on first-party data addresses advertisers. Publishers sit on the other side of the same transaction and the implications differ.
For a publisher, first-party data is inventory value. An audience you can describe — logged in, segmented, consented — commands materially better rates than anonymous impressions, because buyers can target it without relying on third-party identifiers that don’t work on a fifth of traffic anyway. That gap didn’t close when Chrome reversed course; it just stopped being on a countdown.
The practical moves are the same in structure and different in emphasis. A registration wall or a genuinely worthwhile newsletter converts anonymous readers into known ones. Consent rate becomes a revenue metric rather than a compliance one, because unconsented traffic monetises worse. And contextual targeting — written off for a decade as primitive — has quietly become respectable again precisely because it works identically regardless of identifier availability.
The strategic point for publishers is the same one as for advertisers, arrived at from the other direction: an audience you have a direct relationship with is an asset nobody can revoke, and every intermediary in the chain has an interest in you not building one.
Where to Start, Concretely
This week: enable the GA4 BigQuery export if you haven’t. It’s free, it takes five minutes, and it only captures forward from today. Set data retention to fourteen months while you’re in there.
This month: implement enhanced conversions on your ad platforms. Hashed first-party data sent back with your conversions recovers attribution lost to blockers and privacy settings, and it’s the highest-impact technical change most advertisers can make without infrastructure work.
This quarter: audit your identity collection. What proportion of transactions are attached to a known customer? If it’s low, the fix is a better reason to identify rather than better technology.
This year: build one genuine value exchange — a reason someone tells you who they are that would be worth it to them even if you never sent a marketing email. Loyalty, useful content, saved preferences, better service. That’s the asset. Everything else in this article is plumbing attached to it.
Timeline verified against Google’s published Privacy Sandbox announcements of 22 April 2025 and 17 October 2025, Chrome release documentation, and the CMA’s case closure. Browser market share figures for cookie-blocking browsers are approximate. This article contains no affiliate links.