The Third-Party Cookie Is Finally Dead. Now What?

Google's Chrome 136 shipped this month with third-party cookies disabled by default, finally delivering on a deprecation timeline that the advertising industry spent five years lobbying to delay. The transition has been messy, the alternatives are imperfect, and the consequences for small publishers are likely to be worse than the headline numbers suggest.

The Privacy Sandbox proposals that Google developed as replacements — Topics API, Protected Audience, Attribution Reporting — are now live, but adoption among ad-tech vendors is uneven. Major DSPs have integrated Topics API support; the long tail of retargeting and attribution vendors is lagging, creating inconsistencies that advertisers are finding difficult to reconcile across reporting systems.

For publishers, early data from the transition shows CPM declines of 15 to 30 percent for inventory that was previously served by third-party data segments. First-party data strategies — email newsletters, logged-in user bases, contextual targeting — are recovering some of that value for publishers who made the investment. Publishers without first-party data assets are absorbing the revenue hit without a clear path to recovery.

The browser landscape has fragmented. Safari and Firefox deprecated third-party cookies years earlier and built their ad businesses around alternative approaches. Chrome's delay meant the industry could ignore the transition for longer than was healthy. The scramble to replace 30-year-old infrastructure in 18 months reflects that delay, and the results show it.