The Death of Third-Party Cookies: What It Actually Means for Publishers
The deprecation deadline died. The direction did not. Roughly a third of European traffic already arrives without a third-party cookie, and consent rules mean the rest is shakier than the number suggests.
For four years the industry organised itself around a date: the day Chrome would switch off third-party cookies. The date kept moving, and then it stopped being a date at all. Publishers who built their strategy around the deadline were left with a plan and no deadline. Publishers who built around the underlying direction were fine, because the direction never changed.
What actually happened
Safari and Firefox have blocked third-party cookies by default for years. Chrome, holding the dominant share of European browsing, announced deprecation, delayed it repeatedly, then reversed course and retained third-party cookie support rather than removing it. The Privacy Sandbox proposals that were supposed to replace cookies were scaled back rather than shipped as a full replacement.
The result is a market that is neither cookieless nor healthy. A substantial share of European traffic already arrives with no third-party cookie available, and the share that does carry one is subject to consent rules that make it legally usable only some of the time. Nothing was solved; the deadline simply disappeared.
Why the European constraint was never the cookie
This is the part that gets lost in coverage written from a US perspective. In the EU and UK, setting and reading non-essential cookies requires valid consent, and the consent must be freely given, specific and informed. A third-party cookie without lawful consent is not an asset; it is a liability. Enforcement, consent fatigue and rejection rates have removed addressability in Europe faster than any browser change would have.
The practical consequence: a publisher that improves its consent experience — clearer value exchange, better timing, fewer vendors in the string — often recovers more addressable inventory than one that adopts a new identity solution. Reducing the number of vendors listed in the consent dialogue is one of the highest-yield changes available, and it is entirely within a publisher's control.
What replaced the cookie, honestly assessed
| Approach | What it does well | Where it fails |
|---|---|---|
| First-party data | Durable, consented, unique to the publisher | Requires registration and a reason to log in |
| Contextual | No consent dependency; now genuinely accurate | No frequency control or cross-site reach |
| Seller Defined Audiences | Publisher-built segments passed in the bid stream | Depends on buyer adoption and shared taxonomy |
| Data clean rooms | Match with advertiser data without sharing raw records | Cost and complexity; needs scale on both sides |
| Universal IDs | Cross-site addressability where consent exists | Same consent constraint; fragmented adoption |
| Privacy Sandbox APIs | Browser-level signals without cross-site identifiers | Scaled back; limited industry reliance |
Contextual came back for a real reason
Contextual targeting was dismissed for a decade as the crude thing behaviour replaced. It returned because the underlying technology improved beyond recognition. Language models read a page for meaning, tone and suitability rather than matching keywords, which removes the failure that discredited contextual in the first place — an airline advert placed next to a crash report because both contain the word "flight".
For publishers, contextual has a structural advantage that is easy to miss: it needs no consent, so it works on one hundred per cent of traffic. Inventory that carries no identifier is not unsellable inventory; it is contextual inventory, and pricing it that way recovers revenue that would otherwise be written off.
What publishers should actually do
Build a reason to log in. Newsletters, saved articles, personalised feeds, commenting. Registration is the only durable identity a publisher owns, and it is the asset that appreciates while everything else depreciates.
Audit the consent string. Every vendor listed reduces the acceptance rate. Cutting the list is faster, cheaper and more effective than most identity projects.
Sell your own segments. Seller Defined Audiences let a publisher package what it uniquely knows about its readers. It requires taxonomy discipline and buyer education, and it keeps the value with the publisher rather than a third-party data vendor.
Price non-addressable inventory deliberately. Treat it as contextual and premium-adjacent rather than remnant. The publishers who did this stopped watching a third of their inventory clear at floor price.
Note on data. Browser policy in this area has changed repeatedly and may change again; figures for addressable share vary substantially by market, device mix and consent implementation. Treat any single percentage with caution and measure your own consent and identifier rates rather than relying on published averages.
Sources
The claims in this article rest on the documents below. Each is linked to what it establishes, so you can check any statement against its origin rather than taking ours for it.
- Google, next steps for Privacy Sandbox and tracking protections in Chrome — the April 2025 decision: Chrome will neither deprecate third-party cookies nor ship the standalone choice prompt
Frequently asked questions
Are third-party cookies actually gone?
Not in Chrome. Safari and Firefox have blocked them by default for years, but Chrome reversed its deprecation plan and retained support. The deadline disappeared; the underlying loss of addressability did not, because a large share of traffic already arrives without a usable third-party identifier.
What does this mean for European publishers?
Less than the headlines suggest, because in the EU the binding constraint was always consent rather than the browser. A cookie without valid consent cannot be used lawfully, so consent rates and vendor list length determine addressability far more than Chrome's policy does.
Is contextual advertising good enough now?
Considerably better than its reputation. Language models assess page meaning, tone and suitability rather than matching keywords, which removes the adjacency failures that discredited it. It cannot do cross-site frequency control, but it works on all traffic regardless of consent — which makes it the natural pricing model for non-addressable inventory.
What is a Seller Defined Audience?
A segment the publisher builds from its own knowledge of its readers and passes to buyers in the bid stream using a shared taxonomy, without exposing individual identifiers. It keeps audience value with the publisher instead of a third-party data vendor, and depends on buyer adoption to be worth anything.
What is the single highest-return action for a publisher?
Improving consent acceptance, usually by cutting the number of vendors in the consent string and making the value exchange clearer. It recovers addressable inventory immediately, costs little, and is entirely within the publisher's control — unlike browser policy or buyer adoption of new standards.