Third-Party Cookies Were Supposed to Be Gone by Now. Here's What Actually Happened
Third-party cookies have been at the center of a long-running debate about online privacy, digital advertising, and browser control. Google originally planned to phase them out of Chrome, but the company later changed direction. Understanding the difference between the original proposal and Chrome's current approach helps you make better decisions about tracking, browser settings, and privacy tools.
In this post
1. What third-party cookies actually do
Cookies are small pieces of data that websites ask a browser to store. They can support ordinary functions such as keeping a user signed in, remembering preferences, maintaining a shopping cart, or measuring activity across a website.
A cookie is generally considered a third-party cookie when it is used in a context where the cookie's site differs from the site the user is visiting. For example, a news website may include an advertising or analytics service that also appears on many other websites. Depending on the browser's rules and the service's implementation, that third-party service may be able to use cookies to recognize a browser across different sites.
This cross-site recognition can help advertising companies measure campaigns, manage advertising frequency, and personalize ads. It can also contribute to profiles built from browsing activity across multiple websites, which raises privacy concerns when users do not expect that information to be connected.
Third-party cookies are not inherently malicious. Some cross-site services use cookies for legitimate functionality, such as embedded content or federated sign-in. The privacy question is whether the data collection is necessary, transparent, appropriately controlled, and consistent with the user's expectations and applicable law.
First-party versus third-party cookies
First-party cookies are associated with the site a person is visiting and commonly support functions such as login sessions and saved preferences.
Third-party cookies are associated with another site or service embedded in the page and can enable certain forms of cross-site recognition when the browser permits them.
The distinction depends on the browsing context and cookie configuration. It does not mean every first-party cookie is harmless or every third-party cookie is used for advertising.
2. How Google's original plan changed
Google announced the Privacy Sandbox initiative in 2019. One of its major goals was to develop alternatives to cross-site tracking and eventually phase out third-party cookies in Chrome. The proposal attracted attention because Chrome has a large share of browser usage, and changes to its cookie behavior could affect publishers, advertisers, analytics providers, and website developers.
The transition proved more complicated than the original timeline suggested. Advertising companies had existing systems that relied on third-party cookies, while developers and regulators raised questions about compatibility, competition, privacy, and the proposed alternatives.
The key changes happened over several years:
- 2019: Google announced Privacy Sandbox as an effort to develop privacy-oriented alternatives for advertising and cross-site tracking.
- 2020–2023: The company outlined and revised plans for third-party cookie deprecation, with the proposed timeline repeatedly changing.
- July 2024: Google announced a change in direction, proposing to retain a user-choice approach instead of forcing a general removal of third-party cookies.
- April 2025: Google confirmed that it would maintain its existing approach to third-party cookie choice in Chrome and would not introduce the proposed new standalone cookie prompt.
- October 2025: Google announced that several Privacy Sandbox advertising technologies would be retired, while selected technologies and other privacy-related work would continue.
These changes are documented in Google's April 2025 announcement and its October 2025 update.
The central point is that the original plan to eliminate third-party cookies throughout ordinary Chrome browsing did not proceed as first announced. That is different from saying that Chrome stopped developing privacy features or that all Privacy Sandbox work ended.
3. Chrome's current approach to cookies
Google's April 2025 announcement stated that Chrome would maintain its existing approach to giving users a choice about third-party cookies rather than introducing a new standalone prompt. Therefore, you should not assume that third-party cookies are automatically blocked for every Chrome user in ordinary browsing.
Individual settings still matter. A user may block third-party cookies, clear browsing data, use an extension that restricts tracking, or browse in a mode with stricter cookie defaults. Websites may also behave differently depending on the browser version, account or enterprise policies, and the specific feature being used.
Chrome's Incognito mode blocks third-party cookies by default, according to Google's announced tracking-protection approach. Incognito mode is nevertheless not the same as complete anonymity: websites can still receive information such as the IP address visible to them, and other tracking or identification techniques may remain possible.
To review cookie controls in Chrome on a computer:
- Open Chrome and select the three-dot menu.
- Choose Settings.
- Open Privacy and security.
- Find the third-party cookie controls and review the available options.
- Choose the setting that fits your privacy needs, keeping in mind that some sites may rely on cross-site cookies for particular features.
You can also type chrome://settings/cookies into Chrome's address bar. The exact wording and available options may vary by release.
Do not rely on the old deprecation timeline. Articles written when Chrome planned a universal phase-out may describe a future that did not arrive as expected. Check the browser's current settings and official announcements rather than assuming that third-party cookies are disabled automatically.
4. How other browsers handle cross-site tracking
Chrome is not the only browser with cookie and tracking controls. Safari, Firefox, Brave, and Microsoft Edge have taken different approaches to reducing cross-site tracking. These approaches are not identical, so it is useful to distinguish outright cookie blocking from cookie partitioning and broader tracking prevention.
| Browser | General approach | What to keep in mind |
|---|---|---|
| Google Chrome | Offers user controls for third-party cookies and other privacy protections. | Do not assume third-party cookies are blocked for every user in normal browsing. |
| Apple Safari | Uses Intelligent Tracking Prevention to restrict cross-site tracking, including third-party cookies. | Some embedded services and sign-in flows may behave differently. |
| Mozilla Firefox | Enhanced Tracking Protection includes Total Cookie Protection, which partitions many cookies by site. | Partitioning limits cross-site reuse; it is not exactly the same as blocking every third-party cookie in every context. |
| Brave | Blocks third-party cookies by default as part of its broader Shields protections. | Protection can depend on settings and site-specific compatibility exceptions. |
| Microsoft Edge | Offers Tracking Prevention with different levels of restrictiveness. | The effect depends on the selected setting and the tracking technology involved. |
For current details, consult the official documentation for Safari's cross-site tracking protection, Firefox Total Cookie Protection, and Brave browser support.
There is no single browser setting that provides identical protection across every site, device, and tracking method. A privacy-focused browser can reduce some forms of tracking, but users should still understand its limits.
5. Why blocking cookies does not stop every tracker
Third-party cookies are only one method websites and advertising systems can use to recognize activity. Blocking them can make certain forms of cross-site tracking more difficult, but it does not automatically stop every form of data collection.
Browser fingerprinting
Fingerprinting attempts to distinguish a browser or device using a combination of characteristics, potentially including browser capabilities, screen properties, operating-system details, and graphics behavior. Individual characteristics may be common, but combinations can sometimes help identify or link visits.
Fingerprinting does not require a conventional third-party cookie, although the effectiveness and persistence of a fingerprint vary. Browser privacy features can reduce the amount of identifying information exposed, standardize certain values, or restrict access to some APIs. Fingerprinting should not be treated as a guaranteed way to identify every user.
First-party data collection
A website can still collect information about activity within its own pages, subject to its implementation and applicable privacy rules. For example, it may record which articles a visitor reads, whether a shopping cart is used, or how someone navigates between sections.
First-party analytics is not automatically the same as cross-site tracking. The privacy implications depend on what is collected, how it is linked to other information, how long it is retained, and whether it is shared with other parties.
Logged-in identity and server-side tracking
When someone signs in to a service, that service can associate activity with the account according to its systems and privacy practices. Blocking third-party cookies does not prevent a user from being recognized by a website where they deliberately sign in.
Server-side measurement can also process events sent by a website's own infrastructure. Whether this involves cross-site tracking depends on the identifiers, data sources, and sharing arrangements used; server-side processing is not inherently a way to bypass browser privacy controls.
The practical distinction: blocking third-party cookies reduces one important tracking mechanism. It does not make browsing anonymous, erase information already collected by websites, or prevent every method of recognizing returning visitors.
6. Practical ways to improve browser privacy
You do not need to wait for a browser-wide policy change to make more informed privacy choices. The following steps address several different sources of tracking and data exposure.
- Review third-party cookie settings. If you want to restrict cross-site cookies, check your browser's current controls and enable the available blocking option.
- Consider a browser with stronger default tracking protections. Compare how browsers handle third-party cookies, tracking scripts, fingerprinting defenses, and site compatibility.
- Use reputable content-blocking tools when appropriate. A well-maintained blocker can reduce requests to known advertising and tracking resources, but check its documentation and avoid installing unknown extensions.
- Review site permissions and extensions. Remove access that you no longer need, especially for unfamiliar extensions or websites.
- Clear cookies when useful. Removing stored cookies can end some sessions and remove certain identifiers, but it may also sign you out of websites. It does not delete information already held by a service.
- Limit unnecessary account linking. Signing into unrelated sites with the same third-party identity provider can create connections between services. Review the privacy implications and permissions of connected accounts.
- Keep your browser updated. Browser updates can improve security and tracking protections. They do not guarantee that every tracking method is blocked.
- Read privacy notices for services you use regularly. Browser settings control some data access, while the service's own policies and settings govern other collection and use.
Remember that privacy settings involve trade-offs. Blocking cookies and embedded resources may affect single sign-on, payment widgets, video embeds, or other site functions. If a feature stops working, consider whether a narrowly scoped exception is appropriate instead of disabling protections everywhere.
7. What website owners and advertisers should know
Changes to third-party cookie policies matter beyond individual browser users. Publishers, advertisers, analytics providers, and developers need to understand which technologies their sites depend on and avoid building long-term plans around an outdated browser announcement.
Website owners should begin by identifying the actual purpose of each third-party service. An embedded video player, payment provider, advertising tag, and analytics tool may have different cookie requirements. Testing these functions under stricter browser settings can reveal compatibility issues before they affect visitors.
- Audit third-party scripts and embeds. Identify services that access cookies or transmit visitor data to other domains.
- Test important user journeys. Check login, checkout, embedded media, and other features with third-party cookies restricted.
- Use first-party measurement responsibly. First-party analytics can support useful reporting, but data collection and sharing still need appropriate safeguards.
- Follow consent requirements. Browser cookie controls do not replace legal obligations concerning storage, access, or personal-data processing.
- Monitor official browser documentation. Check implementation status before adopting a proposed API or assuming that a technology will remain supported.
- Avoid depending on one tracking method. Build measurement strategies around clear purposes, data minimization, and reliable first-party business metrics rather than assuming that a particular identifier will always be available.
For Google's current direction, the most useful starting points are the official Privacy Sandbox announcement and its update on individual technologies. These explain why the original cookie deprecation plan changed and which parts of the initiative were affected.
Conclusion
The third-party cookie debate illustrates why browser privacy announcements need to be read as evolving plans rather than permanent guarantees. Google spent several years developing a proposal to move Chrome away from third-party cookies, but in 2025 it confirmed that it would retain its existing user-choice approach instead of introducing the planned standalone prompt. Several Privacy Sandbox technologies were subsequently marked for retirement, while other privacy and security work continued.
For everyday users, the practical question is not whether a browser once promised to eliminate cookies. It is what the browser currently permits, which privacy controls are enabled, and what other tracking methods remain possible. Checking settings and understanding their limits is more useful than relying on an old timeline.
For publishers and developers, the lesson is to test real browser behavior, review third-party dependencies, and build privacy-conscious measurement systems that do not depend on an unconfirmed future change.
Key Takeaways
- Third-party cookies can support cross-site recognition, advertising, and certain embedded services.
- Google changed its original Chrome deprecation plan and confirmed its user-choice approach in April 2025.
- Do not assume third-party cookies are blocked for every Chrome user in ordinary browsing.
- Safari, Firefox, Brave, and Edge use different combinations of cookie restrictions and tracking protections.
- Cookie blocking does not eliminate fingerprinting, first-party data collection, or every form of tracking.
- Users can improve privacy by reviewing settings, limiting unnecessary permissions, and choosing appropriate browser protections.
- Website owners should test their services under restricted-cookie conditions and keep up with official browser updates.