I have a complicated relationship with this topic. In 2013 I co-founded Retargeting with Rareș Bănescu, a marketing automation and personalization platform for online stores. The name says it all: a big part of our job was recognizing visitors who had left and bringing them back. In 2014 I wrote, with sincere enthusiasm, that retargeting plus e-commerce equals love. I left the company at the end of 2018, but that industry is, to some extent, still mine.
So when people ask whether the end of third-party cookies is bad news, my honest answer is: for some business models, yes. For the internet, in the long run, probably not. And I think the marketers who understand this first will enjoy a head start of several years.
What happened, in short
A third-party cookie is a small file placed in your browser not by the site you are visiting, but by someone else: an ad network, an analytics platform, a social button. Thanks to it, the same company can recognize you across dozens of different sites and build a profile of you. For about twenty years, a large part of online advertising has rested on this.
Meanwhile, browsers have started closing the door:
- Safari, through Intelligent Tracking Prevention (ITP), has been restricting third-party cookies since 2017 and, since spring 2020, blocks them completely by default.
- Firefox has blocked cookies from known trackers by default since 2019, through Enhanced Tracking Protection.
- In January 2020 Google announced it would phase out third-party cookies in Chrome “within two years”. On 24 June 2021, just three weeks ago, it pushed the deadline back: the phase-out is now expected to happen gradually, ending in late 2023.
Chrome matters enormously, because it is by far the most widely used browser. Many agencies greeted the delay with relief. I see it differently: it is not a reprieve, just a deadline moved further out. The direction has not changed.
FLoC and Apple: the two signals of 2021
So that advertising is not left with nothing, Google is proposing a set of technologies called the Privacy Sandbox. The most debated is FLoC, which would group users into “cohorts” with similar interests, calculated inside the browser, instead of tracking each person individually. FLoC was trialled in Chrome this spring and drew criticism from all sides: privacy advocates say it could become a new form of fingerprinting, and several browser makers and large websites have said they will not support it. In Europe the trial was not even switched on, precisely because of GDPR questions. In short, nobody yet knows exactly what will replace the third-party cookie.
The second signal came from Apple. With iOS 14.5, released at the end of April, apps must explicitly ask for permission to track you across other apps and websites (App Tracking Transparency). Many users say no, and Facebook has warned publicly that this affects its ad targeting and measurement. Anyone running Facebook campaigns has already seen the difference in their reports.
And on top of everything sits GDPR, the EU privacy regulation, with its consent banners. When I wrote my practical GDPR guide for online stores in 2018, many people saw it as a legal formality. It now looks like the first step of a much bigger shift.
What actually breaks
Online marketing is not disappearing. What disappears are some certainties we had grown used to taking for granted:
- Classic retargeting based on third-party cookies across other sites will work less and less, on ever smaller audiences.
- Following a user from one site to another becomes fragmented. You will see pieces of the journey, not the whole journey.
- Measurement gets harder. Conversions that showed up in yesterday’s reports will be missing tomorrow, not because they didn’t happen, but because you can no longer tie them to the ad that triggered them.
- Attribution models, especially last-click, lose what little credibility they had left.
The uncomfortable part is that many marketers have spent years living with an illusion of precision. The dashboard told you exactly which ad brought in every euro, and we believed it. In reality, attribution was always an approximation. Now the approximation becomes visible.
What I would do now if I ran marketing for an online store
Let’s say you run a mid-sized online store and a good share of your sales comes from paid ads. Here is where I would put my energy over the next two years:
- First-party data. Everything you learn directly from your customers, with their consent: emails, accounts, order history, a loyalty program. It is the only database that does not depend on decisions made by Google or Apple.
- Email and marketing automation. I said it back in 2017: email marketing isn’t dead. In a world without third-party cookies it becomes even more valuable, because it is a channel you own.
- Server-side tracking and consent done properly. Not to get around the user’s choice, but to measure correctly what you are allowed to measure. A clear, honest consent banner helps you more than one that tries to trick people.
- Contextual advertising. Ads placed next to the right content, rather than following the right person. It sounds like a return to the early 2000s, but with today’s tools it can be surprisingly effective.
- Content and SEO. Organic traffic needs no third-party cookies. A store that answers its customers’ questions well builds an advantage that compounds over time.
- A good CRM. If your customer data is scattered across five tools that do not talk to each other, first-party data is of no use to you.
From certainty to modelling
Perhaps the biggest change is one of mindset. Instead of hunting for the exact answer to “which ad brought in this sale?”, you will increasingly work with statistical models and incrementality tests. That is: you pause a campaign in one region or for one group of users, keep it running elsewhere, and compare. It is less comfortable than a report with figures to two decimal places, but it is closer to the truth.
I discussed the same principle last month when writing about proper tracking in affiliate marketing: money should go where real value is created, not to whoever happened to drop the last cookie.
Privacy is a legitimate demand
I want to be honest here, because I have sat on the other side of the table. The ad tech industry, including the part I helped build, ran for years on the idea that if you can technically collect a piece of information, you also have the right to use it. People were not asked. Most of them had no idea what was happening behind a web page.
The fact that browsers, regulators and users are now pushing in the opposite direction is not an attack on marketing. It is a correction. Marketing that only works as long as people don’t understand what you are doing to them is not a healthy business model. The best campaigns I have seen were built on relevance and trust, not on surveillance.
Conclusion
Third-party cookies are not disappearing tomorrow, but they are disappearing. Google’s delay buys you time, and time is exactly what needs to be used now: to build a direct relationship with your customers, to fix your measurement and to accept that you will no longer know everything. Those who start now will be ready in 2023. Those who wait for the final announcement will start in a panic.
How are you preparing? Have you already felt the effects of iOS 14.5 or Safari’s blocking in your campaigns?