A Four-Month Retrospective Of Google’s Cookie Conundrum
This was originally a snapshot taken four months into Google’s cookie deprecation rollout. The rollout didn’t finish. It reversed. Here’s the complete arc, and what five years of planning around a deprecation that never fully happened actually teaches.
This piece was originally written four months into what looked like the start of the end for third-party cookies. Five years after Google first flagged its intent to deprecate them, the honest update is that deprecation never actually finished, and the technology built to replace it was largely shut down instead. That’s a genuinely unusual outcome for an infrastructure change this size, and worth understanding properly rather than filing away as old news.
The full arc, not the four-month snapshot
Google first signalled its intent to phase out third-party cookies in Chrome in early 2020. What followed was a repeated pattern of delay: the original target slipped multiple times across 2022 and 2023, a limited 1% rollout began in early 2024, that rollout was paused rather than expanded through the rest of 2024, and by mid-2024 Google had already dropped the plan to switch cookies off automatically. The reversal became official on 22 April 2025, when Google confirmed Chrome would keep third-party cookies on by default indefinitely, with no forced deprecation and no separate consent prompt either. Then, on 17 October 2025, Google retired most of the Privacy Sandbox APIs built over those five years as the intended replacement. The technical detail of what survived and what that means for adtech identity strategy specifically is covered in The Role of Adtech in the Privacy Sandbox Era.
What the industry actually did while waiting
Five years is a long time to plan around an uncertain deadline, and the industry’s response split roughly two ways. A genuine wave of investment went into first-party data infrastructure, clean rooms, server-side tracking, and consent architecture, work that assumed a cookieless world was coming regardless of exact timing. A separate wave went into narrower, deprecation-specific tooling, integrations built directly against the Privacy Sandbox APIs themselves, betting on the specific replacement technology rather than the broader shift it represented.
What endured anyway, and why that’s the interesting part
| Investment type | Outcome |
|---|---|
| First-party data infrastructure, consent architecture, clean rooms | Retained full value regardless of the reversal, still solving real problems |
| Direct integrations against specific Privacy Sandbox APIs | Largely stranded once those APIs were retired in October 2025 |
| Modelled and aggregated measurement approaches | Retained value, and arguably more relevant now given continued cross-browser fragmentation |
The split is instructive. Teams that treated the cookie deprecation as a symptom of a broader shift toward privacy-conscious measurement, and built infrastructure around that broader shift, came out of the reversal with assets that still matter. Teams that treated the specific Privacy Sandbox APIs as the target itself have a rebuild in front of them.
There’s a version of this outcome that looks, at first glance, like vindication for anyone who argued early on that Google would never actually follow through. It isn’t, quite. The regulatory pressure, the CMA scrutiny, the genuine attribution accuracy problems in the Privacy Sandbox tools, were all real constraints that made the original plan harder to execute than Google anticipated in 2020. Being right about the outcome for the wrong reasons, or by simply waiting rather than engaging with the trade-offs, isn’t the same as having planned well.
Need to put a number on your next media decision?
Model the impact of a media or marketing decision on your own numbers, browse the full library of strategic calculators and decision tools, and get definitions straight on the industry terms that come up along the way, three free resources, ready whenever you need them.
The real lesson isn’t about cookies
The specific technology doesn’t matter as much as the pattern it demonstrates: a five-year, industry-wide planning cycle organised around one vendor’s stated roadmap, a roadmap that vendor itself changed multiple times before ultimately reversing the core commitment entirely. That’s not a criticism unique to Google, any platform-dependent roadmap carries this risk. It’s a case study in why the infrastructure worth building is the kind that solves your own measurement and privacy problem directly, rather than infrastructure built specifically to integrate with someone else’s promised future state. The teams who are fine right now didn’t correctly predict that Google would reverse course. They just didn’t need to, because what they built didn’t depend on the prediction being right.
Free Playbook
The Customer Data Strategy engagement model covers building measurement and identity infrastructure around your own data and decisions, not a specific vendor’s roadmap that may or may not hold.
Get the Executive PlaybooksGoogle’s Cookie Conundrum: FAQ
Are third-party cookies gone or not?
Not in Chrome. Google reversed its deprecation plan in April 2025, and cookies remain on by default there. Safari, Firefox and Brave have blocked them for years regardless of Chrome’s policy, so the honest answer depends on which browsers matter to your audience.
Was the five years of industry preparation wasted?
Not uniformly. Infrastructure built around the broader shift toward privacy-conscious, first-party measurement retained its value. Integrations built specifically against the now-retired Privacy Sandbox APIs did not.
Could Google reintroduce cookie deprecation in future?
Nothing rules it out permanently, but reintroducing it would mean rebuilding replacement infrastructure largely from scratch given how much of Privacy Sandbox was retired in October 2025, which makes a near-term repeat unlikely even if not impossible.
