Third-party cookies in Chrome: what Google decided, and what it means for consent

What are third-party cookies?

A first-party cookie is set by the website the visitor is on. A third-party cookie is set by another domain whose content is loaded on that page, such as an ad network, a social media button or an embedded video. Because the same third party appears on many websites, its cookie can recognize the visitor across those sites. That is what makes third-party cookies useful for retargeting and cross-site tracking, and why browsers and regulators look at them closely. More on the different types in What are cookies?

Google's plan, and how it changed

The role of the UK competition regulator

Because removing third-party cookies from the most-used browser could hurt competitors in online advertising, the CMA investigated the Privacy Sandbox and in February 2022 accepted legally binding commitments from Google about how it would make the change. After Google decided not to deprecate third-party cookies, the CMA consulted on releasing those commitments and formally released them on 17 October 2025.

What happened to the Privacy Sandbox?

The Privacy Sandbox was a set of browser technologies meant to support advertising without third-party cookies. In October 2025 Google said that, after evaluating feedback and in light of low adoption, it would retire, among others: Attribution Reporting, IP Protection, Private Aggregation and Shared Storage, Protected Audience, Related Website Sets, Topics, and on Android also On-Device Personalization, Protected App Signals and the SDK Runtime. Google's feature status page now lists these as being deprecated and removed or scheduled for phaseout.

Google keeps supporting technologies that other browsers have also adopted or that improve privacy and security, such as CHIPS (partitioned cookies), FedCM (federated login), Private State Tokens, the Storage Access API and storage partitioning. For measurement, Google says it will work on an interoperable Attribution standard through the W3C.

What Safari and Firefox do

Other browsers went their own way years ago:

• Safari blocks third-party cookies by default. Apple's WebKit team announced full third-party cookie blocking on 24 March 2020, with Safari 13.1 on macOS and iOS and iPadOS 13.4. This is part of its Intelligent Tracking Prevention (ITP).
• Firefox turned on Total Cookie Protection by default for all desktop users on 14 June 2022. It gives every website its own separate "cookie jar", so a third-party cookie set on one site cannot be used to recognize the visitor on another site.

So in practice, part of your visitors already browse without working third-party cookies, while most Chrome users still have them.

What this means for your cookie banner

Whatever browsers do, the law has not changed. The consent rule in the EU (article 5(3) of the ePrivacy Directive and the national laws based on it) and in the UK (regulation 6 of PECR) applies to any storage of information on a device or access to it, whoever does it and whatever technique is used. See EU cookie law explained and UK cookie law.

That means:

• First-party cookies also need consent when they are used for advertising or tracking, and in most EU countries for analytics too. Moving tracking to a first-party cookie or a server-side setup does not remove the need for consent.
• Other techniques are covered as well, such as local storage, tracking pixels and fingerprinting.
• Your banner must block scripts that need consent until the visitor agrees, in every browser. A browser blocking some third-party cookies is not the same as you obtaining consent.
• Google's own consent requirements still apply. If you use Google Ads or Google Analytics for visitors in the EEA, the UK or Switzerland, you need Google Consent Mode v2. See Google Consent Mode v2 explained.

Regulators keep enforcing these rules: see our overview of cookie fines.

What to do now

1. Scan your website for first-party and third-party cookies, pixels and local storage.
2. Check the purpose of each one: strictly necessary, or does it need consent?
3. Block what needs consent until the visitor agrees, with "Accept" and "Reject" equally visible.
4. Set up Google Consent Mode v2 if you use Google tags.
5. Keep your cookie policy up to date, including first-party cookies; see our cookie policy template.

Cookie Confirm does this for you: the scanner finds first-party and third-party cookies every month, scripts stay blocked until consent, Google Consent Mode v2 is supported with all four signals (also through our Google Tag Manager template), and the cookie declaration is generated from the scan. For €7.95 per website per month, with a 7-day free trial without a credit card.

Sources

• Chromium Blog: Building a more private web, a path towards making third party cookies obsolete (14 January 2020)
• Google: An updated timeline for Privacy Sandbox milestones (24 June 2021)
• Google: Expanding testing for the Privacy Sandbox for the web (27 July 2022)
• Google: The next step toward phasing out third-party cookies in Chrome (14 December 2023)
• Privacy Sandbox: Update on the plan for phase-out of third-party cookies on Chrome (23 April 2024)
• Privacy Sandbox: A new path for Privacy Sandbox on the web (22 July 2024)
• Privacy Sandbox: Next steps for Privacy Sandbox and tracking protections in Chrome (22 April 2025)
• Privacy Sandbox: Update on plans for Privacy Sandbox technologies (17 October 2025)
• Privacy Sandbox: Feature status
• CMA: Investigation into Google's Privacy Sandbox browser changes
• CMA: Decision to release the commitments in respect of Google's Privacy Sandbox proposals (17 October 2025, PDF)
• WebKit: Full third-party cookie blocking and more (24 March 2020)
• Mozilla: Firefox rolls out Total Cookie Protection by default to all users worldwide (14 June 2022)
• EUR-Lex: Directive 2002/58/EC (ePrivacy Directive), article 5(3)
• EDPB: Guidelines 2/2023 on the technical scope of Art. 5(3) ePrivacy Directive