The Cookie Apocalypse That Didn't Happen

Somewhere in 2022 there was a slide. Every agency had a version of it, and it said that third-party cookies would be gone from Chrome by late 2023, so the budget request in front of you was not optional. The request funded a server-side tagging container on Google Cloud, a customer data platform, a consent management vendor, a BigQuery warehouse, and a consultant to wire the four together. Budgets got approved on the strength of that slide across most of the advertising industry. Chrome still supports third-party cookies today, and the technology Google built to replace them has been switched off. The interesting part is that almost nobody unwound the spending, because most of it turned out to be load-bearing for reasons that had nothing to do with the deadline on the slide.

A Two-Year Phase-Out, Announced Five Times

The starting gun was a Chromium blog post on January 14, 2020. Chrome engineering director Justin Schuh announced the Privacy Sandbox initiative and said Chrome intended to phase out support for third-party cookies “within two years,” while developing replacement APIs for ad targeting, measurement, and fraud prevention (Chromium blog, 2020). Two years from January 2020 is January 2022.

What followed was five years of slipping dates. In June 2021 Google published an updated timeline moving the phase-out to a three-month window starting mid-2023 (Google, 2021). July 2022 moved it to the second half of 2024. April 2023 moved it again. In April 2024 Google conceded it would not complete deprecation in 2024 at all, citing the need for more time to reconcile “divergent feedback” and, critically, the UK Competition and Markets Authority’s testing requirements (Privacy Sandbox blog, 2024).

That regulatory constraint deserves its own line, because it is the reason the schedule stopped being Google’s to set. In February 2022 the CMA accepted binding commitments from Google over the Privacy Sandbox changes, following an investigation into whether removing third-party cookies would entrench Chrome’s and Google’s advantage in advertising. The commitments required Google to consult the CMA, to give the regulator advance notice, and not to self-preference (CMA case page). A competition authority effectively held a veto over a browser release schedule, which is a genuinely unusual arrangement and one the rest of this book’s regulatory chapters keep running into.

Then the plan changed shape rather than date. On July 22, 2024, Anthony Chavez announced that Chrome would not deprecate third-party cookies at all. Instead Chrome would ship “a new experience” letting users make an informed choice that applied across their browsing, adjustable at any time (Privacy Sandbox blog, 2024). Deprecation by fiat became deprecation by opt-in prompt. Coverage at the time read the pivot as a concession that adoption of the replacement APIs had not reached the level needed to survive removing cookies outright (TechCrunch, 2024).

The Retraction, April 22, 2025

On April 22, 2025, Chavez published the sentence that ended it. Google had “made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies” (Privacy Sandbox blog, 2025). Users could still manage cookies through Chrome’s existing privacy settings, which is where they had always been able to manage them. Trade press treated it as the end of the project in substance if not yet in name (AdExchanger, 2025).

The timing is worth stating plainly. The announcement landed five days after a federal judge ruled that Google held illegal monopolies in the ad tech stack in the Department of Justice’s advertising case (PPC Land, 2025). A company under an active antitrust remedies phase had a weak position from which to unilaterally remove the identifier its competitors depended on and keep the signed-in identity graph its own products used. Whether that was causal or coincidental, the strategic logic of shipping cookie deprecation had inverted between 2020 and 2025.

Winding Down the Replacement Too

Keeping third-party cookies did not automatically mean killing the alternatives, and for six months it looked like Google would maintain the Privacy Sandbox APIs as an optional privacy-preserving path. On October 17, 2025, that ended. Google announced it would retire ten remaining Privacy Sandbox advertising APIs across Chrome and Android: Attribution Reporting, Topics, Protected Audience, Protected App Signals, Private Aggregation, On-Device Personalization, IP Protection, Related Website Sets, SelectURL, and SDK Runtime (Privacy Sandbox blog, 2025). Chavez attributed the decision to “low levels of adoption” and ecosystem feedback that the technologies were not delivering enough value. Deprecation begins with Chrome 144 in January 2026 and completes with Chrome 150 in July 2026 (PPC Land, 2025).

It is worth being concrete about what died, because the replacement APIs were not vague. Topics, which began life as FLoC and was renamed after criticism that cohort IDs were themselves a fingerprinting vector, had the browser derive a handful of coarse interest topics from browsing history and expose a rotating subset to callers. Protected Audience, which began as FLEDGE, ran the remarketing auction inside the browser so that an advertiser could bid on an audience it had built without any party learning who the user was. Attribution Reporting sent conversion reports with added noise and delays so that individual conversions could not be reconstructed. Each targeted one specific job a third-party cookie did. Each required every participant in the supply chain to rewrite integrations against an unfamiliar model with worse signal, in exchange for surviving a deadline that kept moving. The renames alone, FLoC to Topics and FLEDGE to Protected Audience, cost the ecosystem a year of documentation churn.

The sell side felt the cancellation differently from the buy side. Publishers and their SSPs had spent the same years building alternate identity plumbing, seller-defined audiences, authenticated traffic, contextual products, and integrations with the various shared-identifier vendors. Cookies surviving did not make that work worthless, because the yield problem it addressed was Safari and Firefox traffic that had never carried a third-party cookie in the first place. What it did do is remove the forcing function that made buyers accept lower-signal alternatives, which pushed the market back toward the identifiers that still worked and slowed adoption of the ones that were supposed to replace them.

Regulators unwound their side too. Having spent three years as the effective gatekeeper of Chrome’s release schedule, the UK CMA moved after the reversal to release Google from the 2022 Privacy Sandbox commitments, on the reasoning that the changes they were designed to police were no longer happening (CMA case page).

This is a six-year, multi-hundred-engineer program, with W3C working groups, IAB technical guidance, ad tech vendor integrations, and a regulator’s binding commitments attached, discontinued because not enough people used it. State it precisely when you talk about it, because a lot of 2026-vintage marketing material still describes Privacy Sandbox as upcoming or in progress. It is neither. FLoC became Topics and Topics is being removed. FLEDGE became Protected Audience and Protected Audience is being removed. The Attribution Reporting API is being removed.

What the 2020 roadmap promised	What actually exists in 2026
Third-party cookies removed from Chrome	Third-party cookies still supported by default
Topics API for interest-based targeting	Deprecated, removal completing Chrome 150
Protected Audience for remarketing	Deprecated, removal completing Chrome 150
Attribution Reporting API for conversion measurement	Deprecated, removal completing Chrome 150
A standardized, auditable privacy-preserving ad stack	Hashed first-party matching against platform login graphs

Why the Rebuild Stuck Anyway

If the deadline evaporated, the honest question is why nobody tore out the plumbing. Four reasons, and none of them is sunk-cost stubbornness.

Safari and Firefox were always the binding constraint. Chrome’s announcement got the attention because Chrome had the share, but WebKit’s Intelligent Tracking Prevention had blocked third-party cookies outright by March 2020 and capped script-writable storage at seven days without user interaction (WebKit, 2020). Firefox’s Enhanced Tracking Protection did the same on its own schedule. Neither of those retracted anything. The server-side tagging container an advertiser built to survive Chrome still earns its keep against Safari, which is where a meaningful share of high-value mobile traffic lives. The mechanics of that are in the previous chapter.

Regulation moved on a separate track and did not reverse. Consent Mode v2 became mandatory for EEA and UK Google Ads traffic on March 6, 2024, driven by the Digital Markets Act rather than by any browser roadmap (Google tag docs). No certified consent management platform means no new EEA users flowing into remarketing audiences, GA4 audiences, Ads conversions, or Floodlight lists. That constraint is legal, not technical, and Chrome keeping cookies did nothing to relieve it. Consent as an API takes that argument further.

The identity pivot was in Google’s interest regardless. Enhanced Conversions, launched in 2021, has the site capture first-party personal data at conversion, hash it with hex-encoded SHA-256, and send only the hash, which Google matches against its signed-in accounts (Google Ads Help). Customer Match works on the same principle. This is a structural shift from a shared, browser-owned identifier that every vendor could read to a private matching operation against a login graph, and it advantages whichever platform has the most signed-in users. Google had every reason to keep pushing it whether or not cookies survived, and advertisers had every reason to keep supplying the first-party data it requires.

Warehouse-first architecture paid for itself on other grounds. GA4’s BigQuery export shipped in the free tier, which UA had reserved for 360 customers, and it made the warehouse rather than the reporting UI the system of record. Once conversion data lives in BigQuery you get retention beyond the UI’s limits, joins to CRM and margin data, and modelling you cannot do in a report. That value proposition never depended on cookies at all.

What a Retracted Roadmap Should Teach You

The useful lesson is not “ignore platform announcements.” Google’s January 2020 post was a real statement of intent from a company that genuinely tried to execute it for five years. The lesson is about what kind of investment a platform roadmap justifies.

Two categories of spend came out of the cookie panic. The first category bought capabilities that are valuable under multiple futures: owning your own collection endpoint, holding a durable first-party customer record, moving the system of record into a warehouse you control, building a consent architecture. Every one of those pays out whether cookies live or die, because each solves a problem that exists independently. The second category bought compliance with a specific dated event: Privacy Sandbox API integrations, Topics-based targeting pilots, Protected Audience test buys, cohort-based measurement prototypes. That work is now worth nothing, and the vendors who staked a roadmap on it spent 2025 rewriting their positioning.

Sorting a proposal into those two categories before signing is the entire skill. Ask what the investment is worth if the announced change never ships. If the answer is “nothing,” you are not buying a capability, you are buying a bet on someone else’s release schedule, and browser release schedules turned out to be negotiable with a regulator. The next chapter turns to a piece of the stack where the contract is far less negotiable and the enforcement far more abrupt: the Merchant Center product feed.

Key Sources

Source	Author/Org	Year	Link	Why it matters
Building a more private web: A path towards making third party cookies obsolete	Chromium blog	2020	blog	The January 14, 2020 announcement of a two-year phase-out that started the whole rebuild
An updated timeline for Privacy Sandbox milestones	Google	2021	blog	First formal slip, moving the phase-out to mid-2023
Investigation into Google’s Privacy Sandbox browser changes	UK Competition and Markets Authority	2022	case page	The February 2022 binding commitments that handed a regulator effective veto over the timeline
Update on the plan for phase-out of third-party cookies on Chrome	Privacy Sandbox blog	2024	blog	Google conceding deprecation would not complete in 2024, citing CMA requirements
A new path for Privacy Sandbox on the web	Privacy Sandbox blog	2024	blog	The July 22, 2024 pivot from deprecation to a user-choice prompt
Next steps for Privacy Sandbox and tracking protections in Chrome	Privacy Sandbox blog	2025	blog	The April 22, 2025 confirmation of no deprecation and no prompt
Google Isn’t Launching A User Choice Prompt For Third-Party Cookies In Chrome	AdExchanger	2025	article	Trade reaction reading the April 2025 post as the practical end of the project
Update on Plans for Privacy Sandbox Technologies	Privacy Sandbox blog	2025	blog	The October 17, 2025 deprecation of all ten remaining advertising APIs
Chrome kills most Privacy Sandbox technologies after adoption fails	PPC Land	2025	article	Removal schedule from Chrome 144 to Chrome 150, plus the antitrust timing
Full Third-Party Cookie Blocking and More	WebKit	2020	blog	Safari blocked third-party cookies years earlier and never reversed, which is why the rebuild still matters
About enhanced conversions	Google Ads Help	2021	help doc	The hashed first-party matching pattern that replaced the shared cookie identifier

PM Lens