A word from 2005 is still typed into every marketing link sent in 2026.
That word is utm, and almost nobody typing it knows why. In the last post I mentioned that UTM stands for Urchin Tracking Module and promised we would come back to it. Pull that one thread and you get the rise of an entire industry, the mechanism that powered it, the regulatory and technical backlash that nearly broke it, and the unfinished fight happening in Chrome right now.
I sit on the data side of a DSP and an ad exchange, and I have watched the consequences of every shift in this history land directly in the systems I own. So this is a history told from inside the machine, not a headline summary of it.
So that’s today’s post.
Today’s Post
Six sections, in the order the history actually happened.
- How a 2005 acquisition set the free-tools-for-data pattern the web still runs on
- The one domain-ownership distinction that explains the entire tracking industry
- How that distinction turned into retargeting, real-time bidding, and pixels
- The two-front backlash: regulators and browser engineers, arriving the same year
- Chrome’s five-year, twice-reversed attempt to kill its own cookie
- Where tracking actually went once the browser stopped cooperating
1. Urchin, and the birth of Google Analytics
In the early 2000s, if you wanted to know who was visiting your website, you bought software from a company called Urchin. Urchin read your web server’s log files and, later, added a JavaScript tag to report visits, referrers, and behavior directly.
Urchin was good enough that Google acquired it in 2005 and relaunched it, free, as Google Analytics. That single move reshaped the web. Any site owner could suddenly get sophisticated analytics at no cost, and a huge share of the internet wired Google’s tag into its pages within a few years. Google got an unprecedented view of web traffic. Everyone else got free measurement. The trade that defines the next two decades of the internet, free tools in exchange for data, was struck right here.
The naming stuck too. Urchin’s campaign-tagging parameters were called Urchin Tracking Module parameters, and the utm_ prefix survived the rebrand intact. Every time a marketer in 2026 tags a link with utm_source, they are typing the name of a company Google absorbed 21 years ago.
Analytics is only counting your own visitors, though. The stranger and bigger thing that grew on the web was the ability to follow one person across sites they never visited on purpose. For that, you need the cookie.
2. Two kinds of cookies, one distinction that matters
HTTP is stateless. Each request a browser makes is an island by default. The server has no built-in way to know that a request for /cart came from the same person who requested /product/42 a minute earlier.
The cookie fixed that. A cookie is a small piece of text a server asks the browser to store and resend on future requests to that same domain. Log in once, and every later request carries your session ID back automatically.
The distinction that decides everything downstream is who owns the cookie’s domain.
First-party cookie: set by the domain you are actually visiting. You are on shop.com, and shop.com sets the cookie. This is the shopping-cart cookie, the stay-logged-in cookie, and it is generally uncontroversial.
Third-party cookie: set by a different domain than the one in your address bar. You are on news.com, the page loads an ad from adnetwork.com, and adnetwork.com sets its own cookie in your browser while you were never looking at its domain at all.
That second case is the engine of the entire tracking ecosystem.
3. How the third-party cookie built an industry
Almost no website builds its own ads, analytics, and social buttons from scratch. Instead, pages embed resources, an ad slot, a “Like” button, an analytics pixel, that load from other companies’ domains. Each embedded resource is a request to a third-party domain, and that third party can set and read its own cookie on it.
Say adnetwork.com has its ad embedded on thousands of sites. The first time your browser loads any of those sites, adnetwork.com sets a cookie with a unique ID. Every later site in that network sends that same cookie back. The network can now stitch together a profile: one anonymous ID that read about running shoes on a sports blog, checked flights on a travel site, and lingered on a baby-products page.
That capability is what made retargeting possible, the reason a pair of shoes you glanced at once follows you around the internet for a week. It let advertisers buy audiences instead of placements, and it is the join key that real-time bidding runs on: when a page loads, dozens of bidders look up what they know about that ID and decide what to pay, all inside roughly 100 milliseconds before the ad renders.
This is where it gets personal. In a DSP-and-exchange data system, that cross-site identifier is the join key that connects an impression on one app to a click somewhere else to a conversion later. When that identifier is healthy, the joins are clean and the data tells a coherent story. When it degrades, the data fragments into several partial stories that do not reconcile.
Pixels and web beacons
A quick sibling to the cookie: the tracking pixel, or web beacon. It is a tiny, invisible one-pixel image embedded in a page or email. The request for that image is the signal itself. It tells the tracking server that this was opened, at this time, by this IP, with this cookie attached. That is how email-open tracking works, and how a conversion pixel fires on a thank-you page. The pixel is the trigger, the cookie is the memory, and they usually work together.
4. The backlash arrives from two directions
For about fifteen years this ecosystem grew with almost no friction. Then, starting around 2017, two forces converged on it at once: regulation and browser engineering.
Regulation. Europe’s GDPR, enforced in 2018, treated personal data, including online identifiers like cookie IDs, as something requiring a lawful basis to process, and in most ad-tech cases that basis is consent. Every consent banner you click through today exists because of this one rule. California’s CCPA followed in 2020 with a different shape, emphasizing the right to opt out of the sale of personal data, but the same direction of travel. Tracking flipped from allowed unless forbidden to requires permission.
Browser engineering. Apple’s ITP, launched in Safari in 2017, used heuristics and later machine learning to identify and block cross-site tracking, and aggressively capped how long cookies could persist. Over successive versions it effectively killed third-party cookies in Safari. Firefox’s ETP followed, blocking known third-party trackers by default.
Because Safari and Firefox together carry a large share of global traffic, third-party cookies were already substantially broken across much of the web well before the largest browser vendor made a single move. From my seat, that showed up as a structural skew: Safari traffic, disproportionately iOS and disproportionately high-value, became the hardest segment to attribute, precisely because Apple had decided it should be.
5. Chrome’s five-year, twice-reversed cookie saga
Then there is Chrome, which carries the majority of the world’s web traffic and is made by Google, whose business is advertising. That conflict is the whole drama, and it is a genuine multi-year sequence worth walking through in order.
In 2020, Google announced it would phase out third-party cookies in Chrome within two years. The timeline then slipped four times, from 2022 to 2023 to 2024 to 2025. In parallel, Google built Privacy Sandbox, a set of proposed replacement APIs including Topics, the Attribution Reporting API, and Protected Audience, meant to deliver interest-based ads and conversion measurement without exposing individual cross-site identifiers, keeping the data inside the browser instead.
Those replacement APIs largely failed. Citing low adoption, Google retired most of them in October 2025, keeping only a handful of narrower tools like CHIPS, FedCM, and Private State Tokens. Regulators scrutinized whether Privacy Sandbox would simply entrench Google’s own advantage, and ad-tech companies pushed back on the replacements throughout.
Then came the reversal. Google first floated a user-choice prompt in July 2024, effectively asking each Chrome user to decide for themselves. In April 2025 it scrapped even that prompt, leaving third-party cookies in Chrome with no deprecation timeline at all. The cookie did not get the clean execution everyone had spent five years planning for. It got an indefinite reprieve.
The lesson, if you are trying to make sense of the chaos: the people who profit from a technology are rarely the ones who can cleanly retire it. Apple, with no display-ads business to protect, simply killed third-party cookies. Google, whose revenue depends on them, spent five years unable to.
6. Tracking did not die, it moved
If you only read headlines, you would think tracking is dying. It is not. It relocated out of the browser’s exposed cookie jar and into places that are harder to block. Three shifts matter most.
Server-side tracking. Instead of the browser sending data directly to a dozen third-party domains, easy for a browser or extension to block, the browser now sends data to the site’s own server, which forwards it server-to-server to the ad and analytics platforms. To the browser it all looks first-party, and it is far harder for ITP or an extension to interrupt.
First-party data. When you cannot track people across sites anymore, the data you collect on your own properties, logged-in users, email subscribers, purchase history, becomes the crown jewel. The industry’s center of gravity shifted from buying audiences assembled by third parties to building and activating your own first-party relationships. A hashed email address quietly became one of the most valuable identifiers left standing.
Consent mode and modeling. With consent now mandatory, platforms introduced mechanisms, Google’s Consent Mode among them, where a missing consent signal does not just zero out the data. The gap gets modeled instead. As someone who runs a system of record, I will be blunt about what that means: the line between measured and inferred is blurring, and a conversion number in 2026 is sometimes a fact and sometimes a model’s best guess, and the report rarely tells you which one you are looking at.
The net effect, from the data side, is consolidation. Identity resolution is getting harder and more concentrated in the hands of platforms big enough to run massive first-party logins and the server-side engineering to match them. The open, third-party-cookie-based ecosystem democratized tracking. Its decline is re-centralizing it.
Takeaways
Six panels, one per section. Urchin to the cookie to the backlash to Chrome’s reversal to where the data lives now.
Final Words
Trace the whole arc and a pattern holds. Each era exploited an existing web mechanism: Urchin read your own logs, the cookie repurposed a state-management tool into a cross-site identifier, the pixel turned an image request into a signal. Each provoked a response, first better tools, then regulation, then browser countermeasures. None of those responses ended tracking. Each one pushed it into a new, less visible form.
There is one terrain this post never touched, and it is where I spend most of my days: mobile. Phones do not run on third-party cookies at all. Inside an app there is a different identity model built on device advertising IDs, and a completely different attribution machinery to work out which ad made you install something. When Apple changed that model with a single prompt, it sent a shock through the industry that made the entire cookie saga look tame by comparison.
Reply and tell me which part of this history you lived through on your own systems. I am collecting the war stories for the mobile post.
Cheers, Hoshank
Up Next
- Mobile attribution and why MMPs exist: how attribution works when there is no cookie at all
- What App Tracking Transparency actually broke, with real match-rate numbers
- The next post in the AdTech Track series