Cookieless advertising in 2026: what still works without third-party cookies?
Part of Contextual targeting
The short answer
Cookieless advertising reaches people without third-party cookies. Chrome did not remove them, but Safari and Firefox block them by default and Chrome blocks them in Incognito. What still works without them: contextual targeting, site lists and curated deals, publisher first-party audiences, consented advertiser data, partitioned cookies for embedded tools, and first-party measurement.
Key takeaways
- Chrome kept third-party cookies as a user choice, so a cookieless plan is about the browsers and settings that block them, not a Chrome deadline.
- Safari has blocked third-party cookies by default since March 2020, Firefox isolates them per site by default, and Chrome blocks them in Incognito.
- In October 2025 Google said it would retire Topics, Protected Audience, Attribution Reporting and other Privacy Sandbox tools, while keeping CHIPS, FedCM and Private State Tokens.
- Content signals, site lists and publisher first-party data do not rely on third-party cookies, but only content signals avoid personal information by design.
- Removing cookies from a plan does not remove privacy duties, since opt-out signals and Quebec's profiling rules apply to data flows, not to cookies alone.
What does cookieless advertising mean in October 2026?
Definition
- Cookieless advertising
- Targeting, capping and measuring ads without third-party cookies, the cookies set by a domain other than the one in the browser's address bar. It does not mean advertising without any data: first-party cookies, page content and publisher data still exist.
The term grew up around an expected Chrome deadline that never arrived. Chrome did not remove third-party cookies. In April 2025 Google said (opens in a new tab) it would keep its current approach of offering users a choice, and in October 2025 it said it would retire (opens in a new tab) Privacy Sandbox technologies including Topics, Protected Audience and the Attribution Reporting API. No later Google announcement changed this as of October 2026. Our contextual targeting guide covers what that means for planning by content.
Which browsers block third-party cookies by default?
Mozilla's developer documentation on third-party cookies (opens in a new tab) summarizes the defaults of the three major browser engines. The table below follows it, with each browser's own announcement where one exists.
| Browser and mode | Default for third-party cookies | Since or source |
|---|---|---|
| Chrome, standard window | Allowed unless the user blocks them in settings | Google kept user choice in April 2025 |
| Chrome, Incognito window | Blocked by default | Google's April 2025 post says Incognito already blocks them |
| Safari on macOS, iOS and iPadOS | Blocked by default for cross-site resources | Safari 13.1 and iOS and iPadOS 13.4, March 2020 |
| Firefox | Kept in a separate cookie jar per site by Total Cookie Protection | On whenever Enhanced Tracking Protection is on, which is the default |
Safari also limits some first-party storage. WebKit's Intelligent Tracking Prevention 2.1 (opens in a new tab) post of February 2019 says persistent cookies created through document.cookie are capped to a seven day expiry. A measurement setup that writes its own identifier with a script can therefore lose track of returning visitors after a week in Safari.
What still works without third-party cookies?
The useful question is not whether an approach is cookieless, but which signal it uses instead and whether that signal is personal information. The table sorts the options a planner can use without third-party cookies.
| Approach | Signal it uses | Personal information involved | Main limit |
|---|---|---|---|
| Contextual targeting | The text, topic and format of the page or video | None needed to read the content | Infers interest from content, not from who is reading |
| Site lists and curated deals | A reviewed set of domains or channels | None needed to choose the sites | Only as good as the review behind the list |
| Publisher first-party audiences | A publisher's own logged-in or on-site data, packaged by the seller | Yes, held by the publisher | Scale and definitions differ from seller to seller |
| Advertiser first-party data | Customer lists, site visits and logins the brand collected itself | Yes, held by the brand | Consent and notice duties; how lists are matched depends on each platform |
| Partitioned cookies (CHIPS) | A cookie kept per top-level site for an embedded tool | Possibly, but it cannot be shared across sites | Built for one-to-one embeds, not cross-site tracking |
| First-party measurement | The brand's own tags, server events and conversion uploads | It can, so the data flow needs review | Gaps where users decline or browsers limit storage |
IAB Tech Lab's Curated Audiences (opens in a new tab) specification, renamed from Seller Defined Audiences in December 2024, is one standard for the publisher row. Tech Lab says it lets publishers, data management platforms and data providers scale first-party data and does not rely on cookies or mobile IDs. The audience data is still the publisher's, so its consent basis is a question for the seller.
Which Privacy Sandbox tools did Google keep, and which did it retire?
Google's October 17, 2025 update is the record buyers and vendors should check claims against. Any pitch built on the tools in the first column describes a technology Google has retired.
| Status | Technologies | What it means for a plan |
|---|---|---|
| Retired | Topics, Protected Audience, Attribution Reporting API (Chrome and Android), Private Aggregation including Shared Storage, Protected App Signals, Related Website Sets, SelectURL, SDK Runtime, On-Device Personalization, IP Protection | Browser-based interest targeting, on-device remarketing auctions and browser attribution reports are off the table |
| Kept | CHIPS (partitioned cookies) and FedCM (federated sign-in) | Embedded tools and sign-in flows keep a supported path |
| Maintained | Private State Tokens | Google says it will maintain them while it explores other ways to reduce fraud and abuse |
Does removing cookies remove privacy duties?
Privacy laws attach to personal information and to what is done with it, not to one storage technology. Two examples from the United States and Canada show how. These are facts from the regulators, not legal advice.
- California. The California Privacy Protection Agency's FAQ (opens in a new tab) says consumers may ask businesses to stop selling or sharing their personal information for cross-context behavioral advertising, and that businesses must honor opt-out preference signals that meet certain requirements, such as the Global Privacy Control. The W3C Global Privacy Control draft (opens in a new tab) sends that signal as the Sec-GPC header.
- Quebec. The Commission d'accès à l'information explains (opens in a new tab) that organizations collecting personal information with technology able to identify, locate or profile a person must inform the person beforehand, and that such functions cannot be turned on by default.
A plan that replaces a third-party cookie with an email based identifier or a device fingerprint still processes personal information, and may raise more questions, not fewer. A plan that targets by page content and reviewed site lists avoids that layer by design, although tags added for measurement bring it back.
What does a cookieless plan look like for a real brief?
Fictional example
A summer theater festival in Atlantic Canada
An unnamed summer theater festival wants English display ads for residents of Nova Scotia and Newfoundland and Labrador choosing shows and weekend outings close to home. Its previous agency bought retargeting audiences, and the client asks what is left without them.
The new plan has three layers. The core is contextual: arts listings, show reviews and regional food and culture stories, read and approved site by site. The second is a curated deal with regional news and lifestyle publishers that the planner reviewed by hand. The third is the festival's own list of past ticket buyers who opted in to email, which stays in the festival's email tool and is not uploaded to a buying platform.
Measurement moves to the festival's own ticketing pages, and the team tests in Safari how its tags recognize returning visitors, given the seven day cap on script-written cookies. The plan states plainly that it infers interest from content and does not know who any reader is.
How does PlacementGraph plan without third-party cookies?
How can a team check that its plan works without third-party cookies?
Cookieless readiness check for one campaign
- Every targeting layer in the plan names the signal it uses instead of a third-party cookie.
- No layer depends on Topics, Protected Audience or another retired Privacy Sandbox tool.
- The plan was tested in Safari, in Firefox with default settings and in a Chrome Incognito window.
- Each layer that uses personal information has a documented consent or notice basis.
- The team knows how its tags respond to Global Privacy Control signals in states where they apply.
- Measurement does not rely on a script-written cookie that Safari caps at seven days.
- The contextual and site list layers can carry the campaign alone if every audience layer fails.
Frequently asked questions
Will Chrome remove third-party cookies later?
Google has not announced it. Its April 2025 decision kept user choice and dropped the planned standalone prompt, and no later Google announcement changed that as of October 2026. Plan for both cases: people who allow third-party cookies in Chrome and people whose browser or settings block them, which already includes Safari and Firefox by default.
What happened to the Topics API?
Google is retiring it. Its October 17, 2025 update lists Topics, for Chrome and Android, among the Privacy Sandbox technologies it is retiring, together with Protected Audience and the Attribution Reporting API. Chrome's public blink-dev thread (opens in a new tab) shows Topics deprecated in Chrome 144, and a June 11, 2026 follow-up proposed a staged removal from Chrome 150 to Chrome 152, so code that calls it should be treated as legacy. Treat any proposal that relies on Topics as out of date, and ask the vendor which signal now replaces it.
Are email based identifiers a cookieless way to avoid privacy rules?
An identifier built from an email address is derived from personal information, so it carries the duties that come with it. The Office of the Privacy Commissioner of Canada's guidelines on online behavioural advertising (opens in a new tab) treat information used to track and target people online as generally personal information. The same reasoning applies before any customer list is uploaded to a buying platform.
Can a site still use cookies for its own visitors?
Yes. First-party cookies, set by the site in the address bar, are not what the third-party blocking defaults target. Safari does cap persistent cookies written by script at seven days, so a site that needs to recognize returning visitors should test how its tags behave in Safari before relying on them.
Sources
- Next steps for Privacy Sandbox and tracking protections in Chrome (opens in a new tab)Google Privacy Sandbox, April 22, 2025
- Update on plans for Privacy Sandbox technologies (opens in a new tab)Google Privacy Sandbox, October 17, 2025
- Third-party cookies (opens in a new tab)MDN Web Docs, Mozilla
- Full Third-Party Cookie Blocking and More (opens in a new tab)WebKit blog, March 24, 2020
- Intelligent Tracking Prevention 2.1 (opens in a new tab)WebKit blog, February 21, 2019
- Curated Audiences (formerly Seller Defined Audiences) (opens in a new tab)IAB Tech Lab
- Frequently Asked Questions (opens in a new tab)California Privacy Protection Agency
- Global Privacy Control (GPC) (opens in a new tab)W3C Working Draft
- Principaux changements apportés par la Loi 25 (opens in a new tab)Commission d'accès à l'information du Québec
- Guidelines on privacy and online behavioural advertising (opens in a new tab)Office of the Privacy Commissioner of Canada
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.