In short: A company that wants to advertise and measure steadily should not rely on third-party cookies, even though Chrome is not removing them as of September 2026. Some browsers block them, and consent rules and people who decline tracking reduce the signal. The reliable foundation is data you collect yourself, with permission: enquiries, orders and the email addresses of customers who signed up. The change does not call for more data. It calls for better organised data whose origin you know.
What are third-party cookies, really?
A cookie is a small file that a website stores in a visitor’s browser. When the file is stored by the site the person is actually visiting, it is a first-party cookie. It remembers things such as the contents of a basket or the chosen language.
A third-party cookie is stored by another company whose code is embedded in the site: an ad network, a social network or a measurement service. Because the same code sits on many sites, that company can recognise the browser as the person moves from site to site. For years, much of digital advertising worked this way: it built a picture of a person’s interests and showed ads based on it, often without the person knowing.
Is Chrome getting rid of third-party cookies?
No, not as of September 2026. In July 2024 Google dropped its plan to remove third-party cookies, and in 2025 it abandoned the remaining steps in that direction:
- 22 April 2025: Google announced it would not roll out a new standalone prompt asking people whether to allow third-party cookies. The choice stays in Chrome’s privacy and security settings.
- 17 October 2025: Google announced it was retiring most of the Privacy Sandbox technologies meant to replace cookies, including Topics, Protected Audience and Attribution Reporting. It is keeping its current approach of letting users choose in Chrome.
That does not mean third-party cookies work everywhere. Safari has blocked them by default since March 2020. People using Chrome can switch them off themselves. And in the EU, cookies that are not needed for the site to work usually require consent, so when a visitor declines they should not be set at all.
What does this mean for your business? Our recommendation is not to wait for new deadlines: the direction has not reversed, it has only slowed down. The less your marketing depends on someone else’s tracking, the more stable it is.
| Change | Date | Status as of September 2026 |
|---|---|---|
| No standalone cookie choice prompt in Chrome | 22 April 2025 | Choice stays in Chrome settings |
| Most Privacy Sandbox technologies retired | 17 October 2025 | Topics, Protected Audience and others wound down |
| Consent Mode controls Google Ads cookies in GA4 | 15 June 2026 | In effect |
| Cookie rules moved into GDPR (Digital Omnibus) | Proposed 19 November 2025 | Still being negotiated, current rules apply |
What changed in Google Analytics and in consent?
GA4 and Consent Mode from 15 June 2026
From 15 June 2026, Consent Mode becomes the single control over whether GA4 collects Google Ads cookies and identifiers, in practice through its advertising consent signals, mainly ad_storage. The Google Signals setting now only affects reporting in GA4. Google has also announced further changes to ads personalisation and IP address handling later in 2026, without exact dates. In practice, your consent banner and a correct Consent Mode v2 setup become the one place the advertising signal depends on. Our Consent Mode and GA4 checklist walks through the setup step by step.
Digital Omnibus: a proposal, not a law
On 19 November 2025, the European Commission proposed a set of changes known as the Digital Omnibus. Under the proposal, cookie rules would move into the GDPR, some analytics would no longer need consent, sites could not ask again for six months after a refusal, and browser privacy signals would have to be respected. This is still being negotiated. As of September 2026 the current rules apply in full, so do not change your banner based on the proposal.
ScaleLab tip: Open your site in a private window, decline all cookies and use the browser’s developer tools to check whether advertising tags still set cookies. If they do, the banner is decoration.
Why consent is part of the customer relationship
The cookie banner is often treated as a formality. In fact it is your first conversation with a visitor about what you do with their data. Clear wording, a real choice and equally visible buttons to accept and decline show that the company respects that choice.
Consent also applies to your own data. An email address given for one purpose is, as a rule, not permission for any kind of message. When you upload a customer list to an advertising platform to show those customers ads, you also need a legal basis. Which steps require consent, and how to request it, is best assessed with a lawyer, because it depends on the case. The practical rule is simple: collect only the data you will use, and say clearly what it is for.
What is your own data, and how do you collect it?
First-party data is what a company collects itself, on its own site and in its direct dealings with customers: an email address at sign-up, a phone number in an enquiry, order history, a survey answer. Most of it does not depend on whether the browser keeps cookies, because it comes from a real relationship between you and the customer.
- An email list of people who signed up themselves: everyone on it chose to hear from you. The channel depends far less on a social network’s algorithm or on cost per click. To grow the list, offer something useful in return: a guide, a checklist, a notice about new products or a discount on a first order. A list that never hears from you, or only receives promotions, loses its value.
- Enquiries and orders in one place: when data is scattered between the inbox, a spreadsheet and a salesperson’s memory, the company cannot use it. A customer system where every enquiry has a source, a date and an outcome shows which channel brings customers without cookies on other sites.
- Asking customers directly: a short survey after an order, or “How did you hear about us?” in the enquiry form, gives you information no cookie collects. Individual answers are not precise, but taken together they show the direction.
How do you advertise without behavioural targeting?
When the platform knows less about the person, advertising can rely on other signals.
Contextual advertising
Instead of targeting people who looked at something earlier, the ad appears next to content related to your product. An article about bathroom renovation is a suitable place for a tile advert. Intent shows in what the person is reading right now, not in their history.
Search advertising
Someone searching for a specific service is telling you what they want. The main signal is the search itself, not third-party cookies, so this channel is less affected.
Your own audiences
Customers who have already ordered can be excluded from campaigns aimed at new customers, or shown a different message, provided you have a legal basis to use their data that way.
How do you measure in a way you can trust?
1. Get the tracking on your site in order
Define what counts as an enquiry or an order, check that each event is recorded once and that tracking respects the visitor’s choice.
2. Consider sending events from the server
With this approach, information about an order or enquiry is passed directly from the company’s system to the platforms, not only from code in the browser. It takes more technical work, and consent and data rules still apply.
3. Compare the platforms with real sales
Compare what the advertising platforms report with the actual orders and enquiries in your own system. The gap between the two numbers is useful information in itself.
ScaleLab tip: Check your site and tracking before money goes into advertising. If you would like an outside view, our free audit starts exactly there.
Where should you start?
- List the third-party cookies and code on your site and note what each one is for.
- Check that the banner offers a real choice and that the code actually waits for that choice.
- Bring enquiries and orders together in one place, with a source and an outcome for each.
- Give visitors a reason to sign up for email and plan what they will receive afterwards.
- Compare the advertising report with actual sales and decide which campaigns continue.
Third-party cookies are convenient because they let a company advertise without knowing its customers. The less they work, the greater the advantage for the company that does know its customers. So when you build up email marketing and automation, our recommendation is to start from a list of people who signed up themselves and a clear goal for every message.
Frequently asked questions
Is Google removing third-party cookies from Chrome?
Not as of September 2026. In July 2024 Google dropped its plan to remove them, in April 2025 it said the choice stays in Chrome’s settings, and in October 2025 it retired most Privacy Sandbox technologies. Safari, however, blocks them by default, and Chrome users can switch them off.
Do I need cookie consent if I only use GA4?
In the EU, cookies that are not needed for the site to work usually require consent, and that includes analytics. The Digital Omnibus proposal would exempt some analytics from consent, but it is still being negotiated and the current rules apply in full.
What did Google change in GA4 on 15 June 2026?
From that date, Consent Mode is the single control over whether GA4 collects Google Ads cookies and identifiers, in practice through its advertising consent signals, mainly ad_storage. Google Signals only affects reporting in GA4.
Which channel is least affected by cookie restrictions?
Search advertising, because the main signal is the search itself. Email to people who signed up themselves does not depend on cookies on other sites either.
Sources
- Google Privacy Sandbox: Next steps for Privacy Sandbox and tracking protections in Chrome (22 April 2025)
- Google Privacy Sandbox: Update on plans for Privacy Sandbox technologies (17 October 2025)
- WebKit: Full Third-Party Cookie Blocking and More (24 March 2020)
- Google Analytics Help: Changes to data controls in Google Analytics
- iubenda: EU Digital Omnibus, proposed GDPR changes explained