Cookieless marketing in 2026: the first party data strategy that works whatever Chrome does

The short answer: Chrome kept its cookies, and it changes little

Third party cookies are still switched on by default in Chrome in November 2026. Google announced in January 2020 that it would phase them out within two years,¹ started restricting them for 1% of Chrome users on 4 January 2024,² and then changed course. In July 2024 it said it would not deprecate them and would let people choose instead,³ in April 2025 it dropped even the standalone prompt for that choice and kept the existing settings,⁴ and in October 2025 it retired most of the Privacy Sandbox technologies that were meant to replace them, Topics and Protected Audience among them.⁵

So the cookieless future never arrived on the calendar that marketers were given. It arrived anyway, through three other doors: the browsers that are not Chrome, the consent banner, and the way ad platforms now handle personal data. None of those doors closes again if Google changes its mind a fourth time.

This article is about what that means for an online shop or a SaaS business in 2026. I go through what each browser really does, why consent removes more conversions than any browser does, what first party data is and what it is not, and how to measure without following people around. One invented Leeds tea shop runs through it with numbers, so you can see where the sales go missing and how much of the gap a model fills. The business numbers are made up. The law and the platform rules are not.

What Chrome actually did, and what it does today

The timeline matters because a lot of marketing advice still assumes the 2020 plan.

Read it top to bottom. Six years of announcements end where they started, with one difference: the replacement technologies are gone too. Today a person using Chrome in a normal window accepts third party cookies unless they have changed the setting themselves, and Incognito blocks them by default.⁴ Google kept CHIPS (partitioned cookies) and FedCM, and is pursuing an attribution standard through the W3C rather than its own API.⁵

For a shop owner this has one practical consequence. If a guide tells you to prepare for "the day Chrome switches off cookies", it is out of date. Plan for the conditions that already exist instead, because those are the ones costing you data now.

What Safari and Firefox do instead

Safari's Intelligent Tracking Prevention blocks all third party cookies by default, with no exceptions beyond the Storage Access API.⁶ It also goes after first party storage that scripts write. Cookies created in JavaScript, and other storage a script can write, are deleted after seven days without the visitor interacting with the site. When the visitor arrives through a link decorated with a click id, cookies that JavaScript creates on that landing page expire after 24 hours. Cookies set by a server behind a third party CNAME or IP address are capped at seven days.⁶

Firefox has isolated cookies per site for every desktop user since June 2022: Total Cookie Protection gives each website its own cookie jar, so a tracker cannot join up what a person does across sites.⁷

Here is the part that is easy to miss. Google Ads conversion tracking does not depend on third party cookies at all. The Google tag stores the click information from the click id in first party cookies on your own domain.⁸ That is why Chrome's decision barely touches your conversion numbers, and why Safari's seven day and 24 hour rules touch them a lot: they apply to exactly the kind of cookie your conversion tag writes. A Safari visitor who clicks an ad on Monday, leaves, and buys ten days later from a bookmark may arrive at the checkout with the click id already gone.

Third party cookies still matter for one thing: following a person from site to site to build interest profiles and retargeting audiences. That is precisely the use the law restricts most, which brings us to the bigger door.

Consent removes more than any browser does

In the UK the rule is regulation 6 of the Privacy and Electronic Communications Regulations. Since 5 February 2026 it allows storage on a visitor's device only with consent or under one of the exceptions in Schedule A1.⁹¹⁰ The new statistical exception lets you run first party analytics without consent, but only if the output is aggregate, the data is not shared beyond helping you improve the site, the visitor is told and can object, and the purpose has nothing to do with advertising.¹⁰¹¹ The regulator that enforces it has been the Information Commission since 30 September 2026, formerly the ICO.¹² Advertising cookies, conversion pixels and retargeting were never exempt and still need a yes.¹¹

If you sell into Germany or Austria, your visitors there fall under section 25 of the German TDDDG and section 165(3) of the Austrian TKG 2021, which allow only consent or what is strictly necessary for a service the visitor asked for, with no statistical exception.¹³¹⁴ The detail, the banner that is valid in all three markets and the exact wording of my consent mode rule are in cookies, consent and the ePrivacy mess. I keep this article consistent with that one.

So how many visitors say yes? Commanders Act's 2025 privacy barometer, covering 1,301 banners in May 2025, found that 55.03% of all visitors opted in. Its headline "consent rate" of 80.54% only counts people who made a choice. 32.41% made no choice at all.¹⁵ For your ad account, the 55% is the number that matters: someone who ignores the banner is invisible, just like someone who refuses.

That is a 45% hole before any browser has done anything, and it applies in Chrome just as much as in Safari.

Worked example: where Fernleaf Tea's sales go missing

Fernleaf Tea is an invented shop in Leeds, fernleaftea.example, selling loose leaf tea online. In October it took 1,000 orders that its own database matches to a paid ad click. Two things stand between those orders and what Google Ads reports.

First, the banner. I take Fernleaf's opt in rate as 55%, in line with the barometer above. Second, the browser and the blockers. Of the visitors who consented, some lose the click id before they buy: Safari has deleted the script written cookie, or a content blocker stopped the tag firing. I assume 85% of consenting buyers keep it. Both percentages are assumptions for the example. Your own logs give you the real ones.

The conversions the platform observes are the true conversions multiplied by both survival shares:

$$C_{\text{obs}} = C \times r \times s$$

Here $C_{\text{obs}}$ is the number of conversions the ad platform observes, $C$ is the true number of conversions from the ad clicks, $r$ is the opt in rate (consenting visitors as a share of all visitors) and $s$ is the share of consenting buyers whose click id survives until the purchase. Multiplying the two shares treats them as independent, which is a simplification, and Foundations: probability explains when that is fair.

For Fernleaf: $1{,}000 \times 0.55 = 550$ after the banner, and $550 \times 0.85 \approx 468$ after the browsers. Google Ads shows 468 of 1,000 orders.

Google's conversion modelling fills part of the gap. It estimates unobserved conversions from consenting users' journeys and from historical trends, deliberately errs towards under prediction, and only works once an account passes 700 ad clicks a day over seven days for a country and domain grouping. Google's own illustration: at a 50% consent rate, modelling added 18% to reported conversions.¹⁶ I assume a 20% uplift for Fernleaf: $468 \times 1.20 \approx 561$.

The bars count the same 1,000 orders four ways. The platform is not lying: it reports what it was allowed to see, plus a cautious estimate, and still lands at 56% of the truth. Notice what is not in the chart. Chrome's third party cookies appear nowhere, because neither the banner nor Safari's limits care whether Chrome kept them.

The fix for the gap is not a cleverer pixel. It is your own database as the reference, a monthly reconciliation of platform conversions against database orders, and the correction worked through in the consent article, so that nobody cuts a profitable campaign because its visitors pressed reject more often.

First party data, and what it is not

First party data is what you collect directly in your own channels: orders, accounts, newsletter signups, support conversations, what people do inside your product. Zero party data is the subset people tell you on purpose, such as a quiz answer or a preference they set. Both sit in your own systems and do not depend on anyone else's cookie.

What first party data is not is consent free. Two rules apply to it in the UK, and the equivalents apply in every EU market.

The device rule still applies on your own site. A first party cookie that serves advertising or tracks individuals needs consent under regulation 6, exactly as a third party one does. The regulation is about storing and reading on the device, not about whose domain the cookie belongs to.⁹¹¹

The email rule applies when you use the address for marketing. Regulation 22 of the same regulations allows marketing emails to individuals only with their prior consent, or under the soft opt in: you got the address in the course of a sale or negotiations for a sale, you market only your own similar products, and you offered a simple way to refuse when you collected it and in every message since.¹⁷ So an address taken at checkout can carry reorder reminders for tea, if the opt out was there at checkout. It cannot carry your partner's offers.

The usual justification for all this effort is a study by BCG for Google, published in 2020: brands that used first party data in all four of the advanced activations it looked at reported 2.9 times the revenue uplift of brands that used none.¹⁸ Read it for what it is. It surveyed over 160 brands in ten Asia Pacific countries, it is correlational, and it was commissioned by an advertising company. It shows that mature brands do this, not that doing it makes you mature. I would make the case on the arithmetic above instead: your own database is the only count that no banner and no browser can shrink.

Collecting it: give something worth the data

Nobody hands over an email address for nothing, and nobody should have to. The exchange has to be fair at the moment it happens.

Ask early and specifically. A guide to brewing temperatures for green tea, a sample offer on the first order, a restock alert for a sold out blend: each is a reason to leave an address, and each tells you something about the person. "Subscribe to our newsletter" tells you nothing and gets little. Embedded forms in useful content generally do better than a popup that interrupts the first second of a visit.

Make accounts worth having. Saved addresses, order history, one click reorder and a subscription the customer can pause themselves are reasons to log in. A logged in customer is a known customer, without any cookie beyond the strictly necessary login session.

Use preference centres that visibly change something. If a customer says they only drink black tea, the next newsletter should show black tea. If they ask for one email a month, they should get one. A preference that disappears into a void teaches people not to give you any more.

Use quizzes where a recommendation genuinely helps. A tea finder that asks about caffeine, flavour and brewing time and then recommends three blends collects zero party data and does the customer a favour at the same time. Store the answers against the customer record, with the consent that covers what you will do with them.

For SaaS, the product is the richest source. Which features someone uses, how often, what they never touch: that predicts renewal and churn better than anything a third party ever sold. It belongs in your own analytics and your own database, and the behavioural segments built on it do the work that interest audiences used to do.

Activating it without crossing the consent line

Collecting is the easy half. Using the data in ad platforms is where the rules bite, and the platforms enforce some of them themselves.

Customer Match, Google's feature for uploading hashed customer lists, requires both ad_user_data and ad_personalization to be granted for every EEA user in the upload. Missing or unspecified consent counts as no consent.¹⁹ Google's EU user consent policy also covers UK users and requires legally valid consent, with records, for the use of personal data for ad personalisation.²⁰ In plain terms: upload only the customers who agreed to their data being used for advertising, keep the consent record next to the address, and remove people who withdraw.

Enhanced conversions add a hashed email or phone number to a conversion so Google can match it to a signed in account. The data is hashed with SHA256 before it is sent.²¹ Hashing is not anonymisation, though, and Google treats it accordingly: when ad_user_data is denied, personal data collection for advertising, enhanced conversions included, is switched off.²² The old claim that enhanced conversions need no consent beyond the conversion itself was wrong, and I have taken it out of this article.

Lookalike audiences are built from the same seed lists, so the same consent applies to the seed.

Retargeting follows one rule on every site I build: nobody who declined consent ever enters a retargeting audience, by any route. That includes server side tracking. Moving a tag from the browser to your server changes where the code runs. It does not change whether the person said yes. When I send events server side, the ones from visitors who refused are renamed (a purchase_nc instead of purchase), stripped of every identifier and never mapped to an audience or an optimisation signal. They exist so the totals in the report match the database. The plumbing is in the technical guide to server side tracking.

Consent mode: basic by default, advanced as a decision

Google's consent mode has two shapes. In basic mode, Google's tags do not load until the visitor has answered the banner, and after a refusal nothing at all goes to Google. Modelling then uses a general model. In advanced mode, the tags load with consent denied and send cookieless pings, which lets Google build a model specific to your account.²²

For visitors from Germany, Austria or Ireland, my default is basic mode, and advanced mode only if the shop's own lawyer sets out in writing why those pings are lawful there. The reasoning is in the consent article. For UK visitors the choice is a risk decision for you and your lawyer. The pings are not advertising cookies, but they are sent by advertising code that reads the device, and the statistical exception explicitly excludes anything to do with advertising.¹¹ I run the same basic setup for UK visitors rather than split one site into two regimes, and I accept the slightly weaker modelling that comes with it.

Contextual advertising: the page, not the person

Contextual advertising places an ad by what the page is about rather than who is reading it: a tea advert beside a recipe for chai, a project management tool in a trade magazine for architects. It needs no profile of the reader, so it is untouched by the consent rate and by Safari's cookie rules.

It is not a full replacement for audience targeting, and it was never gone. What changed is the comparison. When behavioural audiences lose 45% of the people they were built on, the gap between a precise audience and a well chosen context is smaller than it was, and on a modest budget the context can win. Test it like anything else, with a holdout.

Measuring without following people

If individual journeys are only half visible, measure in aggregate. Two methods do most of the work.

Marketing mix modelling regresses weekly sales on weekly spend per channel, with seasonality, promotions and prices as controls, and estimates what each channel contributed. It needs no user level data at all, only spend and sales, which you already have in your accounts. It does need history, ideally two years of weekly data, and it answers questions about channels, not about individual ads. Google's Meridian and Meta's Robyn are both open source.²³²⁴ The method in full, with adstock and diminishing returns, is in media mix modelling.

Incrementality testing compares a group that received the marketing with a randomly chosen group that did not. The difference is what the marketing caused, which no attribution report can tell you.

Worked example: Fernleaf's reorder email

In November Fernleaf sends a reorder email to 20,000 past customers, all of them on the soft opt in or with consent. It holds back 2,000 at random, so 18,000 receive the email. Over two weeks, 720 of the 18,000 order (4.0%), and 60 of the 2,000 who got nothing order anyway (3.0%).

The lift is the difference in conversion rates relative to the control:

$$\text{lift} = \frac{p_t - p_c}{p_c}$$

$p_t$ is the conversion rate in the group that received the marketing, $p_c$ the conversion rate in the control group, and the result is a relative increase. That is a percentage change, covered in Foundations: percentages.

For Fernleaf: $(0.040 - 0.030) / 0.030 \approx 0.33$, a 33% lift. In orders, the email caused $(0.040 - 0.030) \times 18{,}000 = 180$ of the 720. The other 540 would have happened anyway, and a last click report would have credited all 720 to the email.

How sure is that 180? The uncertainty of a difference between two rates is its standard error:

$$SE = \sqrt{\frac{p_t (1 - p_t)}{n_t} + \frac{p_c (1 - p_c)}{n_c}}$$

$SE$ is the standard error of the difference, $p_t$ and $p_c$ are the two conversion rates as above, and $n_t$ and $n_c$ are the sizes of the treated and control groups. A 95% confidence interval is roughly the difference plus or minus $1.96 \times SE$, and Foundations: confidence intervals explains why.

For Fernleaf: $\sqrt{0.04 \times 0.96 / 18{,}000 + 0.03 \times 0.97 / 2{,}000} \approx 0.0041$, so the interval is $0.010 \pm 0.008$, from 0.2 to 1.8 percentage points. In orders, somewhere between about 36 and 324 extra. The email worked, but a control of 2,000 cannot say how well. A bigger holdout, or the same test repeated over several sends, narrows it; how much data you actually need works through the sizes.

A customer data platform, or your own database

The original version of this article called a customer data platform essential. For a large retailer with a store estate, an app, three email tools and a call centre, a CDP that joins those sources into one profile can earn its fee. For most shops and SaaS businesses of the size I build for, the order database already is the customer record. It holds every order, every account, every subscription and, if it is built properly, every consent with its timestamp. What it usually lacks is the discipline around it: one table of consents, one list of what is sent where, and a monthly check of platform numbers against it.

On a Solidus shop or a Rails application, that is a few models and a few scheduled jobs, not a new platform. Buy a CDP when you have more sources than you can join by hand, not because a 2024 roadmap said everyone needs one.

The order of work

If Fernleaf came to me, I would do it in this order.

First, measure the gap. Count orders from ad clicks in the database, count what each platform reports, and work out the opt in rate from the consent log. Until you know $r$ and $s$ for your own shop, every other number is a guess.

Second, fix the banner: two equal buttons on the first layer, nothing non essential before a press, a consent log, a footer link to change the choice.

Third, consent mode in the basic shape, and the server side events for the most valuable conversions, with the renaming rule for refusals written into the code and onto one page the next marketer will read.

Fourth, the first party collection points: a reason to leave an address, accounts worth having, a preference centre that does something. Each one is a small piece of work and each one compounds.

Fifth, measurement that does not need individuals: a holdout on every recurring campaign, and a mix model once there are two years of weekly data.

None of that waits for Google. Chrome's cookies may stay for years or go next spring, and the plan above is the same either way. If you would like to see your own gap in numbers, I run a free workshop, and the first two weeks of work are on me. Your raw data stays yours, and the terms for code and models are in the analytics and data science terms.

Sources

Footnotes

1. Justin Schuh, Building a more private web: a path towards making third party cookies obsolete, Chromium Blog, 14 January 2020, https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html

2. Anthony Chavez, The next step toward phasing out third party cookies in Chrome, Google, 14 December 2023, https://blog.google/products/chrome/privacy-sandbox-tracking-protection/

3. Anthony Chavez, A new path for Privacy Sandbox on the web, Privacy Sandbox, 22 July 2024, https://privacysandbox.google.com/blog/privacy-sandbox-update

4. Anthony Chavez, Next steps for Privacy Sandbox and tracking protections in Chrome, Privacy Sandbox, 22 April 2025, https://privacysandbox.google.com/blog/privacy-sandbox-next-steps

5. Anthony Chavez, Update on plans for Privacy Sandbox technologies, Privacy Sandbox, 17 October 2025, https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies

6. WebKit, Tracking Prevention in WebKit (sections on full third party cookie blocking, the 7 day cap on all script writeable storage, link decoration and CNAME and third party IP address cloaking), webkit.org, https://webkit.org/tracking-prevention/

7. Mozilla, Firefox rolls out Total Cookie Protection by default to all users worldwide, The Mozilla Blog, 14 June 2022, https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/

8. Google, How Google Ads tracks website conversions, Google Ads Help, https://support.google.com/google-ads/answer/7521212?hl=en

9. The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6, as substituted on 5 February 2026 by the Data (Use and Access) Act 2025, legislation.gov.uk, https://www.legislation.gov.uk/uksi/2003/2426/regulation/6

10. The Privacy and Electronic Communications (EC Directive) Regulations 2003, Schedule A1 (exceptions to regulation 6), inserted 5 February 2026, legislation.gov.uk, https://www.legislation.gov.uk/uksi/2003/2426/schedule/A1

11. Information Commissioner's Office (now the Information Commission), Guidance on the use of storage and access technologies: What are the exceptions?, 2026, https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/

12. The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, S.I. 2026/1015, regulation 2, bringing sections 118 and 119 (the Information Commission) into force on 30 September 2026, legislation.gov.uk, https://www.legislation.gov.uk/uksi/2026/1015/made

13. Telekommunikation Digitale Dienste Datenschutz Gesetz (TDDDG), § 25 Schutz der Privatsphäre bei Endeinrichtungen, Bundesministerium der Justiz, gesetze im internet, https://www.gesetze-im-internet.de/ttdsg/__25.html

14. Telekommunikationsgesetz 2021 (TKG 2021), § 165 Datenschutz, Allgemeines, Linde Verlag law database, https://linda.lindeverlag.at/Dokument/537514_165/

15. Commanders Act, Privacy Barometer 2025 edition (1,301 banners, 1 to 31 May 2025), Commanders Act, 2025, https://www.commandersact.com/wp-content/uploads/2025/09/Barometre-Privacy-2025-EN-website.pdf

16. Google, Google Ads Help page on consent mode modelling (the page title uses the American spelling), https://support.google.com/google-ads/answer/10548233

17. The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 22 (use of electronic mail for direct marketing purposes), legislation.gov.uk, https://www.legislation.gov.uk/uksi/2003/2426/regulation/22

18. Boston Consulting Group for Google, Responsible marketing with first party data: a USD 200 billion value unlock opportunity in Asia Pacific, BCG, 2020 (survey of over 160 brands in ten Asia Pacific countries, exhibit 5), https://www.thinkwithgoogle.com/_qs/documents/9990/BCG_x_GOOGLE_-_RESPONSIBLE_MARKETING_WITH_FIRST-PARTY_DATA_JIN1QtS.pdf

19. Google, FAQs about the EU user consent policy for Customer Match upload partners, Google Ads Help, https://support.google.com/google-ads/answer/14310715?hl=en-gb

20. Google, EU user consent policy, Google, https://www.google.com/about/company/user-consent-policy/

21. Google, About enhanced conversions, Google Ads Help, https://support.google.com/google-ads/answer/9888656?hl=en

22. Google, Consent mode overview, Google for Developers, Tag Platform, https://developers.google.com/tag-platform/security/concepts/consent-mode

23. Google, Meridian, an open source marketing mix modelling framework, GitHub, https://github.com/google/meridian

24. Meta, Robyn, an open source marketing mix modelling package, GitHub, https://github.com/facebookexperimental/Robyn