Merging first party data with SEO: the cookie stayed, the case for your own data did not change

The point: the cookie did not die, and you still need your own data

When I first wrote this piece, the received wisdom was that Chrome would soon block third party cookies and every marketer had to prepare for a cookieless future. That did not happen. Google changed course, and Chrome still has third party cookies today.

The advice survives anyway, for a plainer reason. A large share of your visitors already browse with third party cookies blocked, Irish and EU law already require a yes before any advertising tracking, and the only data that is reliably yours is the data people give you directly. Search is the best way I know to meet those people, because a visitor who arrives from a search has told you what they want before they have clicked anything.

So this article is about one thing: how to turn organic search visitors into first party data you can actually use, lawfully, and how to measure content by what it teaches you about your customers rather than by traffic alone. The broader paid media side has its own piece, on first party data strategy for cookieless marketing, and the mechanics of the consent banner are in event tracking and consent mode.

One invented business carries every example. Shandon Tea is a loose leaf tea merchant in Cork, run by Siobhán, selling online at shandontea.example. Every number about it is made up. The law and the Google documentation are real, and footnoted.

What actually happened to third party cookies in Chrome

A third party cookie is one set by a domain other than the site you are on. An ad network's script on a tea shop's page sets one, and the same cookie is read again on a news site, which is how the network knows it is the same browser. That cross site recognition is what retargeting and most cross site measurement were built on.

Here is the timeline, from Google's own announcements.

On 22 July 2024 Google said that instead of deprecating third party cookies, it would introduce a new experience in Chrome that lets people make an informed choice applying across their browsing.¹ On 22 April 2025 it went further: it would maintain its current approach to offering users third party cookie choice in Chrome, and would not roll out a new standalone prompt.² On 17 October 2025 it confirmed that approach again and retired most of the Privacy Sandbox technologies that were meant to replace cookies, including Topics, Protected Audience and the Attribution Reporting API, citing limited expected value and low adoption.³

So, said plainly: Chrome did not deprecate third party cookies, there is no new prompt coming, and most of the replacement technology is gone. The old version of this article said Chrome would soon follow Safari and Firefox. That was the plan in 2024 and it is not true now, so I have corrected it.

The other browsers never waited. Safari has blocked third party cookies by default since March 2020, when WebKit described it as the first mainstream browser to do so.⁴ Firefox confines cookies to the site that created them, which Mozilla calls Total Cookie Protection, and made it a default for all desktop users worldwide in 2022.⁵

And in Ireland the law sits on top of whatever the browser allows. Regulation 5 of the ePrivacy Regulations 2011 (S.I. No. 336 of 2011) says you may store information on a visitor's device, or read what is stored there, only with their consent after clear and comprehensive information, apart from what is needed to carry a transmission and what is strictly necessary for a service the visitor explicitly asked for.⁶ The Data Protection Commission (DPC), which enforces the rule, says that cookies related to advertising are not strictly necessary and must be consented to, and that the rule covers pixel trackers and similar technologies as well as cookies.⁷

Worked example: how many of Shandon's visitors can a retargeting cookie reach?

Siobhán wants to know whether the Chrome news changes anything for her. Two facts decide it: which browser a visitor uses, and whether they said yes to advertising.

Her server logs record the browser of every request, no cookie involved. For October they show 48% Safari, 44% Chrome, 3% Firefox and 5% other browsers. Safari and Firefox block third party cookies by default, so only Chrome and, at most, the other 5% can carry one. That is 49% at the very most, and less in practice, because some Chrome users switch them off.

Her consent banner, counted in aggregate, shows that 60% of visitors accept advertising cookies.

A visitor can only be reached if both things are true. If we treat the two as independent, the share is the product of the two probabilities:

$$P(\text{reach}) = P(\text{browser allows}) \times P(\text{consent})$$

Here $P(\text{reach})$ is the share of visitors a third party retargeting cookie can follow, $P(\text{browser allows})$ is the share whose browser accepts third party cookies, and $P(\text{consent})$ is the share who accepted advertising on the banner. Multiplying probabilities for "both" is covered in Foundations: probability, including when the independence assumption breaks.

Step by step: $0.49 \times 0.60 = 0.294$. At most about 29% of Shandon's visitors are reachable by a third party cookie, and Chrome keeping its cookies did not change that by a single visitor. For seven in 10 visitors, the future Siobhán was told to prepare for arrived years ago.

First party data, in plain words

First party data is information your business collects directly from the people it deals with, on its own site, in its own shop, through its own forms. Orders, email sign ups, answers to a quiz, a request for a sample, a reply to an email.

Second party data is someone else's first party data, shared with you under an agreement. Third party data is collected by a business with no direct relationship to the person, usually across many sites, and sold or used on.

The old version of this article called first party data "permission based" by nature. That is too generous. Collecting data yourself does not make it lawful, and it does not mean the person agreed to everything you might want to do with it. Under Article 5(1)(b) and (c) of the GDPR, data must be collected for specified, explicit and legitimate purposes, and be limited to what is necessary for those purposes.⁸ What makes first party data valuable is not that it is automatically clean, it is that you know where it came from and can make it clean.

Worked example: sorting Shandon's data into the three kinds

Siobhán lists what she holds or uses.

1. Orders in her shop database, with name, address, email and what was bought: first party.
2. Email addresses from the newsletter form: first party.
3. Answers to her tea finder quiz: first party.
4. A list of tea lovers offered by a Kilkenny cookware shop under a joint promotion agreement: second party, and she needs to check exactly what those people agreed to before she touches it.
5. Interest audiences she can target inside an ad platform, built from browsing across other sites: third party.

Only the first three belong to her relationship with the customer. The rest of this article is about growing those three from search.

Search Console sees your organic traffic without a single cookie

Here is the fact that makes Search Engine Optimisation (SEO) the natural partner of first party data. Google Search Console reports your performance in Google Search from Google's side of the click. It does not depend on a tag running in the visitor's browser, so a visitor who rejects your cookies is still counted there.

Google's own help page puts the contrast mildly: Search Console data may differ from tools such as Google Analytics, which track traffic only from users who have JavaScript enabled, and Search Console removes duplicates and visits from robots.⁹ Its Performance report gives four metrics. Clicks are the number of times a user clicked through to your site from Google Search results. Impressions are how often your site appeared. Click through rate (CTR) is clicks divided by impressions. Average position is the average position of the topmost result from your site.¹⁰

Two limits matter. First, privacy filtering: queries that are not issued by more than a few dozen users over two to three months are anonymised and never shown as rows, although their clicks are included in the chart totals unless you filter by query.¹¹ Second, row limits: the interface exports 1,000 rows, while the API and the Looker Studio connector allow up to 50,000 rows per day per site per search type.¹¹

Worked example: Shandon's October, seen from Google's side

Search Console shows Shandon's site appeared 210,000 times in Google Search in October and received 6,300 clicks.

$$CTR = \frac{\text{clicks}}{\text{impressions}}$$

$CTR$ is the click through rate, clicks is the number of clicks from Google Search to the site, and impressions is the number of times the site appeared in results. It is a rate, events over opportunities, explained in Foundations: ratios and rates.

Step by step: $6{,}300 / 210{,}000 = 0.03$, so 3.0%.

Siobhán exports the query rows and adds them up: 5,355 clicks. The gap, $6{,}300 - 5{,}355 = 945$ clicks, about 15%, came from anonymised queries. They are real visitors, she just cannot see what they typed.

In Google Analytics 4 (GA4), the same month shows 3,900 sessions from organic Google search. Her banner shows that about 62% of visitors accept analytics, and $6{,}300 \times 0.62 = 3{,}906$, which is close. That match is partly luck, because a click and a session are not the same thing and are counted by different systems. But it makes the point: GA4 sees the consenting share, Search Console sees everyone who clicked.

Keep the search data longer than Google does

Search Console keeps 16 months of performance data. When you link it to GA4, the Search Console reports in Analytics are limited to the same 16 months, the data appears about 48 hours after collection, and the two reports you get show queries and landing pages, with Landing page, Device and Country as the only Analytics dimensions they combine with.¹² GA4 itself keeps user level data for either two or 14 months on a standard property, a setting that affects explorations and funnel reports, not the standard aggregated reports.¹³

That is grand for this month's questions and poor for a three year view of which topics bring which customers. Search Console offers a bulk data export: a daily export of performance data to BigQuery, Google's data warehouse, with every query except the anonymised ones.¹⁴ Once it runs, the data accumulates in your own warehouse for as long as you choose to keep it. Your shop database already keeps every order for as long as you keep it.

Worked example: what Siobhán keeps, and where

Siobhán switches on the bulk export in November, so from that day her warehouse holds every day's query and page data. She keeps her orders in the shop database as she always has. She sets GA4 retention to 14 months, the longest a standard property allows.¹³

A year later she can ask a question none of the tools answers on its own: which queries led to pages that produced newsletter subscribers who bought within 90 days. The search side comes from the export, the subscriber and order side from her own database. Nothing in that question needs a cookie. If you want the warehouse plumbing in detail, my BigQuery setup for a Rails and Solidus shop walks through it.

The path from a search to a known person

A search visitor is anonymous. To turn them into first party data, the page has to offer something worth leaving an email address for, and the form has to collect that address lawfully. The order of events matters, so here it is as a flow.

Read the flow from the top. The first box is the only one Google sees. Everything from the second box down happens on Siobhán's site and is hers. The decision box is the legal hinge: what the visitor asked for and what they agreed to receive afterwards are two separate things, and the page keeps them separate.

The Irish rules for email you collect from search

Two sets of rules apply. The GDPR governs the personal data itself. The ePrivacy Regulations 2011 govern the marketing emails you send, and the DPC enforces both.

Under regulation 13 of the ePrivacy Regulations, you need the recipient's consent to send them direct marketing by email, with one exception for existing customers. Regulation 13(11) lets you email a customer without consent when you obtained their email address from them in the context of a sale, you only market your own products or services of a kind similar to what they bought, you gave them a clear, easy and free way to object both when you collected the details and in every message since, and the sale was no more than 12 months before the email.⁶¹⁵ There is no wider version for negotiations, and none for charities.

The DPC's guidance draws the line tightly. The exception covers customers only, and an organisation must not send electronic marketing to a prospective customer who does not complete a purchase.¹⁵ The Court of Justice of the EU held in the Inteligo Media case in November 2025 that a sale needs payment, though a free account can count where its cost is paid for indirectly through the price of a paid offer.¹⁶ For consent, the DPC says silence, pre ticked boxes and inactivity are not consent, and marketing consent must not be bundled with consent for anything else.¹⁵

Worked example: Shandon's three sign up points

Siobhán collects email addresses in three places, and each needs its own reasoning.

1. Checkout. A customer buying tea gives an email address to complete the sale. This is a sale, so the existing customer rule can apply to marketing for her own similar products for 12 months, provided the checkout offers a clear way to object there and then, and every email after carries an unsubscribe link.⁶¹⁵
2. The brew chart download on the water guide. A free chart is not a sale, nobody pays for it directly or indirectly, so the existing customer rule does not apply here.¹⁵¹⁶ The page sends the chart the visitor asked for, and asks for newsletter consent with its own unticked box.¹⁵
3. The newsletter box in the footer. Plain consent, worded to say exactly what arrives and how often.

Gated content is a trade, so make it a fair one

Gating means putting something behind a form: you get the resource once you give an email address. It works when the resource is worth more than what you ask for. It fails, commercially and legally, when the visitor is forced to accept marketing to get it.

Article 7(4) of the GDPR says that when you assess whether consent was freely given, you take utmost account of whether a service was made conditional on consent to processing that is not necessary for that service.¹⁷ Sending someone a chart does not need their consent to a newsletter. And the DPC's line on bundling points the same way: marketing consent has to stand on its own.¹⁵

My practice follows from that. The email address needed to send the chart is the price of the chart. The newsletter is a separate question, and saying no to it changes nothing about what the visitor receives. And I never gate the answer to the search query itself. The page answers the question in full, then offers something extra. Someone who searched "what water is best for green tea" and finds a form instead of an answer goes straight back to Google.

Worked example: the water guide's capture rate

The guide "Brewing tea with Cork tap water" answers the question on the page and offers a printable brew chart by email. In October it received 2,400 clicks from Google Search, according to Search Console. 192 visitors requested the chart, and 71 of those also ticked the newsletter box.

$$c = \frac{n_{\text{sign up}}}{n_{\text{clicks}}}$$

$c$ is the capture rate, $n_{\text{sign up}}$ is the number of people who gave an email address, and $n_{\text{clicks}}$ is the number of organic clicks to the page. It is another rate, see Foundations: ratios and rates.

Step by step: $192 / 2{,}400 = 0.08$, so 8% of searchers asked for the chart. Then $71 / 192 = 0.37$, so 37% of those also chose the newsletter. And $71 / 2{,}400 \approx 0.03$, so about 3% of the page's search visitors became newsletter subscribers. Using Search Console clicks as the denominator means the rate does not depend on who accepted cookies.

Interactive tools: ask only what you will use

A quiz, a calculator or a finder tool is useful twice. It helps the visitor decide, and every answer tells you something about what they need. The old version of this article was right about that. What it left out is the limit: Article 5(1)(c) of the GDPR requires personal data to be adequate, relevant and limited to what is necessary for the purpose.⁸ A question you will never act on is a question you should not ask.

Worked example: the Shandon tea finder

Siobhán's first draft of the tea finder asked eight questions: age, gender, Eircode, birthday, caffeine, milk, preferred flavour, and how the visitor brews. I go through them with her, one by one, asking what each changes in the recommendation.

Age, gender and Eircode change nothing. Birthday would be used for a discount email, which is marketing and a separate purpose. So four questions stay: caffeine or not, milk or not, which flavour family (malty, floral, smoky or fresh), and teapot, infuser or bags. Four answers are enough to recommend three teas.

In October 3,800 visitors from search reached the finder, 1,150 completed it, and 230 asked for their results by email with the newsletter box ticked. The completion rate is $1{,}150 / 3{,}800 \approx 0.30$, and the share who completed and subscribed is $230 / 1{,}150 = 0.20$. The 230 records hold an email address, four answers and the page they started on. Every field is used in the next section.

Record where each subscriber came from, and segment by topic

This is the step most sites skip, and it is the one that turns content into customer insight. When someone signs up, store which page the form was on. No cookie is needed: the form simply sends its own page path along with the email address, in a hidden field. Then join subscribers to orders in your own database by email address, and tell people in your privacy notice that you do this.

Grouping subscribers by the topic of the page they joined on shows which questions bring buyers. In GA4, a sign up can also be marked as a key event, which Google defines as an event that measures an action particularly important to the success of your business,¹⁸ but GA4 only sees consenting visitors. The shop database sees every subscriber and every order.

Worked example: Shandon's subscribers by entry topic

Siobhán groups her content into four topics and looks at everyone who subscribed from July to September, and what they spent in their first 90 days. The query runs on her own database:

SELECT s.entry_topic,
       COUNT(DISTINCT s.email) AS subscribers,
       COALESCE(SUM(o.item_total), 0) AS revenue_90d
FROM subscribers s
LEFT JOIN orders o
  ON o.email = s.email
 AND o.completed_at >= s.subscribed_at
 AND o.completed_at < s.subscribed_at + INTERVAL '90 days'
WHERE s.subscribed_at >= '2026-07-01' AND s.subscribed_at < '2026-10-01'
GROUP BY s.entry_topic

It returns four rows. Brewing guides: 310 subscribers, €4,030. The tea finder: 230 subscribers, €5,520. Gift guides: 140 subscribers, €4,620. Caffeine and health questions: 180 subscribers, €1,260.

The revenue per subscriber is a mean:

$$\bar{r} = \frac{1}{n}\sum_{i=1}^{n} r_i$$

$\bar{r}$ is the mean 90 day revenue per subscriber in a topic, $n$ is the number of subscribers in that topic, and $r_i$ is what subscriber $i$ spent in their first 90 days, zero for those who bought nothing. The mean and its weak spots are in Foundations: the mean.

Step by step: brewing guides $4{,}030 / 310 = €13.00$. Tea finder $5{,}520 / 230 = €24.00$. Gift guides $4{,}620 / 140 = €33.00$. Caffeine and health $1{,}260 / 180 = €7.00$.

The gift guide subscribers spend nearly five times as much as the caffeine readers. That is a product insight as much as a marketing one: gift buyers want boxes and bundles, and Siobhán's newsletter for them should look nothing like the one for people asking whether green tea keeps them awake.

Measure content by what each click is worth

The old article said to measure content by its contribution to audience intelligence rather than sessions or bounce rates. I agree, but a principle you cannot put a number on tends to lose to a traffic chart in a meeting. So here is the number I use: the expected value of one organic click to a topic.

$$E[v] = c \times \bar{r}$$

$E[v]$ is the expected value of one organic click, $c$ is the probability that a click becomes a subscriber (the capture rate from earlier), and $\bar{r}$ is the mean 90 day revenue per subscriber. It is an expected value, a probability times a payoff, covered in Foundations: expected value, and the capture rate is a rate from Foundations: ratios and rates.

It is deliberately conservative. It ignores visitors who buy without subscribing, and it uses revenue where margin would be more honest. Use margin if you have it.

Worked example: which Shandon topics deserve the next article

From July to September, Search Console shows organic clicks per topic: brewing guides 7,750, tea finder 4,600, gift guides 2,800, caffeine and health 12,000.

Capture rates, subscribers divided by clicks: brewing $310 / 7{,}750 = 0.04$, finder $230 / 4{,}600 = 0.05$, gifts $140 / 2{,}800 = 0.05$, caffeine $180 / 12{,}000 = 0.015$.

Value per click, capture rate times revenue per subscriber: brewing $0.04 \times 13 = €0.52$, finder $0.05 \times 24 = €1.20$, gifts $0.05 \times 33 = €1.65$, caffeine $0.015 \times 7 = €0.105$.

Multiplied by 1,000 to make them readable:

The horizontal axis shows the four content topics. The vertical axis is the expected 90 day revenue, in euro, from 1,000 organic clicks to that topic. The caffeine pages bring the most traffic, 12,000 clicks, and the least value, €105 per 1,000. The gift guides bring the fewest clicks and the most value, €1,650 per 1,000, about 16 times as much. A traffic report would tell Siobhán to write more about caffeine. Her own data tells her to write the next gift guide.

That does not mean deleting the caffeine pages. They answer real questions, they earn links, and they bring people to the site who may buy later. It means the next hour of writing goes where a click is worth most.

What I would build, in order

If Siobhán came to me, I would do the work in this order.

1. Search Console verified and linked to GA4, with the bulk export to BigQuery switched on from day one, because it only collects from the day it starts.¹²¹⁴
2. Every sign up form sends its page path, and every subscriber record carries the consent wording they saw and the date.
3. Gated offers that never hide the answer, with the newsletter as a separate unticked box.¹⁵¹⁷
4. Interactive tools stripped down to the questions that change the result.⁸
5. A monthly report from the shop database: subscribers and 90 day revenue by entry topic, and the value of 1,000 clicks per topic.
6. Only then, the paid side, using the same first party data. That is a separate project, covered in the first party data strategy for cookieless marketing.

None of it depends on what Chrome does with cookies next year. In the shops I have worked on, that is the real argument for first party data: not that the cookie is dying, but that this data is yours, measured from your side of the counter, and it keeps working whatever the browsers decide.

Sources

Footnotes

1. Anthony Chavez, A new path for Privacy Sandbox on the web, Google Privacy Sandbox, 22 July 2024, https://privacysandbox.google.com/blog/privacy-sandbox-update

2. Anthony Chavez, Next steps for Privacy Sandbox and tracking protections in Chrome, Google Privacy Sandbox, 22 April 2025, https://privacysandbox.google.com/blog/privacy-sandbox-next-steps

3. Anthony Chavez, Update on plans for Privacy Sandbox technologies, Google Privacy Sandbox, 17 October 2025, https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies

4. John Wilander, Full Third Party Cookie Blocking and More, WebKit, 24 March 2020, https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/

5. Mozilla, Firefox rolls out Total Cookie Protection by default to more users worldwide, The Mozilla Blog, 14 June 2022, https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/

6. Government of Ireland, European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, regulations 5 and 13, Irish Statute Book, 2011, https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print

7. Data Protection Commission, Guidance note on cookies and other tracking technologies, DPC, April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf

8. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 5(1)(b) and (c), EUR-Lex, 2016, https://eur-lex.europa.eu/eli/reg/2016/679/oj

9. Google, About Search Console data, Search Console Help, https://support.google.com/webmasters/answer/96568?hl=en

10. Google, Performance report (Search results): overview and basic setup, Search Console Help, https://support.google.com/webmasters/answer/7576553?hl=en

11. Daniel Waisberg, A deep dive into Search Console performance data filtering and limits, Google Search Central Blog, 19 October 2022, https://developers.google.com/search/blog/2022/10/performance-data-deep-dive

12. Google, Connect Search Console to Google Analytics, Analytics Help, https://support.google.com/analytics/answer/10737381?hl=en

13. Google, Data retention, Analytics Help, https://support.google.com/analytics/answer/7667196?hl=en

14. Google, About bulk data export of Search Console data to BigQuery, Search Console Help, https://support.google.com/webmasters/answer/12918484?hl=en

15. Data Protection Commission, FAQ on Consent for Electronic Direct Marketing, dataprotection.ie, April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2026-05/FAQ_Consent_Electronic_Direct_Marketing_April2020.pdf

16. Court of Justice of the European Union, Judgment of 13 November 2025, C-654/23, Inteligo Media, paragraphs 48, 53 to 62 and 64 to 69 and operative part, EUR-Lex, 2025, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62023CJ0654

17. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 7(4), Conditions for consent, EUR-Lex, 2016, https://eur-lex.europa.eu/eli/reg/2016/679/oj

18. Google, About key events, Analytics Help, https://support.google.com/analytics/answer/9267568?hl=en