Cookieless attribution is what marketing measurement looks like when you can't rely on third-party cookies to track users across websites. Safari has blocked third-party cookies since 2017. Firefox followed. Chrome began its rollout of third-party cookie restrictions in 2024. Combined, this covers the vast majority of web browsing.
The implications for measurement are significant, but they're often misunderstood. "Cookieless" doesn't mean "trackingless." It means the specific mechanism of dropping a cookie on a user's browser when they visit one site and reading it from another site no longer works reliably. First-party cookies, which operate only on the domain that sets them, still work fine.
Understanding what actually broke, and what didn't, is the starting point for building measurement that works in this environment.
As third-party cookies disappear, marketers must rely on privacy-safe measurement signals
What broke when third-party cookies went away
Cross-site user tracking. The core capability that third-party cookies provided was the ability to recognise a user across multiple websites. This powered retargeting (showing ads to people who visited your site on other sites), frequency capping across the open web, and the user-level attribution paths that MTA tools depend on. Without it, stitching together a user's journey across different domains requires alternative identifiers.
Retargeting audience accuracy. Retargeting audiences built on third-party cookies are smaller and less precise than they used to be. On Safari traffic, they barely work at all. This affects measurement indirectly: if your retargeting reach is down, your attribution model will see fewer touchpoints on paths that convert, and the paths will look shorter than they actually are.
Cross-device attribution. Third-party cookies were already unreliable for cross-device attribution (a cookie set on a mobile browser doesn't transfer to a desktop browser). Losing them removes one of the weaker signals that probabilistic cross-device models used.
View-through attribution accuracy. Attribution of conversions to ad impressions, as opposed to clicks, relied heavily on third-party cookies to match the impression to the subsequent conversion. With third-party cookies gone in major browsers, view-through attribution on the open web is essentially broken unless you're using a platform's own logged-in audience data.
What still works
First-party cookies. A cookie set by your own domain on your own site still works normally in all browsers. Your analytics platform (GA4, or your server-side analytics) can still track sessions, page views, and conversions within your own site using first-party cookies. The limitation is that these cookies can't follow users off your domain.
Server-side tracking. When tracking happens on the server rather than the browser, the limitations imposed by browser privacy features don't apply in the same way. Server-side tracking sends conversion data directly from your server to the ad platform's API, bypassing the browser entirely. This is more reliable than pixel-based tracking and isn't affected by ad blockers or cookie restrictions.
Hashed email matching. If you can collect a user's email address (through a purchase, a newsletter sign-up, or a login), you can hash it and match it against the hashed emails in an ad platform's logged-in user base. Google calls this Enhanced Conversions. Meta calls it the Conversions API with hashed customer data. This provides a privacy-preserving match that doesn't rely on cookies at all.
Logged-in audiences. On platforms where users are logged in, like Google, YouTube, Meta, and LinkedIn, the platform can track user behaviour using its own first-party identity. Measurement within these walled gardens is less affected by third-party cookie deprecation than open-web measurement.
Modelled conversions. Both Google and Meta now use machine learning to model conversions that they can't directly observe, filling gaps in their attribution data. This is useful but should be understood as a statistical estimate, not observed fact. GA4's modelled conversions in regions with high cookie rejection rates operate on the same principle.
The three cookieless measurement approaches
Rather than looking for a single replacement for third-party cookie tracking, the practical response is to use three complementary approaches that each work without cookies.
Media mix modeling (MMM) never relied on cookies. It works at the aggregate level, using time-series data on spend and outcomes, so individual-level tracking is irrelevant. MMM is unaffected by cookie deprecation and, in a measurement environment where individual-level tracking is increasingly unreliable, its relative value has increased significantly. What is media mix modeling explains how it works in detail.
Incrementality testing also doesn't require individual-level tracking. A geo holdout experiment measures the aggregate difference in outcomes between regions that saw an ad and regions that didn't. You don't need to track individual users to run this kind of test. Incrementality testing provides the conceptual foundation.
First-party attribution uses the data you actually own: your CRM, your email list, your server-side event data, and hashed email matching through platform APIs. This requires investment in first-party data infrastructure but produces attribution data that is stable and not subject to platform deprecation decisions.
Marketing triangulation combines all three of these approaches, and it's worth understanding as a framework precisely because it doesn't depend on any single tracking mechanism.
Google's approach: modelled conversions and enhanced conversions
GA4 handles missing conversion data in two ways. For users who reject cookies, GA4 uses modelled conversions: machine learning estimates of what conversions would have been observed if tracking had been consented to. These estimates are based on patterns in the data where tracking is available.
Enhanced Conversions supplements click-based attribution with hashed first-party data. When a user converts and provides their email address, GA4 hashes it and sends it to Google, which attempts to match it to a logged-in Google account. If matched, Google can associate the conversion with ad clicks that happened while the user was logged in, even if the cookie trail is broken.
Both of these are meaningful improvements over ignoring the missing data. But neither restores the pre-deprecation state. The limitations of GA4 article covers this more broadly, including how GA4's data-driven attribution is affected by these gaps.
Meta's approach: Conversions API
Meta's Conversions API (CAPI) sends conversion events directly from your server to Meta's API, rather than from the browser. This means ad blockers and cookie restrictions don't intercept the signal.
CAPI can be configured to deduplicate events against browser pixel events for users where both signals are available. For users where the browser pixel is blocked, CAPI provides the only available signal. Meta uses the conversion data from CAPI to train its attribution models and optimise delivery.
The practical recommendation is to run CAPI alongside the browser pixel, not as a replacement for it. The deduplication logic handles the overlap.
Why "cookieless attribution" is partly a misnomer
The term "cookieless attribution" implies that the goal is attribution without any cookies. That's not accurate. The goal is attribution that doesn't depend on third-party cookies, which is a narrower constraint.
First-party cookies, hashed email matching, server-side tracking, and platform-level identity (logged-in users) all work and should be used. The shift is away from cross-site user tracking via third-party cookies specifically, not away from all measurement.
A practical privacy-first marketing measurement approach uses first-party data as its foundation and supplements it with aggregate methods (MMM, incrementality) for channels and touchpoints where individual-level tracking isn't available.
Practical steps toward cookieless measurement
Audit your tracking setup. Identify how much of your current attribution depends on third-party cookies. Look at your pixel configurations, retargeting audience sizes over time, and any attribution tools that use cross-site tracking. This tells you how exposed you are.
Implement server-side tracking. Move conversion events to server-side where possible. This applies to your own website conversions as well as the signals you send to ad platforms via their APIs (Google Enhanced Conversions, Meta CAPI, TikTok Events API).
Invest in first-party data collection. Every email address, account login, and CRM entry is an attribution asset. Build processes to collect consented first-party identifiers at key moments in the customer journey: newsletter sign-up, free trial, purchase, account creation.
Add MMM as a channel-level measurement layer. MMM can measure the contribution of channels that are hard to track at the individual level, including connected TV, podcast advertising, and out-of-home. It's a natural complement to first-party attribution for a world where cross-site tracking doesn't work.
Run incrementality tests for major channels. Don't rely solely on platform-reported attribution for budget decisions. Holdout tests provide causal evidence that doesn't depend on tracking infrastructure at all.