"Cookieless" has become one of marketing's most overused buzzwords, deployed by vendors to create urgency and by consultants to justify projects. The reality is more specific and, in some ways, more significant than the general alarm suggests.
Third-party cookies are not the only thing changing. Some of what's being lost has already been gone for years. And the most important structural shift in marketing measurement was underway long before Chrome announced deprecation.
Privacy-first measurement relies on aggregate signals, not individual tracking
What Is Actually Changing
Several distinct privacy changes are affecting measurement simultaneously, and it's worth separating them:
Third-party cookie deprecation in Chrome: Google deprecated third-party cookies in Chrome beginning in early 2024, after multiple delays. Chrome represents roughly 65% of browser market share globally. This affects cross-site tracking, retargeting audience building, and third-party attribution measurement for users on Chrome.
Apple's App Tracking Transparency (ATT): Launched with iOS 14.5 in April 2021, ATT requires apps to ask user permission before tracking across apps and websites. Opt-in rates have averaged around 25–30% globally, meaning roughly 70–75% of iOS users are not consented to cross-app tracking. This has already substantially reduced the signal available to Facebook and other platforms for iOS user targeting and attribution.
Safari's Intelligent Tracking Prevention (ITP): Safari has been aggressively blocking third-party cookies and limiting tracking capabilities since 2017. Users on Safari, roughly 19% of global web traffic, higher on mobile, have effectively been in a cookieless environment for years. This is not new.
Ad blocker adoption: Estimated at 30–42% of desktop users in many markets. Combined with private browsing modes, a significant portion of web traffic has never been fully trackable.
The cumulative effect: a large and growing share of user journeys are already invisible to conventional tracking. Not because cookies are going away, because they already have, for a substantial portion of your audience.
What This Breaks
The specific things that third-party cookie loss and ATT directly damage:
Cross-site retargeting: Building audiences based on user behavior on third-party sites (visiting your website, then seeing your ad on another site) depends on third-party cookies or device identifiers that require consent. This capability is substantially degraded or gone for many users.
Deterministic cross-device attribution: Knowing that the same person who clicked an ad on their phone bought later on their laptop requires matching an identifier across devices. Without third-party cookies or consent-based tracking, this matching relies on probabilistic methods or logged-in states that don't cover all users.
Last-click attribution coverage: If 30–40% of your conversions are coming from users without active third-party tracking, your last-click attribution data has gaps. The conversions that do appear may not be representative of your full customer base.
Lookalike audience modeling: Meta's and Google's lookalike audiences are less effective for iOS users where signal is limited by ATT. The models have less data to work with.
What This Does Not Break
First-party data: You can still track your own customers on your own domain with your own cookies. First-party cookies are not affected by the changes above. If someone visits your website, you can track their behavior across sessions on your domain, as long as you have appropriate consent under relevant privacy regulations (GDPR, CCPA, etc.).
Server-side event tracking: By sending conversion events directly from your server to ad platforms (via the Facebook Conversions API, Google Ads Enhanced Conversions, TikTok Events API), you bypass browser-level tracking restrictions. The signal is sent server-to-server rather than through the browser, so cookie blocking and ad blockers don't interfere. Server-side tracking recovers a significant portion of the signal lost to browser restrictions.
Media mix modeling: MMM never relied on user-level tracking. It uses aggregate spend and outcome data. Privacy changes have zero direct impact on MMM's methodology. This is one reason why interest in MMM has grown so substantially since 2021.
Incrementality testing: Geo experiments and holdout tests measure business outcomes in your own backend data, orders and revenue, not platform-attributed conversions. They're structurally independent of the tracking layer.
Logged-in matching: When users are logged in to a platform (Facebook, Google, TikTok) and make a purchase from a site that has the platform's pixel, that conversion can often be matched back to the user through their logged-in identity rather than through third-party cookies. This is why Meta's Conversions API and Google's Enhanced Conversions have retained more signal than many expected.
What "Consent Mode" Actually Means
Google's Consent Mode v2 is widely deployed as a response to GDPR and similar regulations. The concept: when a user doesn't consent to tracking, instead of dropping the event entirely, Google uses behavioral modeling to estimate what conversions probably occurred.
This sounds useful. The caveats:
The modeling is done by Google, using Google's data, with Google's methodology. The estimates are not transparent. You cannot audit how many modeled conversions have been added to your account or verify the model's accuracy. For many accounts in high-regulation markets, modeled conversions represent a substantial fraction of total reported conversions.
Use Consent Mode as better than nothing, it does recover some signal. But treat modeled conversion data with appropriate skepticism, and don't use it as primary evidence for major budget decisions without cross-referencing against backend data.
The Deeper Shift That Matters More
The most important structural problem for marketing measurement was never really about cookies. It was about walled gardens.
Even when third-party cookies were fully functional across all browsers and platforms, you still couldn't see a Facebook user's Facebook journey in your Google Analytics. Google couldn't see what happened on TikTok before a user clicked their Search ad. The customer journey across channels was always fragmented, each platform saw only its piece of it.
Cookie deprecation is accelerating the adoption of methods (MMM, incrementality testing) that were always better suited to a multi-channel world than attribution-based approaches. It's forcing the industry to invest in measurement infrastructure, server-side tracking, first-party data, experimentation, that should have been built years ago.
This is, in a strange way, a useful forcing function. The measurement approaches that survive the privacy shift are also the ones that were always more rigorous.
Practical Recommendations
Invest in server-side tracking now if you haven't. Implement the Facebook Conversions API, Google Ads Enhanced Conversions, and equivalent tools for other platforms. This is table stakes in the current environment. Most brands implementing server-side tracking recover 20–40% of previously untracked conversions.
Build a first-party data strategy. Collect emails, phone numbers, and logged-in identities with consent. First-party data is the most resilient form of customer information in a privacy-constrained environment.
Run incrementality tests to calibrate your attribution data. If your tracking is degraded, your attribution numbers are less reliable than they used to be. Incrementality tests give you ground-truth causal data that doesn't depend on tracking completeness.
Start or accelerate MMM if your spend justifies it. Brands spending over $500k per year on advertising should be looking seriously at MMM as a primary strategic measurement tool, not a nice-to-have.