Chrome Won't Remove Third-Party Cookies: What Changes

For years, one deadline shaped the plans of half the web: Chrome, the most-used browser in the world, was going to stop accepting third-party cookies, the ones that let a person be followed from one site to another. Whole industries - online advertising, traffic measurement, shared login systems - had started rebuilding their tools for a “cookieless” world. On 22 April 2025 Google announced that world isn’t coming: Chrome will keep its current approach to third-party cookies, and won’t even introduce the new choice prompt it had promised the year before. For people browsing, almost nothing changes. For anyone working with analytics, advertising, and sign-on across different sites, the ground they’d been building on has shifted.

The news in brief

The announcement came on the Privacy Sandbox blog, the project Google was using to try to replace third-party cookies. In short: Google is keeping the current third-party cookie choice system in Chrome and will not introduce a new dedicated prompt asking users whether to accept or reject them. People continue to manage this preference where they already can today, in the browser’s privacy and security settings.

In the same post Google adds two things. First: the Privacy Sandbox technologies “may have a different role to play” than originally planned, and an updated roadmap would be shared in the following months. Second: tracking protections in Incognito mode continue, with so-called IP Protection - a feature that hides your network address in that mode - expected in the third quarter of 2025. This is a statement of direction, not a technical spec: the details of the new plan were, at that point, still to be defined.

What third-party cookies are

A cookie is a small file a site asks the browser to save, so it can remember something between one visit and the next: that you’re logged in, what’s in your cart, your preferred language. So far it’s handy and harmless.

The difference lies in who sets the cookie. A first-party cookie belongs to the site you’re visiting, the one in the address bar. A third-party cookie, on the other hand, is set by a different domain: typically an ad network, an analytics tool, a social button, or embedded content such as a video. Because the same provider is present on many different sites, that cookie lets it recognize the same person as they move from site to site. This is the mechanism behind cross-site tracking: building a profile of what someone looks at across the web, mostly for advertising.

It’s worth being honest: third-party cookies don’t only power intrusive ads. They also support legitimate uses, such as measuring whether a campaign led to a sale, avoiding showing the same ad a hundred times, and running some cross-site single sign-on (SSO) systems, often built on top of protocols like OAuth, where you authenticate once and stay recognized across several linked domains. That’s why removing them touched so many balances at once.

How we got here

The story starts in 2019, when Google introduced the Privacy Sandbox with a stated goal: remove third-party cookies from Chrome and replace them with new technologies meant to do the same jobs (targeted advertising, measurement) without following the individual user. The idea looked good on paper, but the target was pushed back several times, because building alternatives acceptable to everyone - advertisers, publishers, regulators - proved hard.

There’s a regulatory front too. In 2022 Google entered a formal engagement with the UK’s competition authority (the CMA) and its data protection authority (the ICO). The worry was that, by removing third-party cookies, Google might end up favoring its own advertising system at the expense of smaller competitors who depend on those cookies. A change sold as protecting privacy risked also becoming a matter of competition.

The real turn came on 22 July 2024: instead of removing third-party cookies, Google announced it would introduce “a new experience in Chrome” letting users make a choice once, and change it whenever they wanted. Nine months later, on 22 April 2025, even that new prompt was shelved: what’s already in the settings stays, with nothing added. In practice, in a little over a year the plan went from “remove the cookies” to “let the user choose” to “don’t change the current experience.”

Why the U-turn matters

For people visiting sites, to repeat, the practical effect is minimal. The weight falls on those who build and run services.

Online advertising. Many operators had invested time and money testing the new Privacy Sandbox interfaces - with names like Topics, Protected Audience, and Attribution Reporting - designed to replace cookies. Now that the deadline pushing that migration is gone, and Google itself says those technologies “may have a different role to play,” those investments sit in limbo. They aren’t wasted, but they no longer have a date that makes them mandatory.

Measurement and analytics. Attributing a conversion by following the user across different domains, for now, remains possible with third-party cookies where the browser accepts them. Anyone who’d already started moving toward methods that don’t depend on those cookies hasn’t worked in vain, but the pressure to finish the switch quickly eases.

Sign-on across different sites. Some shared authentication flows across domains lean on third-party cookies. Removing them would have broken those flows, forcing a rewrite. Chrome’s decision lifts that urgency, at least for now.

It doesn’t mean “back to normal”

It would be a mistake to read the announcement as a carefree return to the past. Some facts remain.

Chrome is the most widespread browser, but it isn’t the only one. Apple’s Safari and Mozilla’s Firefox have blocked third-party cookies by default for a while now. That means a significant share of traffic already runs without them: leaning everything on third-party cookies stays a fragile choice, regardless of what Chrome does.

Chrome’s protections in Incognito mode also remain, with IP Protection expected in the third quarter of 2025, after the browser had already extended its security work to other areas, such as post-quantum encryption for connections. And uncertainty remains over the future of the Privacy Sandbox itself, whose role is being redefined.

Finally, a point browsers don’t touch: privacy law. In Europe, the GDPR and the ePrivacy rules still require the user’s consent for tracking cookies. Whether Chrome accepts them or not, whoever runs a site has to ask for consent where required. Google’s technical decision doesn’t erase legal obligations.

What’s worth doing now

Don’t dismantle what you’ve already done. The general direction of the web still points toward fewer third-party cookies, not more. Work done to reduce dependence on them keeps its value.
Lean on first-party data. Information collected directly from your own site, with the user’s consent, is more solid and less exposed to browser decisions.
Map your dependencies. Know which features - SSO, embedded content, measurement - actually depend on third-party cookies, and have a fallback for each.
Follow the new roadmap. Google promised an update in the following months; it’s worth reading before making final decisions.

In short

Google has decided not to remove third-party cookies from Chrome, and not to introduce even the choice prompt announced in 2024: what’s already in the settings stays. It’s a reversal of years of “cookieless” plans, and it scales back the role of the Privacy Sandbox, whose future will be clarified by a later roadmap. For people browsing, almost nothing changes. For those working with advertising, analytics, and cross-site sign-on, the message is: don’t rush, but don’t kid yourself either - other browsers already block those cookies, and consent rules still stand. The road toward less tracking has just become less steep, not disappeared.