Contents6
For five years, the end of third-party cookies was announced, postponed, then abandoned. Many advertisers concluded that nothing had changed. That is wrong the other way round: retargeting based on third-party cookies still works, but on a shrinking share of the audience, and in Europe only with consent. This article takes stock of what happened and of what still works; it is part of our online advertising guides.
In short
Chrome keeps third-party cookies, at the user’s choice; Safari has blocked them by default since 2020.
In Europe, setting an advertising cookie requires prior consent, third-party or not.
Customer lists (Customer Match) can be used by anyone for exclusions; to target, Google requires account history and a spend threshold.
The cheapest retargeting is often email to contacts who agreed to receive it.
What happened
- March 2020
Safari blocks all third-party cookies by default.
- Summer 2024
Google announces it is exploring a new approach to third-party cookies in Chrome.
- 22 April 2025
Google drops a dedicated prompt; Chrome keeps its current third-party cookie setting.
- 17 October 2025
Google retires most Privacy Sandbox technologies, including Topics and Protected Audience.
Safari’s blocking is documented by the WebKit team: since March 2020, cookies for cross-site resources are blocked by default. On the Chrome side, the announcement of 22 April 2025 says Chrome maintains its current approach to third-party cookie choice and will not roll out a standalone prompt; Incognito mode already blocks them by default. Six months later, Google drew the consequences for the technologies that were meant to replace them:
The 17 October 2025 post announces the retirement, for lack of adoption, of Topics, Protected Audience, Attribution Reporting and other Privacy Sandbox technologies. Captured on 19 October 2026.
According to that post, Google keeps CHIPS, FedCM and Private State Tokens, and is pursuing an interoperable attribution standard with other browsers. Protected Audience, the announced in-browser replacement for ad retargeting, is among the retirements.
What it means for an advertiser
Three things at once:
- Third-party cookie retargeting still works, on Chrome when the user has not blocked them, and not on Safari or in private browsing.
- In Europe, the question was never only technical. France’s data protection authority, the CNIL, recalls that the ePrivacy directive requires prior consent before storing or reading a tracker, unless it is strictly necessary for the service requested. An advertising tracker is not, whether third-party or not.
- Retargeting audiences shrink mechanically: every refusal on the banner, every Safari visitor drops out of the list.
So retargeting does not disappear, it concentrates on the people who said yes. They are also, often, the most interested.
What still works
Visitors who consented
Google, Meta or LinkedIn tags, placed on your site with a banner that works, keep feeding visitor audiences. The challenge becomes the quality of consent: a clear banner, refusing as easy as accepting, and the choice passed on to the tags. The Google side of the setup is described in our offline conversions guide, in its consent section.
Your customer lists
A list of customer or prospect emails, uploaded to the platform, depends on no cookie. Google calls it Customer Match, and its policy sets conditions a small business should know before relying on it:
of history and more than USD 50,000 of total spend are required to target a list
at most: beyond that, a list member who has not been refreshed is no longer eligible
Below those thresholds, any account in good policy standing can still use it for observation and exclusion. Exclusion is often the most profitable use: no longer paying to show an acquisition ad to someone who is already a customer. The data must have been collected by you, your privacy policy must mention the sharing, and the consent required in Europe applies.
Meta and LinkedIn offer comparable list-based audiences; to know which of these platforms reaches your buyers, see our Google Ads or Meta comparison and our article on LinkedIn Ads, whose company-list targeting is another kind of retargeting, without cookies.
Context rather than the person
An ad placed by the topic of the page or the search follows no one. On Search, that is the default: the query states the intent. For a B2B small business, a well-run search campaign is often easier to read than broad retargeting; the minimum budget that gives a signal explains how to start it narrow.
Email to contacts who agreed to it
The cheapest retargeting buys no ad space. On an online soft-toy store we work with, the initial review found 972 consenting addresses that had never been contacted. Before paying to find these people on other sites, the first step was to write to them.
What depended on third-party cookies
Following a visitor from site to site
Broad audiences, with no banner or refusal
Interest targeting inferred from browsing
What runs on your own data
Visitors who consented to your tags
Your customer and prospect lists, to target or exclude
The context of the search or the page
Email to contacts who agreed to it
Measuring without depending on cookies
If retargeting shrinks, measurement must not shrink with it. Two settings avoid steering blind:
- Cookieless audience measurement to know what happens on the site, refusals included. On Palmora Property, a real-estate listings site we work with, installing Matomo without cookies, hence without a consent banner, took about three hours, where the alternative stacked GA4, a consent management platform, Consent Mode and a tag container.
- Sales sent back from the CRM to the platforms, which do not depend on a cookie set weeks earlier: the setup is described in our offline conversions guide.
Watch out
Retargeting easily inflates its results
A retargeting ad reaches people who already know your site, some of whom would have come back without it. Its conversions are not all acquisitions: read them separately, and compare your customer acquisition cost with and without retargeting.
Where to start
- Check the banner.
It collects a real choice and passes it on to the tags.
- Exclude customers.
A customer list excluded from acquisition campaigns, right away.
- Write to consenting contacts.
Before paying to find them elsewhere.
- Send sales back.
To judge retargeting on customers, not on returning visits.
Performance Max mixes retargeting and acquisition in a single campaign: customer exclusions and channel reporting matter all the more there. The landing page for a returning visitor also deserves its own thought, as our article on the landing page shows. And if an agency runs your campaigns, its contract should say who owns the lists and audiences.
The rest of the toolbox does not change: negative keywords kept up to date, generated ads that get reviewed, and an eye on ads arriving in AI answers. To rework the consent, lists and measurement of your campaigns, our digital marketing offer starts with a review of your data.
Frequently asked questions
Are third-party cookies going away in Chrome?
Not according to Google: in April 2025, the company announced that Chrome would keep its current approach, where users choose in their settings, with no new prompt. They remain blocked by default in Incognito mode, and on Safari since 2020. In Europe, their advertising use requires consent anyway.
Is retargeting still possible without third-party cookies?
Yes. Visitors who consented to the platform’s tags, uploaded customer lists and contextual targeting do not depend on third-party cookies. They reach fewer people than broad retargeting, but people who gave you their consent or who are searching for what you sell.
Can you target customers with Customer Match on a small account?
To target a list, Google requires 90 days of history and more than USD 50,000 of total spend on the account, according to its policy. Below that, the list can still be used for observation and exclusion, which is already enough to stop paying for acquisition ads shown to your current customers.
Is consent required for retargeting in Europe?
Yes for any advertising tracker stored on or read from the visitor’s device: the CNIL recalls that the ePrivacy directive requires prior consent, except for trackers strictly necessary for the service. For a customer list, you must also have collected the data yourself and say so in your privacy policy.
Sources
- WebKit, Full Third-Party Cookie Blocking and More, 24 March 2020 (new tab)webkit.org
- Privacy Sandbox, Next steps for Privacy Sandbox and tracking protections in Chrome, 22 April 2025 (new tab)privacysandbox.google.com
- Privacy Sandbox, Update on Plans for Privacy Sandbox Technologies, 17 October 2025 (new tab)privacysandbox.google.com
- CNIL, Cookies et traceurs : que dit la loi ? (new tab)cnil.fr
- Google Ads policy, Customer Match policy (new tab)support.google.com
Privacy Sandbox, Next steps for Privacy Sandbox and tracking protections in Chrome, 22 April 2025
Read on privacysandbox.google.com(new tab)Privacy Sandbox, Update on Plans for Privacy Sandbox Technologies, 17 October 2025
Read on privacysandbox.google.com(new tab)Jim · founder of Brain Plus AI
Also in online advertising
Practical guide8 min
Send your CRM sales back to Google Ads: the guide
In B2B, the sale is signed weeks after the click, by phone or in a meeting. Until Google Ads knows that, it optimises for submitted forms, not for customers: here is how to send it the stages from your CRM.
Choose and price7 min
Google Ads or Meta for a B2B SME: how to choose
Google Ads answers a search, Meta interrupts a news feed. In B2B, that difference decides which platform to start with, and how to judge the test.
Choose and price7 min
LinkedIn Ads: expensive, but who is it worth the price for?
LinkedIn Ads has a reputation for being expensive, because it sells access to a job function, a company and a seniority level. Who that targeting is worth the price for, and how to check before committing a budget.