Chrome's Third Party Cookie Deprecation Timeline

Google's third party cookie deprecation plan for Chrome ran for five years and ended without a phase-out: Chrome still lets each user allow or block third-party cookies in settings, and blocks them by default only in Incognito mode. Anthony Chavez, VP of Privacy Sandbox, wrote on 22 April 2025 that Google had "made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies." Any plan that still assumes a Chrome cutoff date is built on an announcement Google withdrew.

The definitions behind the term, which cookie counts as first-party and which as third-party, are covered in first-party vs third-party cookies. This page follows the timeline and what it changes for measuring a website.

When did Google announce each step?

Google announced the plan on 14 January 2020 and posted seven updates over the next five years, each on its own blogs. The table lists every step with the words Google used.

Date	Source	What Google said
14 January 2020	Chromium Blog, Justin Schuh	"we plan to phase out support for third-party cookies in Chrome. Our intention is to do this within two years."
24 June 2021	Google blog, Vinay Goel	Chrome would phase them out "over a three month period, starting in mid-2023 and ending in late 2023."
27 July 2022	Google blog, Anthony Chavez	"we now intend to begin phasing out third-party cookies in Chrome in the second half of 2024."
14 December 2023	Google blog, Anthony Chavez	Tracking Protection testing from 4 January 2024 for 1% of Chrome users globally, with the phase-out "for everyone in the second half of 2024," subject to the UK Competition and Markets Authority.
23 April 2024	Privacy Sandbox site	"we will not complete third-party cookie deprecation during the second half of Q4," with deprecation envisioned "starting early next year."
22 July 2024	Privacy Sandbox site, Anthony Chavez	"Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice."
22 April 2025	Privacy Sandbox site, Anthony Chavez	Chrome keeps its current third-party cookie choice and drops the standalone prompt.
17 October 2025	Privacy Sandbox site, Anthony Chavez	Google retires most Privacy Sandbox APIs, including Topics, Protected Audience and the Attribution Reporting API.

The October 2025 post is the newest statement on Google's Privacy Sandbox site, and the site's banner still reads "Some Privacy Sandbox technologies are being phased out."

Colleagues around a conference table in a serious discussion, standing in for the regulator and industry talks that kept delaying Google's cookie phase-out.

Why did Google keep delaying the phase-out?

Google tied each delay to regulators and to industry readiness, in its own words. The April 2024 update cited "ongoing challenges related to reconciling divergent feedback from the industry, regulators and developers" and said it was "critical that the CMA has sufficient time to review all evidence." The July 2024 post said the transition "requires significant work by many participants and will have an impact on publishers, advertisers, and everyone involved in online advertising."

By April 2025 the reasons had widened. Chavez wrote that "there are divergent perspectives on making changes that could impact the availability of third-party cookies," and that the regulatory picture "has evolved considerably" since Google opened its formal engagement with the CMA and ICO in 2022. The plan never failed on a technical point. It stalled on agreement.

What does Chrome do with third-party cookies today?

Chrome hands the decision to the user, and its help page names one default block: "By default, third-party cookies are blocked in Incognito mode." In regular windows, the setting lives at Settings, then Privacy and security, then Third-party cookies, with two options, Allow third-party cookies and Block third-party cookies.

A user who blocks them can still add sites to an exceptions list, and Chrome's help page says those sites "can use third-party cookies in both regular and Incognito browsing modes." A site allowed from the address bar in a regular window joins that list and can use third-party cookies "for 90 days or until you turn the setting off." For anyone reading Chrome traffic, that means a mix: most regular sessions where third-party cookies work, Incognito sessions where they do not, and users who flipped the setting themselves.

Which Privacy Sandbox APIs did Google retire?

Google's 17 October 2025 update retired ten Privacy Sandbox technologies "in light of their low levels of adoption" and kept three. The retired list includes the Attribution Reporting API, IP Protection, Private Aggregation with Shared Storage, Protected Audience, Related Website Sets, Topics and SelectURL. The ones Google keeps are CHIPS, FedCM and Private State Tokens, and it said it would keep working on an interoperable Attribution standard through the W3C's Private Advertising Technology Working Group.

For analytics teams, the Attribution Reporting API is the one that matters. Google's own page described it as a way to "Understand user journeys from ad click to purchase, without invasive cross-site tracking." That API is now retired, and so is the cookie phase-out it was built alongside. CHIPS survives, so embedded services that need a cookie per top-level site still have partitioned cookies.

Do Safari and Firefox already block third-party cookies?

Yes. Safari blocks third-party cookies by default and Firefox confines each one to the site it was set on, both years before Chrome dropped its plan. John Wilander announced on the WebKit blog on 24 March 2020, for Safari 13.1 on macOS and iOS and iPadOS 13.4, that "Cookies for cross-site resources are now blocked by default across the board."

Mozilla made Total Cookie Protection "a default feature for all Firefox desktop users worldwide" on 14 June 2022. A cookie set by a site or by content embedded in it "is confined to the cookie jar assigned to only that website," so a tracker embedded on ten sites holds ten separate cookies and never sees one visitor across them. So the phase-out Chrome cancelled already happened elsewhere: any visitor on Safari or Firefox reaches your site without a usable cross-site cookie.

An analyst working at a desk with a laptop and handwritten notes, showing the measurement work affected by third-party cookie blocking.

Third-party cookies by browser

Safari

Blocks third-party cookies by default
Cross-site resources are blocked across the board
Embedded content can ask for access through the Storage Access API

Firefox

Total Cookie Protection is on by default
Each cookie stays in the jar of the site that set it
A tracker on ten sites holds ten separate cookies

Chrome

Users allow or block them in settings
Blocked by default only in Incognito mode
An exceptions list lets chosen sites keep them

Safari and Firefox restrict third-party cookies for everyone, while Chrome leaves the choice to the user.

Third-party cookie blocking breaks measurement that follows a visitor across sites, and it leaves analytics that runs on your own domain alone. An analytics script on your site that stores its ID in a cookie on your domain sets a first-party cookie, and none of the third-party rules above apply to it.

Flowsery

–

Revenue-first analytics for your website

Start Your 14-Day Free Trial

Real-time dashboard

Goal tracking

Cookie-free tracking

What does break:

Cross-site identity. Ad networks lose the shared ID they matched between sites, which is what cookie syncing exists to build.
View-through and retargeting data. Anything that needed to recognise a visitor from an ad on another site sees a stranger on Safari, Firefox and Chrome Incognito.
Embedded widgets. Iframes that keep a login or state across sites need CHIPS or the Storage Access API.

First-party analytics has its own limit. Safari caps cookies written by JavaScript at seven days, on your own domain too, and the Safari 7-day cookie limit explains how that inflates new-visitor counts. That rule comes from Safari's tracking prevention, not from the third-party category, and Chrome's reversal does nothing to it.

How does Flowsery track visitors without third-party cookies?

Flowsery's script runs on your own site, and by default it keeps the visitor ID in one first-party cookie on your domain, _fs_vid, and the session ID in the browser's sessionStorage, so third-party cookie blocking does not touch it. Flowsery sets no third-party cookies. Flowsery's script docs say the data-domain attribute "Sets the cookie scope for visitor and session IDs" and defaults to location.hostname, and setting it to your root domain lets subdomains share one visitor ID. Cookieless is an opt-in mode. The setup screen describes it as "Daily-rotating hash, no personal data stored," and data-domain "Has no effect in cookieless mode." In cookieless mode visitor IDs rotate daily, so Flowsery does not link an anonymous visitor across days or devices. In either mode, Flowsery's identify() call links a signed-in user. The privacy-first analytics page lists the rest of that setup, including a tracking script under 10 KB and no collection of IP addresses or browser fingerprints.

Frequently asked questions

Did Chrome ever deprecate third-party cookies?

No. Google announced the plan in January 2020, delayed it three times, proposed user choice in July 2024 and confirmed on 22 April 2025 that Chrome keeps its existing third-party cookie choice. Chrome blocks third-party cookies by default only in Incognito mode.

What is the latest Google announcement on third-party cookies?

The newest post on Google's Privacy Sandbox site is dated 17 October 2025. It retired most Privacy Sandbox APIs, including Topics, Protected Audience and the Attribution Reporting API, and kept CHIPS, FedCM and Private State Tokens. The cookie decision itself dates from 22 April 2025.

Will Chrome show a prompt asking users about third-party cookies?

No. Google's July 2024 post proposed a new choice experience, and the April 2025 post said Chrome "will not be rolling out a new standalone prompt for third-party cookies." Users change the setting under Privacy and security in Chrome's settings.

Does Safari block third-party cookies by default?

Yes. WebKit announced on 24 March 2020 that cookies for cross-site resources are blocked by default across the board, starting with Safari 13.1 and iOS and iPadOS 13.4. Embedded content can ask for access through the Storage Access API, which involves the user.

GA4 sets its cookies on your own domain, so they are first-party and third-party cookie blocking does not remove them. Google's tag settings describe them as first-party cookies whose expiry you can override. Safari's seven-day cap on cookies written by JavaScript still applies to them.

Should I still plan for losing third-party cookies?

Yes, for any measurement that depends on them. Safari and Firefox already block or confine them, and Chrome blocks them in Incognito mode and for every user who switches the setting. Measurement built on first-party data does not depend on them, though Safari's seven-day cap on cookies written by JavaScript still applies to first-party cookies.

How do I turn off third-party cookies in Chrome?

Open Settings, then Privacy and security, then Third-party cookies, and pick Block third-party cookies. You can still add sites to an exceptions list, and those sites can use third-party cookies in both regular and Incognito modes. A site allowed from the address bar in a regular window joins that list and can use third-party cookies for 90 days or until you turn the setting off.

Total Cookie Protection is a Firefox feature that Mozilla made a default for all desktop users on 14 June 2022. It confines each cookie to the cookie jar of the website that set it. A tracker embedded on ten sites therefore holds ten separate cookies and never sees one visitor across them.

Which Privacy Sandbox APIs did Google keep?

Google kept CHIPS, FedCM and Private State Tokens in its 17 October 2025 update. It retired ten others, including Topics, Protected Audience and the Attribution Reporting API, citing their low levels of adoption. Google also said it would keep working on an interoperable Attribution standard through the W3C.

Does Flowsery use third-party cookies?

No. Flowsery's script runs on your own site, and by default it keeps the visitor ID in one first-party cookie on your domain, _fs_vid, and the session ID in sessionStorage. Third-party cookie blocking does not touch either. Cookieless is an opt-in mode that uses a daily-rotating hash and stores no personal data, and Flowsery sets no third-party cookies in either mode.