Third-party cookies have not disappeared in 2026. Chrome retained its existing approach to cookie choice rather than introducing a new standalone prompt. Safari and Brave restrict third-party cookies by default, while Firefox combines tracker blocking with cookie partitioning. Your website needs to work across these different conditions. Google's Chrome announcement, WebKit tracking prevention, Firefox protection, Brave Shields
For a website owner, the useful question is which journeys depend on cross-site state: sign-in, embedded tools, advertising audiences or attribution. This guide explains the browser differences and provides a test plan. Browser restrictions and a visitor's consent choices are separate controls, so test both.
For definitions and practical examples, see first-party vs third-party cookies.
What happened to Chrome's third-party cookie phase-out?
Two announcements are often combined into an inaccurate claim that all third-party cookies or all Privacy Sandbox APIs stopped working on one date.
- 22 April 2025: Google said Chrome would maintain its existing approach to third-party cookie choice and would not introduce the proposed standalone prompt. Users could continue choosing through settings. Google's April announcement
- 17 October 2025: Google announced plans to retire technologies including Topics, Protected Audience, Attribution Reporting and Shared Storage. It said phase-out would follow Chrome and Android processes. This was a retirement announcement, not evidence that every API was disabled that day. Google's October announcement
For an integration that uses one of those APIs, check its specific release status and vendor migration guidance. For example, the Chrome 152 release notes list removal of Private Aggregation. Do not use the October announcement date as a universal removal date.
Google's October update also committed to continuing support for CHIPS and FedCM and maintaining Private State Tokens. CHIPS supports partitioned cookies; FedCM supports federated sign-in; Private State Tokens address fraud and abuse. They serve different purposes and do not collectively replace every advertising workflow. Google's technology plans
Which browsers block third-party cookies?
Use this comparison as a starting point for testing, not a guarantee about every installation. Record browser version, operating system, browsing mode, settings, extensions and site exceptions. Enterprise policies can also change behaviour.
| Browser | Relevant default or protection | What to include in your test |
|---|---|---|
| Chrome | Keeps third-party cookie choice in settings; Incognito blocks third-party cookies by default | Regular browsing with cookies allowed, then blocked; Incognito separately |
| Safari | ITP blocks third-party cookies, with controlled access mechanisms such as the Storage Access API | Embedded sign-in, checkout and storage over return visits |
| Firefox | Blocks cross-site tracking cookies and isolates other third-party cookies by top-level site | Whether an embed incorrectly expects the same cookie across different websites |
| Edge | Balanced tracking prevention is the default; it restricts selected trackers' storage or network access | Balanced and Strict settings, including a fresh profile without prior engagement |
| Brave | Shields blocks third-party cookies and tracking resources by default | Essential embeds and the effect of site-specific Shields settings |
Sources: Chrome cookie settings, WebKit, Mozilla, Microsoft Edge, Brave.
Blocking and partitioning are different. A blocked cookie cannot be used in that context. A partitioned cookie can retain state within a particular top-level site, but does not automatically provide the same identity when the embed appears elsewhere. Firefox therefore should not be described as simply blocking all cookies from third parties. Mozilla's explanation
Edge also needs its own test results. Sharing Chromium with Chrome does not make their tracking protection identical. Edge's Balanced setting uses tracker classification and compatibility mitigations; Strict applies broader restrictions. Microsoft's implementation documentation
Does blocking third-party cookies mean no tracking?
No. A browser can block third-party cookies while still accepting first-party cookies, sending network requests and supporting signed-in accounts. An analytics implementation may also send events without a persistent cookie.
For example, a cookie associated with shop.example can be first-party while the visitor browses that site. A request sent to an analytics vendor is still a separate data flow. Cookie ownership alone does not tell you what information leaves the website or how its recipient uses it.
For planning, replace the vague label “cookieless traffic” with specific observations:
- Was a cookie created, read, blocked or partitioned?
- Did a network request leave the browser?
- Did it contain an identifier or other personal data?
- Did a server forward the event to another destination?
- Which consent or opt-out choice applied at that moment?
Do not estimate the affected share of your visitors by adding global browser market percentages. Your audience mix, consent choices, extensions and browser settings determine your exposure. Analytics reports themselves may underrepresent visitors whose measurement requests are blocked.
Does server-side tracking bypass Safari ITP?
A server-set cookie is not a guaranteed bypass. WebKit documents deletion of script-writeable storage after seven days of Safari use without user interaction with the site. It also limits cookies set in HTTP responses when it detects third-party CNAME or IP address cloaking. WebKit's current tracking prevention documentation, WebKit's explanation of IP cloaking protection
That means a first-party-looking collection subdomain, or a cookie marked HttpOnly, does not establish that an identifier will last as long as configured. Actual handling depends on the architecture and browser protections.
Server-side collection can give an organisation control over event routing and fields sent to vendors. It still needs a defined purpose, appropriate privacy controls and testing of outgoing requests. Our server-side tracking guide explains the architecture and its limits.
Can CHIPS fix embedded tools without cross-site tracking?
For an embed that only needs to remember state within each website, CHIPS may fit the requirement. It lets a developer opt into partitioned cookies using the Partitioned attribute. A support widget embedded on two unrelated sites would have separate cookie state for each top-level site. CHIPS documentation
That separation is useful for the widget, but does not restore an unrestricted identity across both sites. A cross-site sign-in requirement is a different design problem. Confirm browser support, security attributes and fallback behaviour before changing a vendor integration. Partitioning also does not decide whether the storage or processing needs consent.
Do you still need cookie consent and opt-out controls?
Browser settings do not replace your website's legal assessment or choice handling.
In the EU, Article 5(3) of the ePrivacy Directive generally requires consent for storing information on, or accessing information from, a user's device. It includes exceptions for transmission and storage or access strictly necessary for a service explicitly requested by the user. Its application depends on the purpose and national rules, not merely whether a cookie is first-party. GDPR requirements can apply separately to personal data processing. ePrivacy Directive, Article 5(3)
For a business covered by California's CCPA, assess whether a disclosure is a sale or sharing, including applicable exclusions and recipient restrictions. A server transfer can fall within those definitions; moving a request out of the browser does not settle its classification. Equally, not every server transfer is automatically sharing. California Civil Code section 1798.140
Use the GDPR cookie consent guide and CCPA sale versus sharing guide for those separate decisions. Where applicable, test Global Privacy Control handling as well as the on-screen banner.
How to test your website across browser restrictions
The following is a suggested test plan, not a report of tests performed on your website.
1. Inventory the journeys that need cookies
Start with sign-in, checkout, embedded video or chat, consent preferences, analytics and advertising. Record the vendor, request destination, cookie or storage entry, purpose and expected behaviour when unavailable. Include server destinations that browser developer tools cannot show.
2. Establish a clean baseline
Use a dedicated test profile with recorded settings. Remove previous site permissions and saved choices for the test. Keep an existing-profile test separately, because returning visitors can have consent records and browser exceptions a clean profile lacks.
For Chrome, compare the same journey with third-party cookies allowed and blocked. Test Incognito separately, because its session behaviour also differs. Then run the relevant journeys in the other browsers from the comparison table.
3. Cross browser conditions with user choices
| Test case | Evidence to inspect | Question to resolve |
|---|---|---|
| First visit, no banner action | Storage, loaded scripts and request payloads | Are defaults applied before optional processing starts? |
| Reject optional purposes | Browser requests and server forwarding | Does the implementation honour the rejection? |
| Accept a specific purpose | Consent state, cookies and permitted requests | Does the expected integration work when the browser allows it? |
| Accept with third-party cookies blocked | Browser blocking reasons and functional behaviour | Does the site handle unavailable storage without breaking essential journeys? |
| Withdraw after acceptance | Updated signals and subsequent outgoing events | Do future events follow the changed choice? |
| Return visit or sign-in change | Restored preference and account handling | Does the expected choice remain effective? |
Define expected results for each purpose and integration before testing. For instance, Google Consent Mode's basic and advanced implementations intentionally differ before consent. Use the basic versus advanced guide to define the expected behaviour and the Consent Mode troubleshooting guide to investigate signal faults.
4. Separate browser blocking from consent failures
Illustrative example: an embedded booking tool works in Chrome with third-party cookies allowed, but loses its session when they are blocked. The visitor accepted the site's cookie banner in both tests. The next investigation is the tool's dependency on cross-site storage and its supported alternative, not whether to force the banner to grant consent again.
Conversely, if a marketing request is sent before the site's required consent, a browser blocking its cookie does not prove that the website's consent control worked. Inspect the request and the decision that allowed it.
5. Record reproducible findings
Keep the browser and OS versions, test date, settings, region, consent choice, journey steps and expected versus observed behaviour together. Capture relevant storage and request evidence using test data. Redact identifiers before sharing network exports.
Repeat affected journeys after changes to the CMP, tag container, vendor scripts or browser support. Prioritise broken essential functions and incorrect choice handling before trying to reconcile every reporting difference.
FAQ
Is Chrome removing third-party cookies in 2026?
Google retained Chrome's existing cookie-choice approach rather than proceeding with a new standalone prompt. Do not plan against an assumed universal removal deadline. Users can block third-party cookies in settings, and Incognito blocks them by default. Google announcement, Chrome settings
Did Privacy Sandbox shut down in October 2025?
Google announced retirement plans for a list of technologies on 17 October 2025, with phase-out through platform processes. That date is not a single technical shutdown date for every API. The same announcement retained support for several other technologies. Google's retirement announcement
Does Firefox block all third-party cookies?
Firefox blocks cross-site tracking cookies and isolates other third-party cookies by site. That partitioning allows some embedded functionality without sharing the same cookie across unrelated websites. Firefox Help
Are first-party cookies automatically consent-free?
No. First-party status describes the cookie's relationship to the website. For EU device storage or access, assess the purpose and whether an Article 5(3) exception applies. ePrivacy Directive
Can server-side tracking recover every missing conversion?
No. It cannot guarantee that a browser sends an event, that an identifier remains available, or that the event may be forwarded under the applicable choice. Evaluate the specific data flow rather than assuming a complete recovery of reporting.
Should I test only Chrome because most visitors use it?
Use your own audience and business-critical journeys to set priorities. Include a browser with stronger default restrictions and test Chrome with third-party cookies blocked. A sign-in or payment failure can matter even when it affects a smaller audience segment.
Review your cookies and tracking setup
Start with the Cookies and tracking guides to separate browser behaviour from collection architecture. If you need help connecting browser tests to your CMP and tags, see our cookie consent implementation service or request a free consent audit.
