Google’s deprecation of third-party cookies in Chrome, finalised in early 2024, completed a process that had been underway for several years. Safari had blocked third-party cookies by default since 2017. Firefox followed with Enhanced Tracking Protection in 2019. Chrome’s announcement that it would follow suit, originally made in 2020 and delayed several times, was finally acted upon.

For publishers who had been following developments closely, the Chrome deprecation was not a surprise. For many others, it arrived as a genuine disruption to revenue models that had been built on the assumption that cross-site user tracking would remain available indefinitely. This guide aims to cut through the noise and explain what has actually changed, what it means in practice, and what publishers should be doing in response.

What third-party cookies actually were

A third-party cookie is a cookie set by a domain other than the one the user is currently visiting. When you visited a news website, that site might load resources from dozens of third-party domains - advertising platforms, analytics tools, social media widgets, data management platforms - each of which could set its own cookie in your browser. Those cookies could then be read by the same third-party domains when you visited any other site that loaded their resources.

This mechanism enabled the construction of detailed profiles of individual users’ browsing behaviour across millions of websites. An advertising platform that had tracking pixels on enough sites could build a profile that included your political interests, health concerns, shopping habits, relationship status, travel patterns, and financial situation - all inferred from your browsing history - without you ever explicitly providing any of that information.

The advertising value of these profiles was real. They allowed advertisers to target their ads with a precision that contextual advertising - matching ads to page content - could not match, at least in theory. The cost was equally real: a systematic, largely invisible surveillance infrastructure that most users had no meaningful knowledge of or control over.

What has replaced it

The industry has responded to cookie deprecation with a range of approaches, not all of them equally legitimate.

Some ad tech vendors have developed fingerprinting techniques that identify individual users based on combinations of browser characteristics - screen resolution, installed fonts, browser version, device characteristics - without using cookies at all. These approaches are generally considered to be in breach of GDPR and UK PECR, which apply to any technology that tracks individual users, not just cookies specifically.

Google’s own Privacy Sandbox initiative proposed a set of browser-based APIs that would allow interest-based advertising to continue without individual tracking data leaving the browser. The Topics API, which replaced the earlier and more controversial FLoC proposal, allows the browser to assign users to broad interest categories based on their browsing history, which can then be accessed by ad scripts on pages they visit. This is a more privacy-preserving approach than third-party cookies, though it remains controversial in privacy advocacy circles.

The most robust alternative, and the one that is most clearly compliant with current law, is contextual advertising: serving ads based on the content of the page being viewed rather than the profile of the viewer. This approach never relied on third-party cookies, requires no user tracking, and works cleanly within GDPR and ePrivacy frameworks.

What it means for publisher revenue

The honest answer is that the immediate impact on publisher revenue has been variable. Publishers who were heavily dependent on programmatic advertising driven by third-party cookie targeting have seen CPM compression in some inventory categories. Publishers who had diversified their demand sources, established direct advertising relationships, or were already operating in niches where contextual relevance was strong have often seen more modest impacts - and in some cases, improvements, as contextual inventory becomes more valuable relative to now-degraded cookie-based inventory.

The medium-term outlook is more clearly positive for publishers who respond correctly. The programmatic ecosystem is gradually reconfiguring itself around privacy-preserving signals. Advertisers who are serious about the long term are investing in first-party data strategies and building direct relationships with publishers whose audiences are demonstrably relevant to their products. The publishers positioned to benefit from this shift are the ones with engaged specialist audiences, good first-party data relationships with their readers, and robust consent management that generates usable signals.

What you should be doing now

If you have not already done so, the following are the priority actions:

Audit your consent rate. If your current consent management platform is seeing below 60% consent rates, it is either technically broken or poorly designed. Either problem is solvable, but both cost you money every day they persist.

Understand what tracking you are running. Use a tag auditing tool to get a complete picture of every third-party script firing on your site. Many publishers discover they are running trackers they no longer use, didn’t knowingly implement, or that are in clear breach of their own privacy policy.

Review your advertising partner agreements. If your agreements don’t explicitly address post-cookie targeting and data usage, they need updating. You need to understand what your advertising partners are and are not doing with the signals your site generates.

Explore first-party data opportunities. What do you know about your readers that they have consciously shared with you? Registration data, subscription preferences, content engagement patterns - these are legitimate first-party signals that can support advertising targeting without any regulatory exposure.

Test contextual. If you haven’t already tested contextual advertising placements against your existing programmatic setup, do it now. The gap in performance is often much smaller than people expect.

The cookie-free web is not a catastrophe. It is, in many respects, an overdue correction. The publishers who engage with it seriously will find themselves better positioned than those who wait for someone else to solve the problem.