Your cookie deprecation strategy, step by step

A cookie deprecation strategy is your plan for earning well from visitors whose browsers don't pass third-party cookies to buyers. Chrome kept those cookies in 2025, but Safari, Firefox, private browsing and declined consent already remove them for a big share of most sites. The plan: measure that share, fix consent, pass first-party IDs, add context and test what pays.

Here's the problem. For five years publishers were told a cookie deadline was coming, then it vanished, and plenty of people stopped paying attention. Meanwhile the cookieless part of your traffic kept selling for less, quietly, in every report you already have. If you want the background on how these cookies work, start with our guide to third party cookies, then come back for the plan.

This guide gives you the real timeline from Google's own posts, five steps in the order we'd do them, and a simple test so you only keep what earns money.

Is Google deprecating third party cookies?

No. Chrome still allows third-party cookies by default, and Google has said it will keep its current approach of letting users choose. MDN's page on third-party cookies puts it simply: Chrome doesn't block them by default, only in Incognito or when a user turns blocking on.

So why does a cookie deprecation strategy still matter? Because Chrome isn't your whole audience. Your visitors on iPhones, Macs and Firefox already browse without cross-site cookies, and many of your Chrome visitors in the UK and EU decline ad cookies on the consent banner.

Chrome cookie deprecation was cancelled. Cookieless traffic wasn't.

The cookie deprecation timeline, from Google's own posts

The cookie deprecation timeline ran from a live test in January 2024 to a full reversal in 2025. Most pages on this topic stop in July 2024, so here's the whole sequence with the source for each date.

Two things follow from that table. First, nothing is scheduled. There's no new Chrome date to plan around. Second, the replacement APIs most "cookieless" guides told you to adopt are gone. If a vendor still pitches a Topics or Protected Audience integration, our Privacy Sandbox guide for publishers lists what to remove.

Where cookies already don't reach your buyers

Your cookieless traffic is every visit where a buyer's ad buying technology can't read a cross-site cookie. That comes from three places, and only one of them is about Chrome.

The Safari row comes from WebKit's full third-party cookie blocking post, and the Firefox row from Mozilla's announcement. Neither has been reversed.

How big is that share for you? It depends on your audience. A UK lifestyle site with lots of iPhone readers can sit very differently from a desktop-heavy tech site in India. That's why step 1 is measuring, not guessing.

How to build a cookie deprecation strategy in 5 steps

Build your cookie deprecation strategy in this order: measure, fix consent, pass IDs, add context, then test. The cheap fixes come first because they often recover more than paid tools, and the test at the end stops you paying for things that don't earn.

1. Measure your cookieless traffic and what it earns per page view.
2. Fix your consent signals so every visitor who said yes is actually treated as a yes.
3. Pass first-party IDs to Google and to your Prebid bidders.
4. Send context to buyers so pages sell well without any ID at all.
5. Test what actually pays with a holdout, and keep only the winners.

Each step below says what to do, where the setting lives and what to watch out for.

Step 1. Measure your cookieless traffic

Start by splitting revenue per page view by browser. In Google Ad Manager, build a report with Browser as a dimension, plus ad impressions and revenue. Add your page views from analytics for the same days, and work out revenue per 1,000 page views for Chrome, Safari and Firefox.

Then look at the gap. If Safari earns clearly less than Chrome on the same pages, that's your cookieless cost, roughly. It isn't all about cookies, since device mix and country play a part, but it tells you how much is on the table.

• Note the share of page views from Safari, Firefox and other non-Chrome browsers.
• Pull your consent rate from your consent platform (CMP): how many UK and EU visitors accept ad cookies.
• Write both numbers down. Every later step gets judged against them.

Step 2. Fix your consent signals

Fix consent before anything else, because a broken consent string turns a yes into a no. When a UK or EU visitor declines or the signal is missing, Google serves non-personalized ads. Google's help page on personalized and non-personalized ads says those use "contextual information, including coarse geo-targeting" instead of the user's profile.

That's fine when someone really declined. It's lost money when they accepted and the signal never reached the auction. Here's what we check:

• Your CMP is set up for IAB TCF, which Google points publishers in the EEA, the UK and Switzerland to in its ads personalization settings page.
• Google is listed as a vendor in your CMP, so Google's ad tags receive consent for it.
• Prebid's TCF consent management module is in your build. It fetches the consent string from the CMP and passes it to your bidders.
• Ad calls wait for the CMP to answer, rather than firing before consent loads.

On the UK side, the ICO's PECR cookie guidance is plain: you must get "the person's consent to store a cookie on their device", and that consent has to be actively given. So don't try to win back revenue with a sneaky banner. Win it with a banner that works.

Step 3. Pass first-party IDs

Pass first-party IDs so buyers can still cap frequency and recognise returning readers on your own site. There are two routes, and most publishers with Prebid use both.

For Google demand, Ad Manager 360 lets you send a publisher provided identifier (PPID). Google uses it "for use in frequency capping, audience segmentation" and similar jobs. The rules are strict: 22 to 150 characters, hashed or encrypted so it's "meaningless to Google", and never raw personal data like an email address. If you work with other bidders through Google, secure signals lets you share IDs on requests through Authorized Buyers, Open Bidding and SDK Bidding.

For Prebid demand, the User ID module does the job. You list each ID under userSync.userIds, choose where it's stored (cookie, html5 or both) and, if you want, limit which bidders get it with the bidders setting. A minimal setup looks like this:

pbjs.setConfig({
  userSync: {
    userIds: [{
      name: "sharedId",
      storage: { type: "cookie", name: "_sharedid", expires: 365 }
    }]
  }
});

Which IDs to add is a bigger question. Our guide to universal IDs for publishers compares the options, and our first party data strategy guide covers logins, newsletters and segments. Keep this step small at first: one ID, measured, beats five IDs nobody checks.

Step 4. Send context to buyers

Contextual targeting is the one signal that works on every visit, with or without cookies or consent. A page about running shoes tells a buyer a lot, as long as the bid request says what the page is about.

• Set Ad Manager key-values for section and topic. Google's page says simply: "Key-values let you define custom targeting."
• In Prebid, pass the page's categories and keywords as first-party data in ortb2.site.
• Map your sections to the IAB Tech Lab Content Taxonomy; version 3.1 is the newest one listed.
• Keep page titles and headings clear. Contextual tools read your page, so a vague title is a weak signal.

Our guide to contextual advertising for publishers goes deeper on the page side. For this plan, the goal is just that every request carries a section and a topic.

Step 5. Test what actually pays

Test every change against a holdout before you keep it, because measurement is the only way to know a fix paid. Pick one change, such as adding an ID to Prebid, and turn it on for most of your traffic while a small slice runs without it.

• Split by visitor, not by page, so the same reader doesn't flip between groups.
• Run it for at least two weeks, so weekday and weekend traffic both count.
• Compare revenue per 1,000 page views for Safari and Chrome separately. A gain that only shows in one browser tells you where it works.
• Count the costs too: ID vendor fees, extra script weight and page speed.

If the change doesn't beat the holdout, switch it off. That one rule saves more money than any vendor demo.

What we check first when a publisher asks about cookies

When a publisher asks us about a cookieless advertising strategy, we open the browser report before anything else. Most of the time the biggest win isn't a new tool. It's a consent setup that leaks, or bid requests that say nothing about the page.

Here's our usual order on a review:

1. Check revenue per page view by browser, to size the cookieless gap.
2. Check that the CMP answers before the first ad call, on mobile as well as desktop.
3. Check that Prebid's consent and user ID modules are in the build, not just in the config.
4. Check that key-values for section and topic reach every ad request.
5. Remove any leftover Privacy Sandbox modules a vendor added in 2024.

Only then do we talk about adding ID partners. They can help, but only once the basics stop leaking. Our cookie syncing guide explains why extra ID calls also cost page speed, which is a cost you should weigh.

Mistakes to avoid when preparing for cookie deprecation

The biggest mistake when preparing for cookie deprecation is planning for a Chrome date that no longer exists. These are the others we see most:

• Ignoring Safari. If most of your readers are on iPhones, your cookieless problem is already here and already priced in.
• Buying identity before fixing consent. An ID can't be used on a visitor whose consent signal was lost.
• Keeping retired APIs. Topics and Protected Audience modules do nothing now except add code.
• Collecting emails without a plan. Hashed emails only help if they reach buyers through an ID setup you've tested.
• Judging by CPM alone. Use revenue per page view. A higher CPM with fewer filled impressions can earn less.

Frequently asked questions

Is Google deprecating third party cookies in Chrome?

No. In April 2025 Google said it would keep its current approach to cookie choice in Chrome and wouldn't add a new standalone prompt. Chrome allows third-party cookies by default unless a user blocks them or browses in Incognito.

Do I still need a cookie deprecation strategy if Chrome keeps cookies?

Yes, if a real share of your visitors use Safari or Firefox, browse privately, or decline consent. Those visits are cookieless today. Step 1 tells you how big that share is on your site.

Does cookie deprecation affect AdSense publishers?

It affects them less directly, because Google handles the ads, IDs and buyers. You still control consent: a broken CMP setup means more non-personalized ads in the UK and EU, and those are matched on context and coarse location instead of the visitor's profile.

What replaces third-party cookies for publishers?

No single thing. Publishers use a mix of consented first-party IDs (such as a PPID or IDs in Prebid's User ID module), contextual signals about the page, and logged-in data where they have it. Google retired most of the Privacy Sandbox ad APIs in October 2025.

Do I need a universal ID?

Not to start. Fix consent and send context first, then add one ID and test it against a holdout. Keep it only if revenue per page view rises by more than the ID costs.

How long does a cookieless test take?

Plan for at least two weeks per change, so both weekday and weekend traffic are counted. Busier sites can read results sooner, but don't stop a test the day a good number appears.

Next step

Cookies didn't disappear, but your cookieless traffic is real and you can measure it today. Start with the browser report and the consent check this week. If you'd like a second pair of eyes on your setup, we'll review your consent, IDs and header bidding together as part of our header bidding service, or you can ask us for a free review.