Never Mind: Google Keeps Third-Party Cookies. The Work Still Counted.

Four years of deprecation countdown ended on July 22 with a blog post and a shrug. Google announced that Chrome will keep third-party cookies after all. The phase-out announced in January 2020, delayed in 2021 and again in 2022, begun at one percent this January, is abandoned. In its place: a proposal for a user-choice mechanism, details and timeline unspecified. It is subject to review by the UK’s competition regulator, whose oversight shaped the whole sequence.

The industry’s whiplash is real and earned. An ecosystem’s worth of migration spending resolved by press release in a July news cycle. The Sandbox API hookups, the cookieless-readiness programs, the vendor roadmaps, the conference tracks. The told-you-so genre is already thriving in both directions. The adtech crowd celebrating. The privacy crowd noting that the fire drill we ran in January now reads as theater.

Both reflexes are cheap. We predicted neither the date nor the reversal and says so plainly. What it did do (hedge explicitly, twice, in writing, against exactly this class of outcome) earns the right to do the useful accounting instead. Why the deprecation collapsed, what remains true regardless, and the planning lesson worth filing beside every announced deadline this readership will ever receive again.

Why it collapsed: the two-constraint problem

The autopsy, assembled from public sources (the CMA’s published concerns, the industry testing data, Google’s own framing) because its shape is instructive beyond this episode. The deprecation died of a two-constraint problem that never closed.

The Privacy Sandbox had to satisfy the competition regulator. Its standing worry: killing third-party cookies while Google kept its own first-party data advantages would entrench the dominant player. That worry grew sharper as testing showed Sandbox-based advertising underperforming cookies economically.

At the same time, the Sandbox had to satisfy the ad ecosystem’s revenue math. Publishers and adtech testing the replacement APIs kept reporting real revenue gaps. That meant every deprecation date was a scheduled industry-wide pay cut with Google’s name on it.

Privacy pressure pushed the project forward. Competition pressure and revenue math pushed back. Four years of engineering could not close the gap. The user-choice proposal is the classic exit from an unclosable position. Move the decision to the user, satisfy no one completely, and ship the press release on a summer Friday. This outcome was legible in the structure all along. A company asked to referee between its own regulator, its own revenue, and its own ecosystem was never a stable judge. Which is precisely why our advice was what it was.

What remains true regardless, and this is the part that matters

• Safari and Firefox blocked third-party cookies years ago: a third or more of most sites’ traffic has run cookieless this whole time. Nothing in July’s announcement changes that. Every measurement and marketing setup still faces the same partial-signal reality it faced in June.

• Regulatory pressure has not relaxed anywhere: the privacy statutes keep multiplying, the state-law pileup, the international spread. The enforcement keeps sharpening. The consent-scoped collection the GDPR era installed remains the legal baseline, whatever Chrome ships.

• Signal loss is the ambient condition: MPP fictionalized the open rate. ITP decayed the identifiers. Consent gaps partialize everything. The modeled-measurement era exists because machine-reported behavior keeps getting less trustworthy on every front at once. Chrome keeping one mechanism does not reverse a seven-year, multi-front trendline.

• The user-choice mechanism itself is unpriced: whatever prompt Chrome eventually ships, some share of users will decline. The ATT precedent, Apple’s prompt, and the low opt-in realities that followed, suggests the share may be large. The cookie’s reprieve may prove, in adoption terms, a slower version of the same funeral.

The verdict on seven years of advice

Now the accounting we have standing to deliver, because our advice is in writing across seven years of posts. The first-party work was never wasted, because the deadline was never the reason.

Walk the list: the consented-data programs, the owned-audience investments, and the server-side pipelines. Then the on-domain measurement and the consent architecture. Every recommendation we made (from ITP in 2017 through the FLoC porch in 2021 to January’s drill) was justified at the time by the direction: cross-site tracking’s structural decline, browser-led and regulation-backed. Never by Chrome’s schedule, which we declined to trust in writing, twice. Most recently in January’s ‘direction, not dates’ hedge, which this reversal confirms.

Organizations that built on the trendline hold assets that gained through every iteration and are untouched by the reversal. Their measurement works, their audiences are theirs, their compliance status is current. Organizations that raced to beat a Chrome deadline specifically got whiplash. And organizations that bet on the reversal (the ones that deferred everything, waiting for exactly this outcome) won a news cycle. They still face Safari, Firefox, the statutes, and the ambient decay. Which is to say, they won nothing durable. Strategy built on trendlines survives schedule cancellations. Strategy built on schedules is a bet on other people’s press releases, and July 22 is the cleanest example of the difference we have seen.

How to hold the next announced deadline

The transferable lesson, because announced deadlines are a permanent feature of this audience’s world and July re-calibrates how to hold them. Believing announcements and this month’s reversal are not in tension. The reconciliation is worth stating precisely.

Believe announcements about what platforms will enforce on you. The ranking deadlines, the label rollouts, the API sunsets. The track record there remains near-perfect, because enforcement is cheap for the platform and the platform controls it.

Hedge announcements that require the platform to accept pain on your behalf. The deprecations that cost the announcer revenue. The transitions requiring ecosystem consensus. Anything a regulator can veto. Those die of exactly the two-constraint anatomy above, and the cookie deprecation now heads that file’s specimen drawer.

The practical approach, unchanged and re-armed. Do the work the direction justifies on its own merits. Treat the dates as planning conveniences rather than commitments. And keep the January drill’s outputs anyway. The SSO fixes, the embed cleanups, the CHIPS migrations. All still correct, because Safari exists. Never mind, says the press release. The work still counted, says the accounting. And the accounting gets the last word.