First-party vs third-party: the distinction that matters
A cookie is a small piece of data a site stores in your browser. The first-party kind belongs to the site you are actually visiting -- it keeps you logged in and your basket filled. The third-party kind is set by a different domain embedded in the page: an ad network's pixel, a social widget, an embedded player. Because the same ad network is embedded on thousands of sites, its cookie lets it recognise you on all of them -- that is how a product you viewed once follows you around the internet for weeks.
Third-party cookies are the infrastructure of cross-site profiling, which is why browsers and regulators converged on them from different directions.
What actually happened to them?
The short history: Safari began restricting cross-site tracking with Intelligent Tracking Prevention in 2017 and now blocks third-party cookies by default. Firefox followed with Enhanced Tracking Protection in 2019. Brave always blocked them. That already covers a substantial minority of web users.
Chrome -- roughly two-thirds of the browser market -- announced in 2020 that it would remove third-party cookies too, replacing them with its Privacy Sandbox APIs. The deadline slipped from 2022 to 2023 to 2024 while advertisers and regulators (worried about entrenching Google's own ad dominance) pushed back. In July 2024 Google abandoned the forced phase-out, and by 2025 it had shelved the plan for a standalone opt-out prompt as well: Chrome keeps third-party cookies, with users able to restrict them in settings.
So "the death of the third-party cookie" arrived unevenly: dead on Safari and Firefox, alive-but-surrounded on Chrome, and squeezed everywhere by GDPR's consent requirement, which made setting tracking cookies legally conditional across the EU regardless of browser.
Does this affect your website analytics?
Less directly than the headlines suggest -- with one important nuance. Google Analytics runs as a first-party cookie on your domain, so browser third-party-cookie blocking does not disable it by itself. But the same privacy wave hit it from two other sides: Safari's ITP caps first-party script-set cookies (the GA kind) at days, not years, and EU law requires consent for analytics cookies whatever party they belong to. The result is the measurement gap we detailed in why your GA numbers are wrong: expiring cookies, declined banners, blocked scripts.
The deeper point: the cookie era trained everyone to treat individual-level tracking as the default architecture for measurement. Every browser change since 2017 punishes that architecture. Tools built on anonymous counting -- no cookies of any party -- have simply been unaffected by eight years of tracking crackdowns, because there is nothing in them to block or expire. That is the design behind privacy-first analytics.
What about advertising and remarketing?
If you run retargeting campaigns, this is where real change lands. Classic view-my-product-see-my-ad retargeting depends on cross-site recognition, and its reach shrinks with every blocked browser. The industry's answers -- Privacy Sandbox APIs, hashed-email identifiers, platform-native audiences inside walled gardens -- all have the same practical implication for a small business: first-party relationships become the asset. An email list you own outperforms an ad-network profile you rent, and the channels that do not depend on cross-site tracking (search, content, email, direct) compound in value.
What should a site owner do now?
- Audit what you embed. Third-party widgets bring third-party trackers with them; each one is banner-consent surface and page weight. Keep the ones that earn their place.
- Build first-party channels. Newsletter, customer accounts, direct relationships -- the data you are given beats the data that is scraped.
- Measure on cookie-independent ground. Anonymous, aggregated analytics is immune to cookie policy changes by construction -- no consent banner, complete counts, and nothing to re-architect at the next browser announcement. TrackTrendy does exactly this from €4/month.
- Tag your campaigns with UTMs so channel attribution survives without cross-site tracking -- see the UTM guide.
The cookie saga's lesson is not that any single deadline mattered -- most of them slipped. It is that betting your measurement on tracking mechanisms under permanent regulatory and browser pressure means rebuilding every few years, while the anonymous-counting approach has not had to change once.