Third-party cookies are set by a domain other than the one the visitor is on, typically an ad or tracking service embedded in many sites. Safari and Firefox block them by default. Google announced plans in 2020 to phase them out of Chrome, delayed several times, then said in 2024 and 2025 that it would not proceed with a forced phase-out and would keep users' existing cookie controls. The original deprecation plan for Chrome is therefore effectively abandoned, though third-party cookies remain restricted across much of the web.
Where things stand
The practical position in late 2026 is mixed. Safari and Firefox restrict third-party cookies by default. Chrome continues to allow them for users who have not blocked them. Google has also scaled back much of its Privacy Sandbox program that was meant to replace them. Check Google's and the browsers' own announcements for current details, because this area has changed repeatedly.
What it means for analytics
Most web analytics, including GA4, uses first-party cookies, so the core of site analytics is not directly affected. The impact falls on cross-site use cases.
- Ad retargeting and frequency capping across sites
- View-through conversion tracking by ad networks
- Embedded widgets that rely on cookies, such as some chat and login tools
- Third-party audience data used for targeting
How teams have adapted
The common response is to rely more on first-party data and consented identifiers: logged-in user IDs, server-side tagging, ad platforms' conversion APIs, and aggregate measurement such as incrementality tests. These approaches hold up regardless of what any single browser decides next.
Example
Measuring paid social without cross-site cookies
Imagine Ospreyline, a scheduling tool, sees ad-platform-reported conversions drift away from trial starts in its own database, especially for Safari users. Rather than chase cookie fixes, the team sends trial starts server-side through the platform's conversion API and runs periodic holdout tests to check how much the ads actually add.
Common mistakes
Assuming GA4 broke because of cookie deprecation
GA4 uses first-party cookies. Look at consent, tagging and browser limits first.
Planning around one announcement
Timelines have changed many times. Build measurement that does not depend on third-party cookies at all.
Questions
Not by default. Google stepped back from a forced removal and kept user controls instead. Users can still block them in Chrome settings, and other browsers block them by default.
