If your site uses third-party cookies it's time to take action as we approach their deprecation. Chrome restricted third-party cookies for 1% of Chrome Stable clients from January 4th, 2024 to facilitate testing, and plans to ramp up to 100% of Chrome clients from early 2025, subject to addressing any remaining competition concerns of the UK's Competition and Markets Authority (CMA). Chrome has also restricted cookies for 20% of Chrome Canary, Dev, and Beta clients.
Our goal with the Privacy Sandbox is to reduce cross-site tracking while still enabling the functionality that keeps online content and services freely accessible by everyone. Deprecating and removing third-party cookies encapsulates the challenge, as they enable critical functionality across sign-in, fraud protection, advertising, and generally the ability to embed rich, third-party content in your sites—but at the same time they're also the key enablers of cross-site tracking.
In our previous major milestone, we launched a range of APIs providing a privacy-focused alternative to today's status quo for use cases like identity, advertising, and fraud detection. With alternatives in place, we can now move on to begin phasing out third-party cookies.
1% third-party cookie deprecation and Chrome-facilitated testing
On the privacysandbox.com timeline you can see two milestones in Q4 2023 and Q1 2024 as part of Chrome-facilitated testing modes. This testing is primarily for organizations testing the Privacy Sandbox relevance and measurement APIs, however as part of this we have disabled third-party cookies for 1% of Chrome Stable users.
This means that from the start of 2024, you can expect to see an increased portion of Chrome users on your site with third-party cookies disabled even if you are not actively participating in the Chrome-facilitated testing. This testing period continues through to Q3 2024 when, after consultation with the CMA and subject to resolving any competition concerns, we plan to begin disabling third-party cookies for all Chrome users.
Take action to ensure your sites are prepared
We've broken the process down into these key steps, to ensure you're prepared for your site to run without third-party cookies:
- Audit your third-party cookie usage.
- Test for breakage.
- Migrate to privacy preserving solutions:
- For cross-site cookies which store data on a per site basis, like an embed, consider
Partitionedwith CHIPS. - For cross-site cookies that would otherwise be restricted by browser settings, consider prompting users with request for storage access permissions with Storage Access API.
- For cross-site cookies across a small group of meaningfully linked sites, consider Related Website Sets.
The Privacy Sandbox provides a range of purpose-built APIs for specific use cases without a need for third-party cookies:
- Federated Credential Management (FedCM) enables federated identity services allowing users to sign in to sites and services.
- Private State Tokens enable anti-fraud and anti-spam by exchanging limited, non-identifying information across sites.
- Topics enables interest-based advertising and content personalization.
- Protected Audience enables remarketing and custom audiences.
- Attribution Reporting enables measurement of ad impressions and conversions.
If you still have third-party cookie use cases that are not covered by these options, you should report the issue to us and consider if there are alternative implementations that don't depend on features that can enable cross-site tracking.
Preserve critical user experiences
Cross-site cookies have been a critical part of the web for over a quarter of a century. This makes any change, especially a breaking change, a complex process that requires a coordinated and incremental approach. While the additional cookie attributes and new privacy-focused APIs account for the majority of use cases, there are specific scenarios where we want to ensure we don't break the experience for people using those sites.
Explore these temporary options, such as third-party deprecation trial and enterprise controls, while you continue making the necessary changes to migrate away from unrestricted third-party cookies.
Read more about the options offered in Preserving critical user experiences.
Report issues with third-party cookies and get help
We want to ensure we capture the various scenarios where sites break without third-party cookies to ensure that we have provided guidance, tooling, and functionality to allow sites to migrate away from their third-party cookie dependencies. If your site or a service you depend on is breaking with third-party cookies disabled, you can submit it to our breakage tracker at goo.gle/report-3pc-broken.
If you have questions around the deprecation process and Chrome's plan, you can raise a new issue using the "third-party cookie deprecation" tag in our developer support repository.