Third-party cookies are still in Chrome, with no removal date. What actually happened is stranger, and more useful to know: Google spent five years building a cookie replacement, then killed that replacement instead. If your first-party data strategy is built on “cookies are going away,” it’s built on the wrong premise.
- What actually happened: Google reversed its own cookie-deprecation plan in April 2025, then retired its Privacy Sandbox replacement APIs in October 2025.
- What didn’t change: the industry-wide shift toward first-party data continues anyway, because Google was never going to hand marketers a workable substitute.
- Who this is for: marketing teams deciding where to invest in data infrastructure now that “wait for Google’s alternative” is no longer an option.
- Google confirmed in April 2025 it would not deprecate third-party cookies after all, then retired its own Privacy Sandbox replacement APIs in October 2025 — the technology meant to replace cookies is gone, the cookies themselves aren’t.
- Brands using tailored first-party-data experiences saw an 18% lower customer acquisition cost and 27% higher conversion, per Deloitte Digital research commissioned by Meta.
- First-party data activation is now a top growth driver for 39% of European ad buyers, tied with omnichannel integration, per IAB Europe’s 2025 Attitudes to Retail Media Report.
- AI-driven “clean rooms” now do the job third-party cookies used to do for lookalike targeting — matching a brand’s own customer data against a publisher’s audience without either side exposing raw data.
1. What actually happened to third-party cookies
Google confirmed on April 22, 2025 that it would not deprecate third-party cookies in Chrome after all — reversing the pledge it first made in 2020. Six months later, on October 17, 2025, Google went further and retired the Privacy Sandbox APIs it had spent years building as the cookie replacement — Topics, Protected Audience, and Attribution Reporting among them. Deprecation began at Chrome 144 in January 2026, with full removal targeted for Chrome 150 in July 2026.
Read that sequence carefully: cookies stayed, and the *alternative* to cookies is what got cancelled, reportedly after failing to gain adoption and facing scrutiny from the UK’s Competition and Markets Authority. The practical takeaway is not “cookies are back, ignore first-party data.” It’s that Google was never going to hand the industry a ready-made substitute — which is exactly why first-party data investment has continued regardless of what Chrome does with cookies.
2. How far first-party data adoption has actually gotten
First-party data activation is now named by 39% of European ad buyers as a top growth driver, tied with omnichannel integration, according to IAB Europe’s 2025 Attitudes to Retail Media Report, based on responses from more than 180 buyers and sellers across 31 European markets. Separately, Deloitte Digital research commissioned by Meta — still cited by the IAB Tech Lab as the reference study in 2026 — found brands running tailored first-party-data experiences saw an 18% lower customer acquisition cost, 27% higher conversion, 20% higher spend per customer, and 23% higher satisfaction than brands that didn’t.
That doesn’t mean the shift has been smooth. An earlier IAB Europe survey found second-party data partnerships actually grew in preference relative to pure first-party approaches in some years — a reminder that “collect your own data” is a starting point, not a finished strategy, and most teams still route at least some targeting through data partnerships rather than first-party data alone.
3. Where AI actually fits: clean rooms and lookalikes
The mechanism that’s actually replacing cookie-based lookalike targeting is the AI-driven clean room: a system where a brand’s high-value customer profiles are matched against a publisher’s audience using shared models, without either side exposing its raw data to the other. InfoSum — acquired by WPP in 2025 — is now positioned as WPP/GroupM’s clean-room layer for training client-specific models on first-party data without that data leaving the client’s control.
This isn’t a fit for every team. Industry analysts note clean-room investment is premature for companies without both a meaningful volume of first-party data and significant media spend to justify it — smaller advertisers are generally better served starting with simpler first-party segmentation before evaluating a clean-room partnership. Teams unsure whether they have the infrastructure maturity for this step are the same audience we cover in how to choose an AI marketing agency, since a data-strategy evaluation is exactly the kind of work worth outside scrutiny before committing budget.
4. The GDPR question nobody’s cookie post answers
Most “cookieless marketing” content treats first-party data as automatically GDPR-safe because it’s “your own data.” That’s not quite right, and the distinction matters for how you actually implement AI-driven targeting. The European Data Protection Board’s Opinion 28/2024 (adopted December 2024) confirms legitimate interest can be a valid basis for AI models processing personal data — but explicitly frames it as a starting point requiring a documented necessity and balancing test, not an automatic pass. France’s CNIL went further in June 2025, formally endorsing legitimate interest as workable for AI *training* on personal data specifically, provided safeguards like opt-outs and data minimization are documented before training begins.
What neither opinion resolves is individual-level ad profiling once that model exists — which generally still needs consent under GDPR and the ePrivacy framework, not just legitimate interest. The table below is the distinction most cookieless-marketing advice skips.
| Activity | Likely legal basis | Key requirement |
|---|---|---|
| Training an AI model on your own first-party customer data | Legitimate interest (per CNIL, June 2025) | Documented necessity + balancing test before training starts |
| Using that model for individual-level ad profiling or targeting | Consent (GDPR + ePrivacy) | Explicit, informed opt-in from the individual being targeted |
| Building lookalike audiences via a clean room | Depends on data flow — often legitimate interest on the brand’s own data, consent on the matched audience | Case-by-case legal review; not a blanket first-party exemption |
5. A sequence for auditing your own data stack
Before investing in a clean room or a new first-party data platform, most teams get more value from checking what they already have:
- Inventory what first-party data you currently collect (CRM, email engagement, on-site behavior) and where it actually lives — fragmented across tools is the most common blocker to using it for AI targeting at all.
- Confirm the legal basis you’re relying on for each use case, using the training-vs-targeting distinction in Section 4 rather than assuming “first-party” means “compliant.”
- Check whether your data volume and media spend actually justify a clean-room investment, or whether simpler first-party segmentation gets you most of the value first.
- Pilot AI-driven segmentation or lookalike modeling on one channel before rolling it out account-wide.
- Re-check your measurement setup — a shift in targeting method changes what’s attributable, a point covered further in our piece on performance marketing metrics that matter more than CTR.
What the evidence doesn’t yet support
A few limits worth stating plainly. The Deloitte/Meta performance figures (18% CAC reduction, 27% conversion lift) come from a single 2023 study commissioned by a platform with a direct interest in the outcome — a strong proof point, not an industry-wide guarantee for every brand. Clean-room technology remains genuinely premature for advertisers without significant first-party data volume and media spend; smaller teams chasing this before they have the data foundation for it are solving the wrong problem first. And the GDPR guidance in Section 4 is still evolving — the CNIL and EDPB positions cover training and profiling in general terms, not every specific AI targeting use case, so case-by-case legal review still matters more than a general “first-party data is compliant” assumption.
Frequently Asked Questions
Are third-party cookies actually going away?
Not on any confirmed timeline. Google reversed its own deprecation plan in April 2025 and has not set a new removal date. What did go away is Google’s Privacy Sandbox replacement technology, retired in October 2025 — which is why first-party data investment matters regardless of what happens to cookies.
Does first-party data automatically solve GDPR compliance for AI targeting?
No. Training a model on your own customer data can often rely on legitimate interest, per CNIL guidance from June 2025, but using that model for individual-level ad profiling generally still requires separate consent under GDPR and ePrivacy rules. See the comparison table in Section 4.
Do we need a clean room to do AI-driven first-party targeting?
Only if you already have meaningful first-party data volume and enough media spend to justify it. Industry analysts consider clean-room investment premature for smaller advertisers — simpler first-party segmentation is usually the better starting point.