Most browsers block third-party cookies today. Here is what changed, what is true now, and simple privacy-first steps for this week.
Most web browsers now block third-party cookies, the small files that follow people from one website to another. Google decided not to fully remove them, but the move away from tracking has not stopped. This week, focus on information your customers give you directly, with their permission.
What changed
A cookie is a small piece of data a website stores on your phone or computer. A third-party cookie is stored by a website other than the one you are visiting. According to OnSpot Data, advertisers used these cookies for about twenty years to follow people across websites and build profiles of what they did.
That has shifted. OnSpot Data reports that browsers such as Safari and Firefox block cross-site tracking. It also reports that 67% of U.S. adults take steps to limit tracking.
Sources do not fully agree on Google. A 2023 article from Syrenis said Google's Privacy Sandbox would eventually remove cookies in Chrome. The newer OnSpot Data guide, from October 2026, says Google decided not to fully remove cookies. The articles were written at different times. The newer one says this decision has not changed the direction of the industry.
What is true now
Going "cookieless" does not mean going without data. It means using signals people agree to share. OnSpot Data lists a few of them:
- First-party data. This is information you collect yourself, through your own website, app, sales records or surveys, as nine.am explains.
- Contextual relevance. This means showing an ad that fits the topic of the page, not the person's past browsing.
- Consented location data. This is device location that a person has agreed to share.
Researchers writing in First Monday list more options, such as identity graphs, user groups called cohorts, and Marketing Mix Models. They also say the post-cookie future brings many challenges for advertisers.
Many businesses still depend on the old way. nine.am cites an Adobe study that found 75% of marketers still rely on third-party cookies.
Consent still matters, even for your own cookies. Syrenis notes that EU law still requires consent for many first-party cookies. Data Axle names Europe's GDPR and California's CCPA as key privacy laws.
Email rules matter too
Your email list is one of your best sources of first-party data. The rules for sending email have also changed. Data Axle reports that Gmail began enforcing new rules for high-volume senders in November 2025. These include:
- A one-click unsubscribe option.
- Sender checks called SPF, DKIM and DMARC. These are settings that help prove an email really comes from your business.
- Clean lists. Senders are expected to remove addresses that bounce, so fewer emails fail.
Data Axle says email that does not meet these rules may not reach the inbox. It also says Microsoft, Apple and Yahoo are likely to adopt similar rules.
Steps to take this week
- List what you already own. Write down your email list, customer records, past orders and survey answers. This is your first-party data.
- Ask clearly and get permission. On signup forms, say what people will get and how often. Consent-based marketing, OnSpot Data says, invites people to opt in and builds trust.
- Check your cookie notice. If you have visitors from the EU, remember that many first-party cookies still need consent there.
- Review your Google Analytics settings. Google Analytics Help says it does not log or store IP addresses from EU, Switzerland or UK users. You can turn off detailed location and device data by region. Know the trade-off: Google says this greatly reduces modeled conversion counts for that region and also affects linked Google Ads reports.
- Check your email setup. Ask the person who runs your email to confirm SPF, DKIM and DMARC are in place. Make sure every marketing email has a one-click unsubscribe. My suggestion is simple. Before your next send, you or the person who sends your email should remove every address that bounced. If that is not possible this week, make it the first task before your next campaign goes out.
- Use a simple guide. The NIST Privacy Framework is a voluntary tool from the U.S. government. It offers basic questions and activities to help organizations start managing privacy risk.
You do not need to do everything at once. Start with your list and your email setup. Those two steps give you data you control and help your messages reach people.
How I can help
AppWT has built 600+ websites, by its own count. AppWT has a core team of 7. AppWT is practicing since 1997 and operating as AppWT since 2005. AppWT is based in Livonia, Michigan.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Cookieless Marketing: Strategies for 2026 | OnSpot Data, OnSpot Data, 2026-10-20
- The impact of a cookieless future: Adapting to a privacy-first world, syrenis.com, 2023-03-29
- The Cookie-Less Future: How to Win in a Privacy-First World | nine.am, nine.am, 2026-01-30
- Adapting digital marketing strategies for a cookieless future: Challenges and opportunities | First Monday, First Monday, 2025-06-05
- Privacy-First Marketing: Thrive Beyond Cookies and Compliance, data-axle.com, 2026-01-27
- EU, Switzerland, or UK-focused data and privacy - Analytics Help, Google Analytics Help
- Privacy Framework, National Institute of Standards and Technology, 2018-08-10
Tags
Frequently Asked Questions
Are third-party cookies gone?
Not completely. OnSpot Data says most browsers already block them, and Safari and Firefox block cross-site tracking. It also says Google decided not to fully remove cookies.
What is first-party data?
It is information you collect directly from your own customers. Examples include website visits, purchases, customer records and survey answers.
Do I still need consent for my own cookies?
In the EU, often yes. Syrenis notes that EU law still requires consent for many first-party cookies.
What changed with Gmail?
Data Axle reports that Gmail began enforcing rules for high-volume senders in November 2025. These include one-click unsubscribe and sender checks called SPF, DKIM and DMARC.
Does Google Analytics store IP addresses?
Google Analytics Help says it does not log or store IP addresses from EU, Switzerland or UK users. It uses them only to find a rough location, then discards them.
Enjoyed this article?
Share it with your network
