How Online Advertising Tracking Still Works After Cookie Deprecation

Google’s deprecation of third-party cookies in Chrome — delayed multiple times from its original 2022 target but now proceeding through 2024–2025 — was widely covered as a significant change to online advertising tracking. It is a significant change. It is not the end of online advertising tracking, and the advertising industry has moved aggressively to develop alternatives that maintain audience targeting and attribution capabilities without relying on the specific mechanism that third-party cookies provided. Understanding those alternatives explains both the current state of online privacy and why the death-of-tracking narrative consistently overstates how much user privacy improves from any single technical change.

What Third-Party Cookies Were and Why They’re Going

A third-party cookie is a cookie set by a domain other than the site the user is visiting. When you visit news.example.com and that page loads an ad from adnetwork.example, the ad network’s JavaScript sets a cookie on your browser from adnetwork.example’s domain. The next time you visit shop.example.com and that page also loads an ad from adnetwork.example, the ad network’s cookie is sent with the request, allowing adnetwork.example to recognize you as the same user who visited news.example.com. This cross-site user recognition is how traditional ad retargeting worked: see a product on one site, see ads for that product on other sites.

Third-party cookies are going away because major browsers have blocked them (Firefox and Safari have blocked them for years; Chrome’s deprecation is completing this change across the dominant browser) due to privacy concerns, regulatory pressure from GDPR and similar laws, and user sentiment. The third-party cookie mechanism is particularly transparent (browser extensions can show exactly what tracking cookies are present) and relatively easy to block, which made it an obvious target for privacy advocacy.

What Replaced Cookies: The Main Alternatives

The advertising industry’s response to cookie deprecation has been a proliferation of alternative tracking approaches, several of which are harder to block than cookies and in some ways more privacy-invasive.

Browser fingerprinting collects a collection of device and browser attributes — screen resolution, installed fonts, browser version, system timezone, hardware capabilities, WebGL rendering characteristics — that together create a unique or nearly-unique identifier for a device without storing anything on the user’s browser. The fingerprint is derived from information that browsers expose as part of normal operation, making it difficult to prevent without fundamentally changing what APIs browsers expose. Fingerprinting doesn’t require any stored state; it computes the identifier from the device at the time of the visit. Privacy-focused browsers (Brave, Firefox with Enhanced Tracking Protection) actively work to reduce fingerprinting surface by normalizing or randomizing some of these attributes, but perfect fingerprint prevention requires significant tradeoffs in web compatibility.

First-party data and identity resolution use email addresses and other authenticated identifiers to link users across sites and devices. If you sign into a site with your email address, that site can hash your email and share it with advertising partners who can match it against their own records — connecting your activity on that site to your broader advertising profile through email-based identity resolution. LiveRamp, The Trade Desk’s Unified ID 2.0, and similar identity resolution services operate on this basis, creating persistent user identifiers based on hashed email addresses that function similarly to third-party cookies for advertisers who have access to authenticated user data. This approach is more privacy-protective than uncontrolled cookie tracking in that it requires explicit authentication, but it creates persistent tracking across sites based on the email address you’ve given various services.

Server-side tracking and conversion APIs move tracking from the browser to the server. Instead of loading a pixel or JavaScript tag in the browser (where it can be blocked by browser extensions and privacy settings), advertisers implement server-to-server calls that send conversion data directly from the advertiser’s server to the advertising platform’s API. Facebook’s Conversions API and Google’s Enhanced Conversions work this way. Because the data transfer happens server-to-server rather than through the browser, browser-based tracking blockers cannot intercept it. This makes server-side tracking more reliable for advertisers and harder for users to prevent.

Google’s Privacy Sandbox

Google’s Privacy Sandbox initiative attempts to replace third-party cookie functionality with privacy-preserving browser APIs that provide advertiser functionality without exposing individual user data. The Topics API (replacing the deprecated FLoC proposal) has the browser itself classify users into interest categories based on browsing history, and advertisers can request these interest categories without seeing the underlying browsing data. The Attribution Reporting API enables conversion measurement (tracking whether an ad led to a purchase) with privacy constraints on the precision of the reported data.

The Privacy Sandbox has been controversial precisely because it performs in-browser user classification for advertising purposes — moving the tracking partly into the browser itself rather than eliminating it. Critics argue this trades a distributed tracking ecosystem for one that entrenches Google’s platform control (the browser doing the tracking is Chrome, owned by Google). Proponents argue it’s a genuine privacy improvement over raw third-party cookie sharing. Both things are partially true, which is why the debates around Privacy Sandbox have been ongoing within the W3C and among privacy advocates.

What This Means for Privacy in Practice

The practical state of online advertising tracking after cookie deprecation: more fragmented (advertisers work harder across more signals rather than relying on one dominant mechanism), somewhat less precise for cross-site behavioral retargeting, but not absent. First-party data (what authenticated users have shared with sites directly), fingerprinting, server-side tracking, and platform-level identity (Google, Meta, Amazon, and Apple all have large authenticated user bases) provide substantial targeting and attribution capability without third-party cookies.

For users who want to reduce tracking: browser choice matters (Brave or Firefox with uBlock Origin provides substantially more protection than Chrome), avoiding signing into sites unnecessarily reduces first-party data linkage, and using a VPN or Tor for sensitive browsing reduces IP-based identification. No combination of these measures provides perfect privacy, because server-side tracking and platform-level identity resolution operate outside the browser’s privacy controls. The practical state is a spectrum between comprehensive tracking (Chrome, logged in everywhere, no extensions) and significantly-reduced tracking (privacy-focused browser, content blocker, VPN), not a binary between tracked and not tracked.