Marketing measurement without cookies: what survives

Key Takeaways

• • • Chrome did not remove third-party cookies, and Google retired its Privacy Sandbox attribution APIs in October 2025. Safari, Firefox, and iOS apps already restrict tracking.
    • Journey-level attribution survives where identifiers survive. It is thinnest where browsers and apps limit them.
    • Methods that use aggregated data survive by design: media mix models, geographic experiments, and modeled conversions.
    • Modeled conversions fill gaps but come with eligibility thresholds and cannot recover what was never observed.
    • For years the expectation was a single day when third-party cookies would disappear from Chrome, and that day did not arrive. Tracking limits arrived anyway, browser by browser and platform by platform. This post summarizes what changed, checked against the sources on 2026-09-18. It also describes what marketing measurement without cookies looks like in practice.

What changed, and when?

Two browsers and one mobile platform tightened tracking between 2020 and 2022, and Chrome chose a different path in 2025. The dates matter, because each change has shaped your data for years, whatever Chrome does next. The sequence runs as follows.

In March 2020, WebKit announced that cross-site cookies are blocked by default in Safari 13.1 and iOS 13.4 (WebKit blog). In April 2021, Apple released iOS 14.5 with App Tracking Transparency. Apps must now get permission before tracking a user across other companies' apps or websites (Apple Newsroom).

In June 2022, Mozilla made Total Cookie Protection the default for Firefox users, which confines each cookie to the site that set it (Mozilla Blog). Chrome then took a different course. On April 22, 2025, Google said it would maintain its current approach to third-party cookie choice. It would not roll out a new standalone prompt (Privacy Sandbox blog).

Dated changes to browser and app tracking. Each date comes from the publisher named in the Sources list.

Chrome's replacement for cookies was retired

Google retired most of the Privacy Sandbox technologies that were meant to replace third-party cookies. On October 17, 2025, it announced that the Attribution Reporting API, Topics and Protected Audience, among others, would be retired. Google cited ecosystem feedback and low levels of adoption.

The same announcement reaffirmed Google's approach to third-party cookie choice in Chrome. It also said Google would keep advancing an interoperable attribution standard through web standards bodies (Privacy Sandbox blog). I found no later Google announcement that changes this position when I checked on 2026-09-18.

The practical consequence is that journey data now depends on where a visitor's browser sits. A visit from Safari, from Firefox or from an iOS app faces limits that a visit from Chrome may not. Your journey table is therefore not one uniform sample of your customers, and the mix shifts with your audience.

Why does Safari's seven-day cap matter for attribution?

Safari deletes script-writable storage after seven days without a visit, which can cut a long lookback window short for those users. Journey attribution needs an identifier that persists across the touches in the lookback. When the identifier expires before the conversion, the earlier touches lose their link to the buyer.

WebKit's documentation says that Intelligent Tracking Prevention (ITP) deletes script-created cookies and other script-writeable storage after seven days without user interaction with the site. It also caps such cookies at 24 hours when it detects link decoration, meaning tracking parameters added to a landing page URL (WebKit).

A synthetic example: a 30-day lookback against a 7-day cap

Suppose a store records 10,000 conversions and uses a 30-day lookback. Each conversion has one ad touch that landed between 1 and 30 days before purchase. Assume that 35% of conversions come from Safari or iOS visitors whose identifier is written by script. These visitors do not return between touch and purchase. A conversion is unmatched when no touch links to it.

For those visitors, only a touch within 7 days of purchase survives, which is about 23% of touches. About 77% of their conversions therefore lose the link, and across all visitors roughly 27% of conversions are unmatched. The table shows one simulated run, and the script that produced it is in the repo at assets/scripts/cookie_lookback_example.py.

• Safari or iOS — Conversions: 3,597; Matched: 865; Unmatched: 2,732; Unmatched share: 76.0%
• Other browsers — Conversions: 6,403; Matched: 6,403; Unmatched: 0; Unmatched share: 0.0%
• Total — Conversions: 10,000; Matched: 7,268; Unmatched: 2,732; Unmatched share: 27.3%

One synthetic run with a fixed seed of 2026. Illustrative teaching data, not customer data. Real shares depend on your audience and on how often visitors return.

Nothing about buyer behavior changed in this example, and total revenue is identical. Only the link between touch and conversion was lost, which makes it a coverage problem and not a bias in either direction. The reconciliation post shows how to size that share against ledger revenue.

Which approaches to marketing measurement without cookies survive?

Methods built on aggregated data survive by design, because they do not follow individuals. Media mix models use weekly totals, geographic experiments compare regions, and modeled conversions estimate missing paths from observed patterns. Each has costs, and each answers a slightly different question than journey attribution.

Media mix models. Meta's Robyn guide notes that media mix modeling does not need user-level data and runs on aggregated data such as campaign-level figures. The same guide warns that granular data is not always available, and that over-granularity without enough variation and volume can add noise.

Geographic experiments. Google's Conversion Lift documentation describes a geography-based variant that creates test groups from aggregated geographical data (Google Ads Help). Randomizing places instead of people avoids user-level tracking altogether. The incrementality post explains what such a test can and cannot say.

Modeled conversions. Google's consent mode conversion modeling estimates likely outcomes for users who denied consent, using patterns from users who granted it. Google also states that it cannot observe whether an unconsented conversion previously had an ad interaction (Google Ads Help).

The limits of modeled data

Modeled data fills gaps with estimates, and it is published only when a model is confident enough. That is a sensible rule, but it means the model can be silent exactly when your data is thin. Read modeled numbers as estimates with conditions, not as observations you recovered.

Google's behavioral modeling for consent mode has explicit eligibility conditions. A property needs at least 1,000 events per day with analytics storage denied for at least seven days. It also needs at least 1,000 daily users with storage granted on at least seven of the previous 28 days. Google adds that meeting these prerequisites does not guarantee eligibility (Google Analytics Help).

Those thresholds are Google's, and they illustrate a general point. A model of missing data needs enough observed data to learn from. Smaller sites can fall below the line, and the gap then stays a gap. Apply the same caution to any modeled figure by asking what it needs and what happens when it lacks it.

Five checks for this quarter

Five checks tell you how much of your data survives, and each uses figures you already hold. They show which of your numbers describe observed journeys and which rest on modeling.

1. Compare your lookback window with browser storage limits. A lookback longer than a browser's limit means some history was never linkable.
2. Look at the share of visits by browser and app. A large Safari or iOS share means more unmatched conversions.
3. Track the unmatched share of conversions each period, and record it beside the credit table.
4. Read your consent rate. A low consent rate means more of your numbers are modeled.
5. Pick one decision worth an experiment, since a test does not depend on identifiers.

Then decide where to spend effort. Attribution remains useful for describing journeys you can see. For the budget split across channels, a media mix model does not depend on identifiers, and for cause, an experiment is stronger. The pillar page shows how to combine them, and Attribution models compared: six rules, one journey covers the credit rules themselves.

Frequently asked questions

Did Chrome remove third-party cookies?

No. In April 2025 Google said it would maintain its current approach to third-party cookie choice in Chrome and would not add a standalone prompt. In October 2025 it retired several Privacy Sandbox technologies, including the Attribution Reporting API. Safari and Firefox already block cross-site cookies by default.

Does attribution still work without third-party cookies?

Partly. Attribution works on journeys where an identifier persists across touches, such as consented first-party visits. Coverage falls where browsers and apps limit storage or tracking. Report the matched and unmatched shares to show how much of the picture the credit table covers.

Is a media mix model immune to privacy changes?

It is less exposed, since it runs on aggregated data instead of user-level identifiers. Robyn's guide says media mix modeling does not need user-level data. It still depends on enough weeks of data and enough variation in spend, so it has limits of its own.

What is modeled conversion data?

Modeled conversion data is an estimate of conversions that could not be observed directly, built from patterns among users who could be observed. Google uses it for users who decline consent. Availability depends on eligibility thresholds, and modeled counts should be labeled as estimates, not observations.

Sources

• WebKit, "Tracking Prevention"
• WebKit Blog, "Full Third-Party Cookie Blocking and More"
• Apple Newsroom, iOS 14.5 release announcement
• Mozilla Blog, "Firefox rolls out Total Cookie Protection by default to all users worldwide"
• Google Privacy Sandbox blog, "Next steps for Privacy Sandbox and tracking protections in Chrome"
• Google Privacy Sandbox blog, "Update on plans for Privacy Sandbox technologies"
• Google Analytics Help, "Behavioral modeling for consent mode"
• Google Ads Help, "About consent mode modeling"
• Meta, "Analyst's guide to MMM," Robyn documentation
• Google Ads Help, "About Conversion Lift"