In recent years, everyone in the business has heard that Third-Party Cookies are going away, and the cookieless future is right upon us.
Safari and Firefox already block Third-Party Cookies by default.
In early 2020, Google announced that it would join Safari and Firefox in blocking Third-Party Cookies in its Chrome and replace cookies with the Privacy Sandbox initiative which aims to improve user privacy on the web. Initially, it was intended to remove Third-Party Cookies in Chrome by 2022. Google's Cookie Deprecation Plan was postponed several times before Google decided to drop the plan. After years of development, testing, and feedback, Google officially abandoned its cookie deprecation plan in 2024.
This article explains what the current situation with third-party cookies in 2026 is, is Google still uses third-party cookies on Chrome, what is the new future of cookies, and what to expect from it.
Not sure if your website uses cookies? Scan your website for free and see what cookies, including Third-Party Cookies, your website uses:
Key Takeaways:
- In 2026, cookies aren't dying, but consent is becoming the only way to keep them alive.
- Cookie deprecation reduces risk, but it does not eliminate responsibility.
- The marketing industry has moved away from the cookieless future toward a hybrid reality with user choice as a basis for cookie activation or blocking.
- Regulators are less interested in whether a browser blocks cookies and more focused on whether websites respect user consent choices before setting cookies.
- A Consent Management Platform (CMP) like Cookie Script is necessary for proper cookie management in ever-changing privacy laws and websites’ privacy settings.
The Future of Third-Party Cookies: User Choice vs. Deprecation
Third-party cookies are small, encrypted files that track a website user's movement from website to website, collect the user data, and make the user profile for making analytics, providing data for marketing platforms, social media integration, and ad optimization purposes. Such tracking across the internet is also called cross-website tracking that later determines what your specific interests are.
Cookies are stored by the user's browser.
The problem for website users is that third-party cookies collect personal data, such as IP addresses, details about devices, emails, addresses, private information about health, sexuality, family, religious beliefs, and much more. Moreover, these cookies also collect sensitive information such as Google searches in the last five years, your profile on dating and similar apps, your credit card transactions, and so on. When combined, this data could be used to create a very detailed user profile and even for predicting user behavior.
User privacy concerns led to the creation of digital privacy laws worldwide. The General Data Protection Regulation (GDPR) is the first and strictest privacy law in the world. The GDPR took effect on May 25, 2018, and aims to protect the personal data of users in the European Union.
California Consumer Privacy Act (CCPA) was the first data privacy law in the US, which took effect on January 1, 2020. It was followed by the Virginia Consumer Data Protection Act (VCDPA), which went into effect on January 1, 2023; the Colorado Privacy Act (CPA), which went into effect on July 1, 2023; and others.
For years, everyone talked about the deprecation of third-party cookies. Browsers announced timelines for removing cookies. Marketers were preparing for a cookieless future.
In 2026, the situation with third-party cookies is different. The industry has moved away from the cookieless future toward a hybrid reality with user choice as a basis for cookie activation or blocking.
Instead of blocking cookies by default, Google decided to keep cookies active but introduced a "User Choice" experience. Users are now given clearer, more persistent controls to opt out of tracking, rather than the browser making the choice for them.
Third-Party Cookies in 2026: Cookie Deprecation or User Control?
By 2026, the debate around third-party cookies is no longer about if they will disappear, but how much control users will actually have while they still exist.
Cookie deprecation has progressed but not uniformly.
Safari (Apple) and Firefox (Mozilla) have already deprecated third-party cookies by default. This means roughly 50% of the web is already cookieless.
On Google’s Chrome browser, third-party cookies exist in a strange in-between state.
Third-party cookies are already blocked by default in Chrome’s Incognito mode.
Some users have blocked third-party cookies entirely, while others still allow them, often without realizing it. So, Google relies on user control instead of deprecating all cookies by default.
In 2026, regulators are less interested in whether a browser blocks cookies and more focused on whether websites respect user consent choices before setting cookies on users’ devices. Automatic blocking may reduce exposure, but it does not replace consent.
The real question is no longer “Are third-party cookies deprecated?” They are not. The question is “Who decides when they are used?”
When cookies are controlled by browsers, the result is a fragmented technical landscape where cookies may track but fail silently for another. It depends on the browser. When cookies are controlled by consent, users are actively empowered, making the choice over cookies.
Users expect:
- Transparency about the collected data.
- A real choice to accept or reject cookies.
- Their choice to be respected consistently.
In conclusion, third-party cookies in 2026 still exist but only in cases when users give explicit Cookie Consent, that is recorded and respected.
Cookies Aren’t Disappearing — They’re Being Redefined
Cookies aren’t vanishing — they’re being used differently.
The redefinition of the cookie use is important:
- When browsers block cookies automatically, they do it to protect user privacy.
- When websites ask for consent, they do it to protect privacy rights.
First-party cookies remain essential for core site functionality. They keep you logged in, remember your shopping cart, and allow other core functions to be performed. In 2026, they are considered essential cookies and are rarely blocked.
Third-party cookies still work when users consent. In many cases, they are no longer used as individual IDs and don’t reveal so much information. Instead, they are often passed through Privacy Sandbox APIs or used as aggregated data in probabilistic modeling.
In 2026, Chrome usually prompts users with a high-level "Privacy Choice," where users can make decisions on cookie usage. So, third-party cookies have now become an opt-in rather than an opt-out choice. Most users choose to block tracking. As a result, while third-party cookies still exist in the browser code, they only function for a small, consented portion of your audience, so you can’t rely only on them.
Third-party cookies still serve legitimate, consent-based purposes for some audience- they are not disappearing. What’s disappearing is the belief that they can operate quietly in the background without user awareness.
Cookie Deprecation Explained: Why User Choice Still Matters
A common misunderstanding about user consent is: ”If browsers block third-party cookies, consent doesn’t matter anymore”.
That’s simply not true.
You should distinguish between technical and legal use of cookies. Browser behavior is inconsistent by design. It varies by user, device, region, mode, and update cycle. Technically, website users could have a wide spectrum of implemented cookies.
Consent laws, on the other hand, are strict. They require explicit consent to use cookies. Non-essential cookies require informed, explicit, and prior user consent, regardless of users’ browser privacy settings.
Cookie deprecation reduces risk, but it does not eliminate responsibility.
In fact, relying on browser blocking instead of consent introduces a new problem: loss of control. Strict privacy laws still apply, but websites no longer know what’s running, what’s blocked, or whether user preferences are respected consistently.
Are Cookies Really Going Away? User Choice vs. Browser Policies
So, are cookies really going away?
Not entirely. User choice becomes more important than browser policies. Automatic cookie blocking is blunt: technologies are evolving, and browsers are changing.
On the other hand, consent is precise, and user choice remains the constant— legally, ethically, and practically.
Life after third-party cookies is consent-first.
Instead of assuming access to user data or automatically blocking cookies, modern websites are expected to:
- Ask clearly for user consent.
- Act conditionally, which types of cookies users allow.
- Respect decisions across sessions and systems.
Consent isn’t a solution for cookie deprecation— it’s the foundation that still works with or without cookies. If your business cares about legal compliance and user trust, you must rely on user choice, not browser defaults.
How to Prepare for the New Future of Cookies?
To prepare for cookie deprecation and a cookieless future with no fear about your business, here are five points you should look at:
1. Identify cookies
Firstly, you should identify what kind of cookies your website is using to take further steps. If you are unsure whether they are first or third-party cookies, there are tools to use and find out. Try CookieScript’s unique CookieScanner that will scan your website and provide a cookie declaration after the process is done. Enter your website address below.
2. Identify tools to replace cookies
Since you have identified what cookies your website is using, you can choose a tool or a provider to work with. If you want a GDPR-compliant and safe cookie manager, try CookieScript – a consent management platform that ensures safe cookie usage and allows users to opt out of tracking at any time.
3. Ensure compliance
After choosing your cookie manager to work with and if you are using First-party cookies, ensure that you comply with the latest privacy laws around the world, such as the GDPR and CCPA. Make sure your users can feel safe and their data is used for the right purposes that are stated in these laws.
4. Integrate consent
Before collecting data from your users, you need to gain consent to do so. It is not GDPR-compliant to track user information without notifying them and getting permission to collect data. Users also must have the opportunity to opt out of tracking if they do not want to share their information.
5. Give customers opportunity to make choices
Finally, users also should have the opportunity to select what first-party cookies should be released once they visit your website. strictly necessary cookies are impossible to opt-out of, but other types of trackers are not and users must be able to choose only those that they are comfortable with.
Is There a Need for CookieScript CMP as Third-Party Cookies are Going Away?
Life after third-party cookies is based on consent instead of automatic blocking of third-party cookies. You need to provide a Cookie Banner, inform users about your Personal Information collection practices, and obtain user consent.
This could be done using a Consent Management Platform (CMP) like CookieScript.
CookieScript CMP manages user consent for personal data processing, including third-party cookies as well as other website tracking technologies. Even if technologies change, consent to collect and process personal data will still be required.
If any personal data is collected via trust tokens, this means that according to the majority of data privacy laws in the world, businesses would still need to get the explicit consent before using them on your website.
Google introduced Google Consent Mode v2, which required websites that want to use Google products to implement a Google-certified CMP that delivers user choices over cookies to Google.
In addition, privacy laws evolve, browsers and technologies are also changing. You can’t check and control everything in real time manually. That’s why you need an automatic solution for the management of Cookie Consent that checks updates for privacy laws, websites’ settings, and requirements for third parties, such as Google or Meta.
Just look at some other automatic features of CookieScript:
- Google-certified CMP — CookieScript is a Google CMP partner, recommended by Google for the implementation of Google Consent Mode and Google Tag Manager.
- Google Consent Mode v2 integration — allows tags like GA4, Ads, and Floodlight adjust automatically to each user’s consent status while preserving event modeling for accurate performance reporting.
- IAB TCF 2.2 integration — implement IAB TCF v2.2, technical standard for publishers and ad tech vendors to manage user consent for data processing, ensuring compliance with GDPR.
- Geo-targeting — automatically show the right banner, in the right format, for each region. GDPR in the EU, CCPA in California, LGPD in Brazil — all localized and ready.
- Privacy Policy generator — connected to your scan results, so disclosures stay aligned with your actual data use as new cookies or vendors appear.
- Monthly scans and advanced reports powered by CookieScript’s cookie scanner — automated sweeps that detect new cookies, scripts, or third-party tools added by plugins. Reports track consent rates, banner performance, and compliance changes over time.
- Automatic blocking for third-party scripts — analytics and marketing tags stay paused until valid consent is received. You don’t need to track down rogue pixels or rewrite snippets manually.
- Banner sharing and self-hosted code — one setup that works across multiple sites or clients, with the option to host it yourself for full control and faster load times.
- Consent logs — detailed, exportable records showing who gave consent, when, and for which purposes. They’re your evidence if an auditor or DPA ever asks for proof.
- Available in 40+ languages — a Cookie Banner and a Cookie Policy are translated by professional translators into 40+ languages.
Register with CookieScript today.
Frequently Asked Questions
Are cookies going away?
As of 2026, first-party cookies are not going anywhere; they are actually becoming more important as companies rely on them to build direct relationships with their customers and collect data. Third-party cookies are still alive, but their significance is fading. In 2026, Chrome does not block third-party cookies by default. Instead, it presents users with a "Privacy Choice" prompt, so users decide whether to allow or block them. If a user chooses "Enhanced Privacy," third-party cookies are blocked. Use CookieScript CMP to deliver cookie banner, obtain cookie consent, and manage cookies automatically.
Does Chrome block third-party cookies by default?
No, Chrome does not block third-party cookies by default. After years of Google promising to remove cookies from Chrome, the strategy shifted from deprecation of cookies to user choice. Google presents users with a "Privacy Choice" prompt, so users decide whether to allow or block them. If a user chooses "Enhanced Privacy," third-party cookies are blocked. Use CookieScript CMP to deliver cookie banner and obtain and store cookie consent automatically.
What are Google cookies?
Cookies are small, encrypted files, stored on your browser, that track a website user's movement from website to website. They help that website remember your visit information, username, language settings, and other preferences, which increases your browsing experience. Google uses its cookies to remember user settings, for session management, optimization, analytics, advertising, and other reasons.
Does my website use third-party cookies?
If your website uses use any kind of analytical or marketing platform or social media integration, such as Google, YouTube, Facebook, or LinkedIn, third-party cookies will be present on your website. You can scan your website for free to see all cookies in use.
Are third-party cookies legal?
Third-party cookies collect personal data from website users. Most privacy laws, such as GDPR, CCPA, LGPD, and others require website owners to inform users of cookies, their provider, purpose, and duration, as well as to get explicit consen to use cookies prior to they are set. If you inform users about third-party cookies and obtain explicit consent to use them, then they are legal. Use CookieScript CMP to deliver cookie banner, obtain cookie consent, and manage cookies automatically.