Third-Party Cookie Statistics 2026: Browser Share, Blocking Rules and Tracking Impact

Are third-party cookies going away in 2026?

No. Chrome, which supplies two thirds of page views, still allows third-party cookies unless the user turns them off, and Google has said it will not change that. What did change is everything around them: Safari and Firefox block or partition third-party cookies by default, and Google retired most of the Privacy Sandbox APIs that were meant to replace them.

Every date below links to the publication it came from in Sources and methodology.

Timeline of browser cookie and tracking changes

Which browsers block third-party cookies by default?

Safari blocks all of them, Firefox confines each one to the site that created it, Edge blocks storage for trackers on its classification list, and Chrome allows them unless the user changes the setting.

Edge's Balanced level relaxes enforcement for sites a user engages with and for sites owned by the same organization, so its protection is narrower than Safari's blanket rule. We did not assess the defaults of the remaining browsers, so they are grouped separately below.

What share of web traffic comes from browsers that block third-party cookies?

About one in five page views worldwide (21.0%) and one in three in the United States (33.7%) come from Safari or Firefox, according to StatCounter's September 2026 data. Chrome supplies 66.5% worldwide and 53.9% in the United States.

Browser share of page views, September 2026

Share of page views by default cookie behaviour

Safari and Firefox together plus Edge account for 27.01% of worldwide page views and 41.20% of United States page views. Desktop and mobile differ sharply: on desktop, Safari and Firefox supply 14.15%, while on mobile they supply 25.27% because of Safari's 24.59%.

StatCounter measures page views from a sample of sites that use its tracking code, so these figures describe browsing behaviour in that sample, not every site. Your own analytics will differ if your audience is not typical, and the browser split of your own visitors is the number to plan around.

Is the share of cookie-blocking browsers growing?

Worldwide, yes: Safari and Firefox's combined share rose by 4.96 points in a year, from 16.03% to 20.99%. In the United States the same combination moved by only 0.89 points, from 32.79% to 33.68%.

StatCounter does not explain the worldwide shift, and we cannot either. Treat the direction as a signal and the size as uncertain: browser detection changes between years, and in the United States Brave was reported at 2.62% in September 2025 but did not appear among the top seven browsers in September 2026, which suggests a change in how some traffic is classified. The iOS operating system moved the same way worldwide, from 15.57% to 19.37% of page views, which is consistent with the Safari increase but comes from the same sample.

Does Safari limit first-party cookies as well?

Yes, when a script writes them. Safari's Intelligent Tracking Prevention (ITP) deletes cookies created in JavaScript, and other script-writeable storage, after seven days without user interaction with the site.

Home screen web apps are exempt from the 7-day cap. WebKit does not publish which domains ITP classifies as having cross-site tracking capabilities, so whether the 1-day rule applies to a particular ad click can only be found by testing in Safari.

WebKit's own table for the CNAME rule shows when the cap does not apply: a subdomain with no cloaking, or one that resolves to the same site, is not capped. A subdomain that points at a third party's hostname is.

Do Chrome and Firefox on an iPhone follow Safari's rules?

Mostly yes. Apple's App Review Guideline 2.5.6 requires apps that browse the web to use WebKit, and WebKit has enabled ITP by default in every web-rendering app since iOS 14.0, so Chrome, Firefox and Edge on iOS run under the same cookie and storage caps as Safari.

The guideline has one exception: Apple lets developers apply for an entitlement to use an alternative browser engine in the EU and Japan. Outside those regions, the rules in the previous section follow the operating system, not the browser name.

That matters for reading browser-share tables. StatCounter counts Chrome on iOS as Chrome, so the Safari figure understates the page views that run under ITP. The operating system view gives a second angle.

The two measures overlap and cannot be added: Safari includes desktop Safari on macOS, and iOS includes every browser on the iPhone. The practical reading is that ITP's reach is at least the larger of the two and is likely higher than either. In the United States, where iOS holds 53.5% of mobile page views, a majority of mobile visitors are under WebKit's rules.

What is the App Tracking Transparency opt-in rate?

Adjust measured a global opt-in rate of 38% in the first quarter of 2026, up from 35% a year earlier, among iOS users who permit tracking requests. For e-commerce and shopping apps the rate was 34%, down from 35%.

App Tracking Transparency (ATT) is a different mechanism from browser cookie rules. Apple's policy covers apps that track activity across other companies' apps and websites: the app must ask permission, and if the user declines it cannot read the advertising identifier or track the user with other identifying data such as an email address. It does not change how Safari handles cookies on a website.

Adjust sells mobile measurement, and its data covers apps that use its platform, so the rate describes that population. We did not find a primary source for the figure of "75-85% of iOS users opt out" that circulates in older articles, and AppsFlyer's competing figure is not available from a primary publication we could check.

How much click-ID cookie exposure might a store have?

A store's exposure is roughly the share of its visits that run under ITP multiplied by the share of those buyers who purchase after the cookie cap has expired. For a store whose visitors look like StatCounter's sample, that is between about 4% and 11% of orders worldwide and 6% to 18% in the United States under the scenarios below.

This table is a calculation with assumed inputs, not a measurement. The Safari share is the observed value from above; the late-purchase share is an assumption you should replace with your own number.

Here, "late" means the order is placed after the cap that applies. After one day if a tracked link set a one-day cap, after seven days otherwise. Google Ads' default click-through conversion window is 30 days, and Meta's Ads Manager can compare click windows of 1, 7 and 28 days, so the browser's storage limit is shorter than the windows the platforms offer.

Four caveats keep this honest:

1. It counts orders that can lose a click ID stored only in a script-written cookie, not orders that are lost. A server that stored the click ID at the first visit, or a match on a hashed email, can still attribute the order.
2. Safari visitors are assumed to buy and delay at the same rate as everyone else. That is unlikely to be exactly true.
3. The Safari share understates iOS exposure, as explained above, and ignores that some Safari visits are never ad clicks.
4. The 1-day cap depends on ITP's private classification of the referring domain.

The reliable number is your own: compare the share of orders with a stored click ID in Safari against other browsers over the same period.

What replaces third-party cookies for ad measurement?

No browser-wide replacement shipped. Google's October 2025 announcement retired the Attribution Reporting API and the other advertising APIs because of low adoption, and said it will work on an interoperable attribution standard through the W3C instead.

In practice advertisers measure with first-party identifiers they collect themselves and send the conversion from their own server to the ad platform. A few points from the sources above affect how well that works:

1. A first-party cookie that a script writes is subject to Safari's caps. A cookie set in an HTTP response by your own server on your own site is not named in those caps.
2. A subdomain that resolves through a third party's hostname can be treated as cloaking. Test the lifetime of any cookie you set from a custom domain in Safari instead of assuming it lasts for years.
3. Server-side delivery removes the browser from the path for the conversion event, but the event still needs an identifier that the ad platform can match.

For the mechanics, see our guides to server-side tracking, first-party data tracking and fixing iOS tracking, and the server-side tracking benchmark report for published uplift figures and how much weight each deserves. Ad blockers add another layer of loss; our ad blocker statistics cover that. SignalBridge is built to send these server-side conversions.

Frequently Asked Questions

Is Chrome blocking third-party cookies?

No, not by default. Google said in April 2025 that Chrome will keep offering users a choice in its settings and will not add a standalone prompt, and Incognito mode already blocks third-party cookies by default.

What percentage of web traffic blocks third-party cookies?

About 21% worldwide and 34% in the United States come from Safari or Firefox, which block or partition third-party cookies by default (StatCounter, September 2026). Including Edge's default tracker blocking raises that to 27% worldwide and 41% in the United States.

Does Safari delete cookies after 7 days?

Safari deletes cookies created in JavaScript, and other script-writeable storage, after seven days without user interaction with the site. It caps them at one day when a tracker-classified site sends the visitor to a URL with a query string or fragment. Cookies set by your own server in an HTTP response are not covered by that rule.

Do Chrome and Firefox on iPhone follow Safari's tracking rules?

Yes, outside the EU and Japan. Apple requires browsers on iOS to use WebKit, and WebKit has enabled its tracking prevention by default in web-rendering apps since iOS 14.0.

Does a first-party subdomain avoid Safari's 7-day cap?

Not always. WebKit caps cookies set in HTTP responses at 7 days when the subdomain resolves through a CNAME that belongs to a third party, so a subdomain pointed at a vendor's hostname can still be capped. Test the cookie lifetime in Safari for your own setup.

What is the App Tracking Transparency opt-in rate?

Adjust's Q1 2026 figure is 38% globally, up from 35% in Q1 2025, and 34% for e-commerce and shopping apps. It measures app permission among iOS users who permit tracking requests, not browser cookie settings.

Sources and methodology

Primary sources

• StatCounter Global Stats, browser market share (worldwide, September 2026): all-platform shares, and the September 2025 comparison month.
• StatCounter, browser market share in the United States: US shares for September 2026 and September 2025.
• StatCounter, desktop browser market share and mobile browser market share: platform splits.
• StatCounter, operating system market share: iOS share worldwide, plus the United States and US mobile views.
• WebKit, Tracking Prevention in WebKit: current behaviour of third-party cookie blocking, the 7-day and 1-day caps and the CNAME rule.
• WebKit, Full Third-Party Cookie Blocking and More (March 24, 2020): full blocking, 7-day cap on script-writeable storage and the February 2019 cookie cap.
• WebKit, Intelligent Tracking Prevention 2.2 (April 24, 2019): the 1-day cap after link decoration.
• WebKit, CNAME Cloaking and Bounce Tracking Defense (November 12, 2020): the CNAME rule and its table.
• WebKit, App-Bound Domains: ITP enabled by default in every web-rendering app from iOS 14.0.
• WebKit, WebKit Features in Safari 17.0: tracking parameter blocking in Private Browsing.
• Apple, App Review Guidelines (2.5.6): browsers must use WebKit, with alternative-engine entitlements for the EU and Japan.
• Apple Support, If an app asks to track your activity: scope and effect of App Tracking Transparency.
• Adjust, Mobile app trends: 2026 edition and its press release (February 18, 2026): ATT opt-in rates.
• Google, Next steps for Privacy Sandbox and tracking protections in Chrome (April 22, 2025) and Update on plans for Privacy Sandbox technologies (October 17, 2025): Chrome's cookie policy and the retired APIs.
• Mozilla, Firefox rolls out Total Cookie Protection by default (June 14, 2022): Firefox behaviour and dates.
• Microsoft, Tracking prevention in Microsoft Edge: the Balanced default and what it blocks.
• Google Ads Help, About conversion windows: 30-day default click-through window.
• Meta Business Help Center, Compare attribution settings in Ads Manager: 1-day, 7-day and 28-day click windows.

How we calculated the figures

• StatCounter shares were downloaded as published CSV exports for September 2026 and September 2025 and are quoted to the two decimals StatCounter provides. Group totals add the published values, so "all other browsers" is 100 minus the four named browsers.
• Safari plus Firefox is the sum of their shares. The three-browser total adds Edge. Changes are differences in percentage points.
• The exposure table multiplies a Safari share by an assumed late-purchase share. It uses no other data.
• ITP behaviour was read from WebKit's current documentation and the dated posts that introduced each rule. Browser behaviour changes with releases, so re-check the WebKit page before relying on a rule.

Limitations

• StatCounter reports page views from sites that use its code. It is a sample, its year-over-year movements can reflect changes in detection, and it is not a census of web traffic.
• We assessed the default behaviour of Safari, Firefox, Edge and Chrome only. Samsung Internet, Opera, UC Browser, Brave and other browsers are shown as not assessed, not as allowing third-party cookies.
• No browser vendor publishes the share of Chrome users who have blocked third-party cookies, so we do not estimate it.
• ATT opt-in is a vendor measurement among apps that use Adjust and says nothing about browser behaviour.
• WebKit does not publish ITP's classification list, so we cannot say which ad domains trigger the 1-day cap.

Corrections and updates

• October 7, 2026: First publication. Our earlier article on third-party cookies in e-commerce said Safari and Firefox cover "roughly 35-40%" of web traffic and that 75-85% of iOS users opt out of tracking. The measured share is 21.0% worldwide and 33.7% in the United States, the opt-in rate is 38% according to Adjust, and that article has been corrected to match.