Third-Party Cookies in 2026: What E-Commerce Stores Need to Know

Are third-party cookies dead?

No. Chrome still allows third-party cookies by default, and it supplies 66.5% of page views worldwide. Safari blocks all of them, and Firefox confines each one to the site that created it. Together Safari and Firefox supplied 21.0% of page views worldwide and 33.7% in the United States in September 2026, according to StatCounter.

Many e-commerce brands waited for Google to deprecate third-party cookies in Chrome before acting. That never happened. Google kept the current approach in April 2025 and retired most of the Privacy Sandbox APIs in October 2025. The tracking stack still changed, but through other rules: browser limits on cookies that scripts write, ad blockers, and consent requirements.

For the measured numbers behind this article, see our third-party cookie statistics, which cites each source.

---

What are third-party cookies, and why did they matter?

A third-party cookie is a cookie set by a domain different from the one you are visiting. When you visit yourstore.com and Meta's pixel sets a cookie from facebook.com, that is a third-party cookie.

They supported three functions for e-commerce:

---

Timeline: how we got here

Every date is sourced in Sources and methodology of the statistics article.

---

The Privacy Sandbox: what happened

Google's Privacy Sandbox was meant to replace third-party cookies with browser APIs for ad targeting and measurement. In October 2025 Google decided, in light of low adoption, to retire:

• Topics (interest-based targeting), on Chrome and Android
• Protected Audience (auction-based retargeting), on Chrome and Android
• Attribution Reporting API (measurement without cookies), on Chrome and Android
• IP Protection, On-Device Personalization, Private Aggregation (including Shared Storage), Protected App Signals, Related Website Sets, SelectURL and the SDK Runtime

Google said it will keep supporting CHIPS (partitioned cookies) and FedCM (federated login), and will maintain Private State Tokens (fraud and abuse signals).

The practical conclusion is that no browser-led replacement is coming. Measurement for advertisers rests on first-party data, server-side delivery and consent.

---

What this means for e-commerce tracking

1. Safari shortens how long a click can be matched to a purchase

Safari goes further than third-party cookies. It deletes cookies written by JavaScript, and other script-writeable storage, after 7 days without user interaction with the site, and caps them at 1 day when a tracker-classified site sent the visitor to a URL with a query string or fragment.

If a visitor clicks your ad in Safari and buys more than a week later, a click ID stored only in a script-written cookie may be gone. A click ID that your own server saved at the first visit, or a match on a hashed email, can still attribute the order. The tables in the statistics article show how to estimate how many of your orders this could affect.

2. Retargeting audiences depend on what your own site sends

Pixel-based audiences used third-party cookies to recognise returning visitors (our tracking pixel guide covers how the pixel and the cookie work together). Where those cookies are blocked or partitioned, platforms rely on what your site and server send them, such as hashed email and click IDs. The result is that audiences built from pixel data alone skew toward browsers that still allow third-party cookies, mainly Chrome.

3. Your conversion data may have a gap, and only your own numbers show its size

Cookie rules, iOS app permissions and ad blockers each remove some signal. We could not find a verified figure for how much a typical store loses in total, and widely repeated ranges such as "15-30%" have no primary source.

To measure your own gap:

1. Export orders from your store for a fixed period.
2. Export conversions from each ad platform for the same period and attribution window.
3. Compare them by browser, device and campaign.

Our benchmark report explains why uplift and loss use different denominators, so a +25% uplift means the pixel missed 20% of conversions.

---

What replaces third-party cookies?

Three approaches work together.

1. First-party data

Data you collect directly from customers on your own domain:

• Email addresses and phone numbers, collected with consent
• Purchase history and browsing behaviour on your site
• First-party cookies. In Safari, script-written ones are capped at 7 days, while cookies your own server sets in an HTTP response are not named in those caps. A subdomain that points to a third party's hostname through a CNAME is capped.

Read our guide: First-Party Data Tracking: Why It Matters in 2026.

2. Server-side tracking

Instead of depending only on a pixel in the visitor's browser, server-side tracking sends conversion events from your server to ad platform APIs:

Because the event is sent from your server, an ad blocker or a browser cookie rule cannot block its delivery. The browser still has to give your server the click ID and customer details, so the server needs to capture them at the first visit. Platforms report gains on their own measures: 17.8% lower cost per result for Meta, 19% more events for TikTok and 8% incremental ROAS on Search for Google. An independent test of Google's enhanced conversions found +16% tracked conversions on average, ranging from -3% to +33%. The benchmark report lists each source and what it measures.

Read our guide: What is Server-Side Tracking?

3. Conversion modeling

Ad platforms estimate conversions they cannot observe:

• Google's consent mode models conversions for visitors who decline consent. Google Ads requires 700 ad clicks over a 7-day period per country and domain grouping before it models, and it publishes no fixed recovery rate.
• Modeled conversions are estimates, not measurements.

Modeling complements direct measurement. It does not replace it.

---

A practical playbook for e-commerce

Step 1: Measure your gap

Compare backend orders with each platform's reported conversions over the same period. If the platforms see materially fewer, you have signal to recover. If they see almost everything, other work comes first.

Step 2: Send conversions from the server

If there is a gap, deliver conversions from your server with the click ID and hashed customer details.

Options:

• Managed platform (fastest): SignalBridge server-side tracking with a 5-minute setup and no developer needed
• DIY: Deploy a server-side Google Tag Manager container, which requires developer resources
• Platform-native: Shopify's built-in CAPI, which is limited but free

Read our setup walkthrough: Set Up Server-Side Tracking in 5 Minutes.

Step 3: Build your first-party data strategy

• Collect email and phone at checkout, which you already do
• Store the click ID with the order at the first visit
• Hash customer data before sending it to ad platforms
• Build email and SMS lists as owned audience channels

Step 4: Pass consent choices to Google

If you serve visitors in the European Economic Area, consent mode v2 is how your banner passes their choices to Google tags. It does not make a site compliant on its own, because that depends on your banner and legal basis.

Step 5: Audit regularly

Browser updates change behaviour and tracking can break silently. Run a tracking audit quarterly.

---

Common misconceptions

"Google kept third-party cookies, so I'm fine"

Chrome allows them, but:

• Safari and Firefox together supplied 21.0% of page views worldwide and 33.7% in the United States
• Safari's 7-day cap on script-written cookies applies whether or not third-party cookies are involved
• Ad blockers can stop a pixel from loading at all. GWI's Q2 2025 survey found that 29.5% of internet users aged 16 and over use one at least some of the time (ad blocker statistics)

"I'll wait for a universal replacement"

Google retired most of the Privacy Sandbox APIs after low adoption, and we found no other proposal that is close to deployment. Plan around first-party data, server-side delivery and consent.

"Conversion modeling handles everything"

Models are estimates. Google Ads models only after an account reaches 700 ad clicks over a 7-day period per country and domain grouping, and Google says consented users are typically 2-5x more likely to convert than unconsented ones. A lower consent rate does not translate into an equal drop in conversions, and no model recovers every conversion.

"This only affects Safari users"

It reaches further. Different groups are affected by different rules:

• Safari and Firefox visitors, by cookie rules
• Visitors with an ad blocker, who may never load the pixel
• iOS app users who decline App Tracking Transparency, which governs apps. Adjust measured a 38% opt-in rate in Q1 2026, and App Tracking Transparency does not change how Safari treats cookies
• Visitors who decline consent in the EEA

---

FAQ

Are third-party cookies completely dead?

No. Chrome still allows them by default and has about two thirds of page views. Safari blocks them all and Firefox confines each one to the site that created it, so their usefulness for cross-site tracking depends on the browser.

What is the difference between first-party and third-party cookies?

A first-party cookie is set by the domain you are visiting, such as yourstore.com setting a cookie on yourstore.com. A third-party cookie is set by a different domain, such as facebook.com setting a cookie while you are on yourstore.com. All major browsers accept first-party cookies, but Safari deletes ones written by JavaScript after 7 days.

What are first-party cookies used for?

First-party cookies are the cookies your own domain sets, and they do the everyday work of a store: keeping a shopping cart, remembering a login, saving language and currency, and storing the click ID and campaign details from a visitor's first landing so the sale can be credited later. They still need consent when they are used for marketing rather than for something the visitor asked for. How long they last depends on who writes them: a cookie set by your server is treated differently from one written by a script, which is why a click ID saved only by JavaScript can disappear in Safari.

Does server-side tracking replace cookies entirely?

No, but it reduces the dependence on them. Your server can store the click ID and customer details when the visitor first arrives, then send them with the conversion. That matches the order even when a script-written cookie has expired.

How does this affect my Google Ads campaigns?

Enhanced conversions let Google match a conversion using hashed customer data, which reduces dependence on a click-ID cookie. Compare your backend orders with Google Ads conversions by browser to see whether Safari traffic is under-reported in your account.

What should I do first?

Measure your gap. Compare backend orders with ad platform conversions for the same period. If the platforms see materially fewer, add server-side delivery and send the click ID and hashed customer details with each conversion.

---

Sources

Figures and rules in this article come from StatCounter Global Stats (September 2026), WebKit's Tracking Prevention documentation, Google's Privacy Sandbox updates (October 17, 2025), Google Ads Help on consent mode modeling, Adjust's Mobile app trends: 2026 edition, and the sources listed in our ad blocker and benchmark reports.

Corrections and updates

• October 7, 2026: Rewritten. The earlier version said Safari and Firefox cover "roughly 35-40%" of web traffic, that 75-85% of iOS users opt out of tracking, that "15-25%" or "15-30%" of conversions are missing for most stores, that 37% of desktop users have an ad blocker, and that first-party cookies are not restricted by ITP. None of these could be traced to a primary source or they conflicted with WebKit's documentation, so we replaced them with sourced figures. The title changed from "The Death of Third-Party Cookies" because Chrome still allows them.