For several years, businesses were told that third-party cookies were ending, that measurement as they knew it would break, and that they needed to prepare before a specific date.
A great deal of work was sold on that basis.
Google has since decided not to complete the deprecation. Chrome is maintaining its approach of offering users third-party cookie choice rather than rolling out the full removal previously planned [1][2].
So the deadline has gone. What has not gone is the set of problems the preparation was supposed to address, most of which were never really about cookies.
This article covers what actually changed, what was worth doing anyway, and what to do now that the urgency has been removed.
What Google actually decided
The reasoning Google gave is worth reading, because it explains why this is unlikely to reverse again soon.
As Google engaged with publishers, developers, regulators and the advertising industry, it remained clear that there were divergent perspectives on making changes that could affect the availability of third-party cookies. Alongside that, adoption of privacy-enhancing technologies had accelerated, new opportunities had emerged, and the regulatory picture globally had evolved considerably [1].
Instead of removal, Google proposed introducing a new experience in Chrome that lets people make an informed choice about third-party cookies, applying across their browsing [1]. It also indicated it would maintain the existing grace period at least until that experience is introduced [1].
The direction, in short, moved from unilateral removal to user choice.
Google has also signalled that its focus is shifting toward other privacy-enhancing technologies following that decision [2].
A short history, so the reversal makes sense
The sequence matters, because businesses that lived through it were told several different things by the same source.
Chrome announced an intention to phase out third-party cookie support and began developing replacement technologies under the Privacy Sandbox programme. Testing followed, including restricting third-party cookies for a small percentage of Chrome users to allow the industry to measure the effects.
The timeline then moved more than once. A phase-out originally signalled for one period was pushed to the next, then pushed again, with Google citing the need for regulators to review industry test results and the importance of resolving conflicting feedback from stakeholders.
Then came the decision described above: rather than completing the deprecation, Chrome would maintain its approach of offering users third-party cookie choice, with attention shifting toward other privacy-enhancing technologies [1][2].
Two things are worth taking from that history rather than from any single announcement within it.
First, the direction of travel was real even though the destination changed. Restrictions on cross-site tracking have tightened continuously across the industry for years, and Chrome's decision does not reverse anything that already happened elsewhere.
Second, anybody who sold you certainty about a date was selling something they did not have. That is worth remembering the next time a deadline-driven proposal arrives in this area, because the pattern is likely to repeat.
Why this does not mean nothing changed
Reading the reversal as a return to how things were in 2018 would be a mistake, for three reasons.
Other browsers were never waiting for Chrome. Safari and Firefox have restricted third-party cookies by default for years. A substantial share of your traffic has been outside cross-site tracking that entire time, and Chrome's decision does not change that at all.
That share matters more in some markets than others. Check yours rather than guessing. Look at your analytics by browser and work out what proportion arrives through browsers that already restrict. In markets with high iPhone penetration, which includes much of the UAE, that figure is frequently larger than marketers assume.
Users given a clear choice tend to exercise it. Chrome's stated direction is a prompt letting people decide across their browsing. Whatever the eventual design, a meaningful number of people will decline, which produces a gradual erosion rather than a cliff.
Regulation kept moving. Consent obligations, data protection law and platform requirements developed independently of any browser roadmap and continue to apply.
So the honest summary is that a deadline was removed, not that a trend reversed.
Get the distinction right first
A great deal of confusion in this area comes from conflating two different things.
A first-party cookie is set by the site you are actually visiting. It keeps you logged in, remembers your basket, holds your language preference. Nobody has proposed removing these.
A third-party cookie is set by a different domain embedded in the page, typically for advertising or cross-site measurement. This is what the entire debate has always been about.
Which leads to the question worth asking anybody who tells you your measurement is about to break: which mechanism specifically?
Because measuring what people do on your own website uses first-party cookies and has never been at risk. What is affected is recognising the same person across different sites, which means:
- Attribution across sites
- Retargeting audiences
- Frequency capping across properties
- View-through measurement
If your marketing depends heavily on those, you are exposed. If you acquire customers mainly through search, referral and repeat purchase, your exposure is modest and always was.
What was worth doing anyway
Nearly all the recommended preparation was worth doing on its own merits, which is the good news for anybody who invested in it.
First-party data is information customers give you directly: email addresses, purchase history, account activity, stated preferences, support interactions, loyalty membership. The practical test is whether you would still have it if every tracking mechanism vanished tomorrow.
Its value does not depend on any browser vendor's decision. It improves your marketing regardless of what tracking exists. And it is the one asset in this area you own rather than rent.
The businesses that struggle to build it are usually asking for an email address in exchange for nothing. Give people a reason that benefits them: order tracking, saved preferences, faster repeat checkout, service updates, email that is actually worth receiving.
A smaller tracking footprint is worth keeping for reasons unrelated to cookies. Fewer third-party scripts means a faster site, fewer vendors handling your customers' data, a simpler privacy disclosure, and less to maintain. A business that trimmed its tag stack in anticipation of deprecation should keep the trim rather than quietly restoring it.
Better consent handling remains a legal obligation in the places where it applies, independent of anything Chrome does.
Consent mode, and whether it applies to you
Google's consent mode adjusts how its tags behave according to users' consent decisions. It was updated with two additional parameters, and Google's guidance is that businesses already using it should upgrade to the newer version, and that those maintaining their own consent banner should implement it [3][4].
The requirement Google describes attaches to users in the European Economic Area, where consent must be collected for use of personal data and consent signals shared with Google in order to keep using applicable tags for measurement, ad personalisation and remarketing [5].
Note what that means for a UAE business: it depends on your traffic, not your registration. A Dubai company selling into Europe is squarely in scope. A Dubai company serving only the Gulf is not, for this particular requirement.
So check your analytics by country. Many UAE businesses have more European traffic than they assume, from residents, tourists and diaspora customers. If it is a meaningful share and you run advertising, this stops being abstract.
On banners generally: a copied European cookie banner frequently makes things worse rather than better in a UAE context. Our guide on cookie consent and privacy in the UAE covers which law actually applies to you and why the banner most UAE sites display blocks nothing and satisfies nobody.
Server-side tagging, honestly assessed
This gets recommended enthusiastically and suits fewer businesses than the enthusiasm suggests.
What it is. Moving measurement and advertising tags off the browser into a server container you control. Google describes it as helping protect customers by restricting access to their information, and helping increase conversion rates by reducing page load times [6]. Instead of a dozen third-party scripts running in your visitor's browser, one request goes to your server, which distributes onward.
Google also notes that server-side tagging can load client-side scripts through a first-party domain, making client-side measurement fully first-party [6].
The genuine benefits. Page speed, because third-party scripts leave the critical path and they are frequently heavy. Control, because you decide what data leaves and in what form rather than each vendor's tag deciding for itself. And durability, since data flowing through your own infrastructure is less exposed to browser restrictions on third-party requests.
The costs nobody mentions in the pitch. You are running server infrastructure that did not previously exist, with a monthly bill and a maintenance owner. Debugging is harder, because the data flow is no longer visible in browser developer tools. And it is genuinely easy to misconfigure in a way that sends more data than you intended.
Who it suits. Businesses with meaningful advertising spend, where measurement accuracy translates into money, or whose site performance is materially damaged by third-party scripts.
Who it does not. Most small businesses. If you are spending modestly on advertising, the same effort directed at collecting first-party data and fixing your site will return more. That is a less exciting answer than the industry usually gives.
One caution worth stating plainly: server-side tagging can improve privacy and does not do so automatically. It gives you the ability to filter and minimise what is sent onward. Implemented without that intent, it moves the same data through a different route while adding a layer of opacity, which is arguably worse than what it replaced.
The tools sold as cookie replacements
A category of product appeared during the deprecation scare, and it is worth knowing how to evaluate what remains of it now that the premise has weakened.
Identity resolution and matching services promise to recognise the same person across contexts using signals other than third-party cookies. Ask what those signals actually are, where the underlying data came from, and what your obligations become when you start processing it. Some of these products are legitimate; some involve data whose provenance you would rather not have to explain.
Conversion APIs and offline conversion uploads send data from your systems to advertising platforms directly rather than through the browser. These are genuinely useful, widely supported and worth implementing if you spend meaningfully on advertising. They also mean you are actively sending customer data to a platform, which is a decision to make deliberately rather than a technical detail to delegate.
Consent management platforms solve a real problem if you have obligations that require consent. They solve nothing if you do not, and a banner installed without understanding which law applies to you is decoration with a monthly fee attached.
Data clean rooms and similar arrangements are aimed at businesses operating at a scale where the overhead makes sense. For most companies reading this, they are not the answer to anything.
The general test for anything in this category is the same: what problem does this solve for us specifically, what would happen if we did nothing, and does the answer still hold now that the deadline has gone? A vendor who cannot answer the third question was selling the deadline.
Measuring marketing without the fiction
Here is the part that is uncomfortable and useful.
Cross-site attribution was never as accurate as the dashboards implied. It always involved substantial modelling and assumption, and the confident-looking numbers concealed that. What has changed over recent years is that the gap became visible.
Businesses that adjust to measuring directionally rather than precisely tend to make better decisions than those chasing a precision that was always partly fictional.
Four approaches that do not depend on cross-site tracking:
Total revenue against total spend, over a period. Crude, unarguable, and it captures everything including the effects nobody attributed.
Whether acquisition moves when spend moves. If you increase a channel by half and nothing changes in new customer numbers, that is information no attribution model will give you.
Post-purchase surveys asking how people heard about you. Deeply unfashionable and surprisingly informative, particularly for channels that attribution systematically undercounts.
Holdout tests. Turn a channel off for a defined period, or run it in some regions and not others, and compare. It is the only method that reliably separates incremental effect from correlation. It is also uncomfortable, because it means deliberately forgoing spend that may be working, which is why almost nobody does it and why the ones who do learn the most.
All of these are cruder per-touch and considerably more honest overall.
The underlying shift is to build reporting on the assumption of partial data, rather than treating gaps as errors to be engineered away. Any approach assuming complete visibility of every user across every site was already wrong before any of this started.
What to do now
Stop planning around a deadline that no longer exists. If you have a project justified primarily by the deprecation date, revisit whether it still earns its place on its own merits. Some will, some will not.
Audit what is actually running on your site. Open developer tools and watch the network requests, or list every tag in your tag manager. Most businesses find things they no longer use: a pixel from a campaign that ended, a heatmap tool from a redesign two years ago, an analytics platform replaced but never removed. Each costs speed and adds to your disclosure obligations.
Keep building first-party data. This is the recommendation that survives every change in this area, because its value does not depend on anybody else's decision.
Ask your agency what changes now. An agency that says nothing much changes, because they were always building first-party capability, is being straight with you. One that cannot explain what they were preparing for or why it still matters may have been selling urgency rather than strategy. That is a fair question to ask, and the answer tells you something.
Leave your data protection obligations exactly where they were. Your responsibilities under UAE law attach to your processing of personal data, not to the technical mechanism used to collect it. A browser vendor's decision changes nothing about consent, purpose or retention. Our guide on PDPL compliance covers that framework, and our guide on data retention covers how long to keep what you gather.
A decision framework, by business type
Rather than a general recommendation, here is roughly what different businesses should actually do, because the right answer varies enormously.
Ecommerce with substantial paid advertising. You are the most exposed and the most likely to benefit from real work. Prioritise first-party data capture at checkout and post-purchase, get consent handling right if you have European traffic, and evaluate server-side tagging seriously against your spend. Run at least one holdout test a year on your largest channel.
Ecommerce with modest advertising. Collect first-party data, remove unused tracking scripts, and largely stop worrying about the rest. Attribution precision matters less than repeat purchase rate, and the effort is better spent on the latter.
Services businesses acquiring through search and referral. Your exposure is low and always was. Make sure your own site analytics work, ask customers how they found you, and treat everything else in this article as background.
SaaS and subscription products. Your first-party data is unusually good, because customers have accounts and a continuing relationship. The opportunity is to use what you already hold rather than to chase cross-site signals you never depended on heavily.
Businesses selling into Europe from the UAE. Consent handling is your priority regardless of everything else, because the obligation attaches to your traffic rather than your registration and it has teeth.
Anybody currently mid-project on a cookie-driven initiative. Pause and re-justify it on its own merits. Some of those projects remain worth finishing. Some were only ever justified by a date that has since been withdrawn, and finishing them is sunk cost reasoning.
How much should you care?
In proportion to your advertising spend and your dependence on cross-site attribution.
A business spending substantially on performance advertising should care a great deal and probably already has somebody watching this closely.
A business acquiring customers mainly through search, referral and repeat purchase should read this once, remove the tracking scripts nobody uses, keep collecting first-party data deliberately, and then get on with something else entirely.
The genuinely useful move, for almost everybody, is the one that has nothing to do with cookies: collect more information that customers give you directly, in exchange for something they actually want. It is the only asset in this area whose value does not depend on decisions made by browser vendors, advertising platforms or regulators.
This week, two things. Check what share of your traffic already comes from browsers that restrict third-party cookies by default, which tells you how exposed you really are rather than how exposed you were told you would be. And list every tracking script on your site and remove the ones nobody uses.
Both take an afternoon and both improve your position regardless of what any browser decides next.
If you want the fuller version, a measurement and tracking review covering what is running on your site, what you actually depend on, where the real gaps are and what to change starts from around AED 2,500 with us. Server-side tagging implementation is priced separately by scope. Final pricing depends on scope, and these are our own figures rather than a market survey.
One last framing that helps. The question is not what replaces third-party cookies. It is what you would want to know about your marketing if no cross-site tracking existed at all, and how you would find that out. Answer that, and the browser roadmap becomes something you read about with mild interest rather than something you build quarterly plans around and revise every time somebody in Mountain View changes their mind.
References
- Privacy Sandbox, next steps for Privacy Sandbox and tracking protections in Chrome
- Privacy Sandbox, update on plans for Privacy Sandbox technologies
- Google for Developers, consent mode overview
- Google for Developers, set up consent mode on websites
- Google Ads Help, updates to consent mode for traffic in the European Economic Area
- Google, bring performance and privacy together with server-side tagging
- Google for Developers, implement consent mode with server-side Tag Manager
- SKIMBOX, cookie consent and privacy for UAE websites
- SKIMBOX, product analytics and event tracking
- SKIMBOX, PDPL compliance in the UAE
- SKIMBOX, data retention for a UAE business
Browser and platform policies in this area have changed repeatedly and may change again. Check the linked primary sources for the current position rather than relying on any article, this one included. This is not legal advice.
