Display advertising after third-party cookies

For years, display planning assumed Chrome would kill the third-party cookie. Then 2025 delivered two reversals that make the panic look misplaced, and point to a sturdier way to run display.

What actually happened in 2025?

In April 2025, Google confirmed it would keep its current approach to third-party cookies in Chrome, with no new standalone choice prompt. Then in October 2025 it announced it was discontinuing most Privacy Sandbox advertising APIs, including Topics and the Protected Audience API, citing low adoption. Two pillars of the last five years of planning, cookie deprecation and the Sandbox replacement, both fell away inside six months.

What it means for display

The honest read: chasing the browser roadmap was the wrong fixation. Third-party cookies still work today, but they are a weakening signal that no single announcement will fully settle. Building a campaign that depends on them, or on a Sandbox API that no longer exists, is fragile either way.

Does retargeting still work?

Yes, and it still beats prospecting. Retargeting click-through sits near 0.7% versus 0.05%–0.1% for cold display. The durable version leans on first-party data, private marketplace deals and contextual targeting, so it survives whatever the platforms decide next. We rebuilt exactly this kind of setup in our B2B SaaS CPA case study.

Why did Google reverse course?

Two forces met in the middle. Adoption of the Sandbox APIs stayed low because they were complex and gave buyers less precision than the cookies they were meant to replace, so few teams moved budget onto them. At the same time, regulators worried that removing cookies would hand Google's own logged-in data an even bigger advantage. When the UK competition regulator released Google from its Privacy Sandbox commitments in October 2025, the original plan no longer had a forcing function. The takeaway for advertisers is steadiness: do not rebuild your strategy around the next browser headline, because the last two went nowhere.

What replaced the Privacy Sandbox?

Not much, and that is the point. Google kept a handful of narrow privacy primitives rather than a full cookie replacement. CHIPS (partitioned cookies) lets a site keep cookies scoped to a single top-level site for things like embedded widgets. FedCM handles federated sign-in without third-party cookies. Private State Tokens carry anti-fraud signals between sites without identifying anyone. None of these rebuilds cross-site advertising audiences, so the targeting that depended on Topics or the Protected Audience API now has no sanctioned successor inside Chrome.

First-party data is the foundation

The asset that survives every browser decision is data you collect with consent: purchases, trial signups, newsletter subscribers and CRM records. Start by making sure events are captured server-side where possible, tie them to a consented identifier, and feed them into your DSP as audiences. In Spain and the wider EU that collection runs under GDPR and the AEPD cookie guidance, so a compliant consent layer is part of the foundation, not an afterthought. Even a modest first-party audience usually outperforms broad third-party segments on both cost per acquisition and view-through.

Contextual targeting is useful again

Placing ads against the content of a page, rather than a profile of the person reading it, never needed a cookie. Modern contextual tools read the page in real time and match inventory to intent, which makes them a natural fit for travel, retail and finance campaigns. Paired with private marketplace deals on publishers you trust, contextual buying recovers much of the precision people feared they would lose, without the identifier risk.

Measurement has to change too

As identifiers fade, last-click attribution becomes even more misleading for display. Lean on view-through conversions, geo holdout tests and incrementality rather than crediting only the final click. That is the measurement approach behind our programmatic media work, and it is what keeps display honest when the tracking gets noisier.

What to do now

• Own your data. A first-party data foundation built on purchases, trials and CRM outlasts every cookie debate.
• Buy better inventory. Private marketplace and contextual deals reduce dependence on third-party identifiers.
• Measure on outcomes. View-through conversions and cost per acquisition, not last-click.
• Keep creative strong. When targeting signals get noisier, the banner does more of the work.

That is the whole strategy, and it is what our programmatic media service is built around. If you want a read on how exposed your current setup is, the free audit covers it.