Third-party cookies are going away in some web browsers, but the tracking they used to perform did not go away with them. It moved to methods that are harder for a visitor to see and harder to block. The story most people heard is that the third-party cookie is dead. The reality is more useful to understand. Apple Safari has blocked third-party cookies by default since 2020, and Mozilla Firefox has isolated them to the site that set them since 2022. Google Chrome, the browser most of the web runs on, took a different path: in October 2025 it retired most of its Privacy Sandbox project and chose to keep third-party cookies in place, behind user controls. The cookie did not disappear. What changed is that the advertising and analytics industry, expecting it to vanish, had already shifted its tracking to other techniques. Those techniques are the subject of this guide.
This guide explains how web tracking works after the third-party cookie, in plain terms, for the people who run a website rather than the people who build tracking systems. It maps the main methods in use today, what each one does, how visible each is to your visitors, and whether it still requires their consent. It is a guide to the mechanics. The legal questions, which laws apply and what your specific obligations are, sit with your data protection officer or legal counsel, and we treat them only at the level a non-specialist needs. Where a point turns on the law, we say so.
Key takeaways
- Third-party cookies are blocked by default in Safari and isolated to a single site in Firefox. Chrome kept them in October 2025, but tracking had already moved to other methods.
- The main methods that replaced or supplemented cookies are browser fingerprinting, server-side tracking, and first-party or "consented" data.
- Most of these methods still require consent. Consent attaches to the purpose of the tracking, not to the cookie as a technology.
- Fingerprinting and server-side tracking are harder for a visitor to see and to block than cookies ever were.
How web tracking worked: the cookie in one minute
A cookie is a small file a website stores in your browser so it can recognize you later. A first-party cookie is set by the site you are actually visiting. It is what keeps you logged in and remembers what is in your shopping cart. A third-party cookie is set by a different domain whose code runs on the page, usually an advertising or analytics company. Because the same advertising network appears on thousands of sites, its third-party cookie could follow one person from site to site and build a profile of what they read and bought.
That cross-site profiling is what browser makers moved against. Apple Safari has blocked third-party cookies by default since March 2020, building on the Intelligent Tracking Prevention work it started in 2017. Mozilla Firefox enabled Total Cookie Protection for all users in 2022, which isolates cookies to the site that set them. Google Chrome spent years promising to remove third-party cookies, then reversed course and, in October 2025, decided to keep them. First-party cookies were never the target and remain in normal use everywhere.
Where tracking went
Tracking did not wait for the cookie to disappear. As soon as the major browsers signaled that third-party cookies were unreliable, the advertising and analytics industry moved its measurement to methods that do not depend on them. Some of these methods are older than the cookie debate and simply grew in importance. Others were built specifically to survive in a world without third-party cookies. The table below maps the main ones: what each does, how easily a visitor can see or block it, and whether it still needs consent under European rules.
| Method | How it works | How visible and blockable | Needs consent to track? | Main trade-off |
|---|---|---|---|---|
| First-party cookies | Set by the site you are on, to remember your session and preferences | Visible in browser settings, easy to clear | Not for strictly necessary use, yes if used to track | Limited to one site, cannot follow you across the web |
| Third-party cookies | Set by another domain on the page to follow you across sites | Blocked by default in Safari, isolated per site in Firefox, clearable in Chrome | Yes | Increasingly unreliable as browsers block them |
| Browser fingerprinting | Combines small technical details of your device into a near-unique identifier | Mostly invisible, very hard to block | Yes | Identifies without storing anything, but degrades as browsers reveal less |
| Server-side tracking | Data is sent to third parties from the website's own server, not your browser | Invisible to the visitor, not stopped by browser settings or ad blockers | Yes | Changes where data is collected, not whether consent is required |
| Tracking pixels and web beacons | A tiny invisible image or script that reports when content is opened or viewed | Invisible, only partly blockable | Yes | Common in email and ads, ties activity to a profile |
| Identity graphs, CDPs, data clean rooms | Match first-party data across companies using shared identifiers such as hashed emails | Invisible to the visitor | Yes | Powerful matching, concentrates personal data |
| Operator and telco identity | A pseudonymous ID derived from your mobile operator's network connection, with consent, instead of from your browser | Shown through a consent banner, managed in a central operator hub | Yes, explicit opt-in | European and consent-first, but ties identity to your network connection |
| Contextual targeting | Shows ads based on the content of the page, not the person | Nothing to block, builds no personal profile | No personal data, so no tracking consent needed | Less precise than profiling, but privacy-friendly |
Fingerprinting: tracking without storing anything
Browser fingerprinting identifies a visitor without storing anything on their device. Instead of leaving a cookie, a script reads dozens of small technical details your browser reveals automatically: your screen size, time zone, language, operating system, the fonts you have installed, and the way your graphics hardware draws an image through features called canvas and WebGL. Individually, none of these details identifies you. Combined, they form a pattern that is often unique to your specific device.
How reliably this works in practice depends on how much a given site is allowed to read. The more details it collects, the rarer the resulting combination becomes, and the more confidently it can recognize the same device on a later visit or on another site. A rich enough fingerprint can pick one visitor out of a very large crowd without ever storing anything on their device.
Fingerprinting is hard to see and hard to escape. A cookie can be inspected, blocked, or deleted. A fingerprint is computed from information your browser has to share in order to display pages correctly, so there is no file to remove. Browser makers have responded by revealing less. Google Chrome has reduced the detail in the User-Agent string that browsers send, moving the more identifying parts behind a feature called Client Hints that sites have to request. Safari and Firefox apply their own anti-fingerprinting measures. The effect is to make fingerprinting harder and less stable, not to stop it.
Browsers are not the only force at work, and the advertising industry has been pushing in the opposite direction. In December 2024 Google reversed a position it had held for years and began permitting advertisers on its platforms to use fingerprinting, a change the United Kingdom's data protection regulator, the Information Commissioner's Office, publicly called irresponsible. The concrete step lands on August 3, 2026, when Google begins using the IP addresses it already receives to identify devices for ad measurement and personalization across the European Economic Area, the United Kingdom, and Switzerland, a purpose those addresses have not served before. An IP address joined to the passive signals a browser gives up is a serviceable fingerprint, and it persists after cookies are cleared. So even as browsers reveal less, the largest advertising platform on the web has arranged to read more.
Server-side tracking: moving collection out of view
In the older model, tracking happened in your browser. A tag from an analytics or advertising company loaded on the page and sent data directly from your device to that company. Server-side tracking changes the route. The website collects the data first, on its own server, and then forwards it to third parties from there. To your browser, it looks as though you are only talking to the website you chose to visit.
For the businesses that run it, server-side tracking has practical attractions. It is more reliable, because browser ad blockers and tracking protections cannot intercept a transfer that happens from one server to another. It can be faster, because fewer scripts run in the visitor's browser. And it gives the site more control over exactly what data leaves and where it goes.
The privacy question is the one that is easy to miss. Server-side tracking changes where data is collected, not whether the visitor agreed to it. If a site forwards a visitor's behavior to an advertising platform from its server, that is still tracking, and it still requires the same consent it would have required in the browser. What changes is that the visitor can no longer see it happening, and the usual browser defenses do not apply. The responsibility shifts almost entirely onto the website operator to be honest about what is collected and to ask for consent properly.
First-party and "consented" data
With third-party cookies unreliable, many companies have turned back to data they collect directly from their own customers: email addresses, purchase history, account activity, newsletter signups. This is often called first-party data, and it is presented as the privacy-friendly alternative. Collected and used honestly, with clear consent, it can be exactly that.
The complication appears when first-party data is used to track people across companies. Two businesses can match their customer lists by comparing hashed email addresses, a process that turns each address into a scrambled string. Hashing is sometimes described as making the data anonymous, but it does not. A hashed email still corresponds to one specific person, and matching it across companies rebuilds the cross-site profile that third-party cookies used to create. Customer data platforms and data clean rooms are the tools that perform this matching at scale.
The lesson is that "first-party" describes where data was collected, not how privately it is used. Data gathered with genuine consent, for a purpose the customer understood, stands on solid ground. The same data fed into a matching system the customer never heard of does not, whatever the first-party label suggests.
A newer European approach sidesteps the browser entirely, and to our mind it is the most troubling of the lot. Utiq, an identity service backed by major European telecom operators, derives a pseudonymous advertising identifier from a visitor's mobile network connection rather than from a cookie or a fingerprint. When you visit a participating site on a partner network and agree through Utiq's consent screen, your operator confirms your connection and hands back a stable identifier that advertisers can recognize across sites. The approach already has real scale behind it: Utiq reports reaching more than 55 million consented identifiers across Europe, over a third of mobile users in the markets where it operates, and in June 2026 the advertising platform The Trade Desk integrated it across the region. The company is careful to build the system around explicit consent and to offer a central place to withdraw, and that matters. But consent collected through one more banner, at the moment when people click mostly to make the banner go away, is a thin justification for what is happening underneath. Identification has moved from something stored on your device, which you can see and delete, to your network connection itself, which you cannot inspect, clear, or turn off without leaving the internet. That is a different kind of tracking, woven into the infrastructure rather than layered on top of it, and once identity lives there the idea of browsing privately starts to lose its meaning. However well-intentioned the consent design, we think this is a direction worth resisting, and the privacy advocates raising the alarm are right to.
Four myths worth retiring
"If we do not use cookies, we do not need consent". This is the most expensive misunderstanding. European rules attach consent to the act of tracking, not to the cookie as a technology. The European Data Protection Board confirmed this in its guidelines on the technical scope of the ePrivacy rules, adopted in 2024, which state that the consent requirement covers fingerprinting, tracking pixels, and similar techniques, not only cookies. France's data protection regulator, the CNIL, is explicit that a device fingerprint is a tracker requiring consent in the same way a cookie is.
"Fingerprinting is anonymous". A fingerprint contains no name, so it is tempting to treat it as anonymous. In practice it singles out one device with high reliability, which is the opposite of anonymous. Data that can consistently distinguish one person from everyone else is personal data, whatever it is built from.
"Third-party cookies are gone, so the problem is solved". Chrome kept third-party cookies, and the other browsers blocked them years ago. More to the point, the tracking those cookies performed continues through the methods above. Treating the cookie as the whole problem misses where tracking actually happens now.
"Server-side tracking is private by design". Moving collection to the server hides tracking from the visitor and from ad blockers, but it does not remove the duty to be transparent and to obtain consent. If anything it raises the bar, because the visitor has no way to see what is being collected.
What this means for your website
You do not need to become a privacy engineer to act sensibly here. A few principles cover most of the ground.
Know what your site actually runs. Most tracking arrives through tags, plugins, and marketing tools added over time, often by different people. The first step is a simple inventory: what loads on your pages, what data each tool collects, and where that data goes. You cannot govern what you have not listed.
Treat consent as a question of purpose, not technology. The test is not whether you use cookies but whether you are tracking people. If you are, you need their consent, whether the tracking runs through a cookie, a fingerprint, a pixel, or your own server. Designing consent around purposes rather than cookie types is both more honest and more durable.
Be transparent about server-side collection. If data leaves your server for a third party, your visitors cannot see it, so the duty to disclose it rests entirely with you. Anything you would have had to declare in the browser, you still have to declare from the server.
Know where the line into legal advice sits. Which laws apply to you, and exactly what they require, depends on where you operate and who your visitors are. Those are questions for a data protection officer or qualified counsel. This guide explains the mechanics so that conversation can start from a clear picture.
Frequently asked questions
Are third-party cookies actually gone?
Not entirely. Safari and Firefox have blocked them by default for years, but Chrome, which most of the web uses, decided in October 2025 to keep them behind user controls. More importantly, the tracking those cookies performed has largely moved to other methods, including fingerprinting and server-side tracking, so the cookie's status is no longer the whole story.
Do I still need a consent banner if I do not use cookies?
In most cases, yes. Under European rules, consent is required for tracking, not specifically for cookies. The European Data Protection Board and the CNIL both confirm that techniques such as fingerprinting and tracking pixels need consent in the same way cookies do. Removing cookies does not remove the obligation.
Is browser fingerprinting legal?
Fingerprinting is treated as a tracker under European rules, which means using it to track people generally requires their consent. Whether a particular use is lawful depends on the purpose and on the laws that apply to your business, which is a question for your data protection officer or legal counsel.
Is server-side tracking more private than browser tracking?
Not by itself. Server-side tracking changes where data is collected, moving it from the browser to the website's server, but it does not change whether consent is required. It also makes the tracking invisible to the visitor, which increases rather than reduces your responsibility to be transparent.
What should we do instead of third-party cookies?
Start by listing what your site already collects, then keep only what serves a clear purpose your visitors have agreed to. First-party data gathered with genuine consent, and contextual targeting, which shows ads based on page content rather than personal profiles, are the most privacy-friendly options. Match honest data collection with an honest consent request.
Tracking did not leave with the cookie
The end of the third-party cookie was never going to be the end of tracking. It was a prompt for the industry to move tracking to methods that are harder to see, which makes understanding them more important, not less. The practical goal for any business is not to track as much as the technology allows, but to collect what you genuinely need, with consent your visitors actually gave, through methods you can explain.
This affects how machines read your site as well as how people are tracked on it. We cover that side in Is your website ready for AI agents? If you want an independent review of what your website collects, how visitors are tracked on it, and whether your setup matches what you tell them, our consulting and advisory service is built for exactly that. To talk it through, contact us.
Keroberos is a web technology consultancy that advises businesses on platform selection, commissions and delivers WordPress and Drupal builds, and provides staff augmentation for development teams. To discuss your website's tracking and privacy setup, contact us.