Skip to content
Deepak Gupta markTech Graveyard

Tech Graveyard/consumer

Third-Party Cookies (1994 to 2025)

Lou Montulli invented the cookie at Netscape in 1994 to keep shopping carts working. He did not intend to power a $400 billion ad surveillance industry.

Born 1994 · Died 2025 · Status: dying

Certificate of Death

Name of decedent

Third-Party Cookies

Born
1994
Died
2025
Age
31

Cause of death

Safari ITP (2017), Firefox ETP (2019), Chrome compliance (2024), regulatory pressure

Survived by

First-party data, server-side attribution, privacy-preserving APIs, contextual advertising

Invented by

Lou Montulli at Netscape

Status: DyingFinal breath: 2026

Filed by D. Gupta · guptadeepak.com

The hook

Apple killed third-party cookies in 2017. The ad industry insisted it would adapt. By 2025, ad-tech vendors are still adapting, mostly badly.

Thesis. The death of third-party cookies is not a technology change. It is a privacy regime change. The technology was already obsolete by 2020.

The story

The origin

Lou Montulli at Netscape, 1994. A small piece of state to make shopping carts work across page loads. Never designed for cross-site tracking. The browser security model that allowed third parties to read these cookies was a design oversight that took 30 years to correct.

The unintended industry

By 2010 third-party cookies power a $400B ad-tech stack. DoubleClick, AppNexus, Criteo, the entire programmatic ecosystem. The 'cookie economy.'

The first kill

Safari Intelligent Tracking Prevention, June 2017. By 2019, Safari blocks all third-party cookies by default. Mobile Safari has roughly 25% of global browser share, which means a quarter of the ad-tech stack stops working overnight.

The regulatory wave

GDPR (May 2018), CCPA (2020). Consent banners proliferate. Compliance becomes expensive. The 'legitimate interest' workarounds get progressively narrowed by case law.

The Chrome capitulation

Google announced deprecation in 2020, delayed repeatedly, finally shipped Privacy Sandbox in 2024. The ad-tech industry had four years of advance notice and most of it spent them complaining rather than rebuilding.

Key data points

  • Cookie invention: Netscape, 1994 (Lou Montulli)
  • Safari ITP launch: June 2017
  • Firefox ETP default: September 2019
  • GDPR enforcement: May 2018
  • Chrome Privacy Sandbox: ongoing, 2024 to 2025
  • Pre-2017 ad-tech revenue dependent on third-party cookies: $200B to $400B annually

Contrarian angle

The ad-tech industry spent eight years insisting third-party cookies would survive. They did not, and the industry's failure to prepare cost it more than the deprecation itself.

The flip side

What replaces it

The paired prediction in Future Tech.

Read the prediction

FAQ

Are first-party cookies also dying?

No. First-party cookies are the foundation of session management and remain unaffected. The deprecation specifically targets cross-site tracking via cookies, not session state within a single domain.

What's the Privacy Sandbox actually doing?

A bundle of replacement APIs: Topics for interest-based ads, Protected Audience for retargeting via in-browser auctions, Attribution Reporting for conversion measurement. The intent is to keep ad-funded web economics alive without cross-site identifiers.

Can I still track conversions without third-party cookies?

Yes, via server-side attribution (Meta CAPI, Google Enhanced Conversions), first-party event collection (CDPs), and data clean rooms. The accuracy is comparable; the engineering effort is higher.

More from guptadeepak.com

Want the technical deep-dive on what replaces this?

Read the companion article

Related obituaries

More from the consumer graveyard.