Skip to content
Deepak Gupta markTech Graveyard

Tech Graveyard/consumer

Third-Party Cookies (1994 to Dying)

Lou Montulli invented the cookie at Netscape in 1994 to keep shopping carts working. He did not intend to power the cross-site ad-tracking industry.

Born 1994 · Still dying, projected end 2030 · Status: dying

By Deepak Gupta · Published · Last updated

Paired prediction: what replaces it in Future Tech

Certificate of Death

Name of decedent

Third-Party Cookies

Born
1994
Died
Not yet
Age
32+

Cause of death

Safari ITP (2017) and full blocking (2020), Firefox ETP (2019), regulatory pressure. Chrome still allows them.

Survived by

First-party data, server-side attribution, privacy-preserving APIs, contextual advertising

Invented by

Lou Montulli at Netscape

Status: DyingProjected final breath: 2030

Filed by D. Gupta · guptadeepak.com

The hook

Safari started restricting third-party cookies in 2017 and blocked them by default in 2020. Google spent five years promising Chrome would follow. In 2025 it decided not to.

Thesis. The decline of third-party cookies is not a technology change. It is a privacy regime change. Safari and Firefox had already shut them out by default by 2020.

The story

The origin

Lou Montulli at Netscape, 1994. A small piece of state to make shopping carts work across page loads. Never designed for cross-site tracking. The browser security model that allowed third parties to read these cookies was a design oversight that browsers have spent decades correcting.

The unintended industry

By 2010 third-party cookies power the ad-tech stack. DoubleClick, AppNexus, Criteo, the entire programmatic ecosystem. The 'cookie economy.'

The first kill

Safari Intelligent Tracking Prevention, June 2017. In March 2020, Safari 13.1 blocks all third-party cookies by default. Firefox turned on Enhanced Tracking Protection by default in 2019. Every Safari and Firefox user drops out of cross-site cookie tracking.

The regulatory wave

GDPR (May 2018), CCPA (2020). Consent banners proliferate. Compliance becomes expensive. The 'legitimate interest' workarounds get progressively narrowed by case law.

The Chrome reversal

Google announced in January 2020 that Chrome would phase out third-party cookies within two years, then delayed repeatedly. In July 2024 it dropped the phase-out in favor of user choice. In April 2025 it said Chrome would keep its current cookie controls. In October 2025 it retired most Privacy Sandbox APIs.

My projection, revised in November 2026: with Chrome keeping them, the end is slower and comes from the advertiser side. I expect cross-site cookies to stop being a signal anyone plans around by 2030, even if Chrome still accepts them.

Key data points

  • Cookie invention: Netscape, 1994 (Lou Montulli)
  • Safari ITP launch: June 2017
  • Firefox ETP default: September 2019
  • GDPR enforcement: May 2018
  • Safari full third-party cookie blocking: March 2020
  • Chrome keeps third-party cookies: April 2025
  • Most Privacy Sandbox APIs retired: October 2025

Contrarian angle

The ad-tech industry got its wish in Chrome: third-party cookies survived. That did not make them reliable. Safari and Firefox still block them by default, so any measurement built on them is blind to a large share of users.

The flip side

What replaces it

The paired prediction in Future Tech.

Read the prediction

◆ Technology Rewired

See the full evolution in Technology Rewired:

FAQ

Are first-party cookies also dying?

No. First-party cookies are the foundation of session management and remain unaffected. Browser blocking specifically targets cross-site tracking via cookies, not session state within a single domain.

What happened to the Privacy Sandbox?

Google built replacement APIs: Topics for interest-based ads, Protected Audience for retargeting via in-browser auctions, Attribution Reporting for conversion measurement. Adoption stayed low. In October 2025 Google retired all three, along with several other Privacy Sandbox technologies.

Can I still track conversions without third-party cookies?

Yes, via server-side attribution (Meta CAPI, Google Enhanced Conversions), first-party event collection (CDPs), and data clean rooms. The engineering effort is higher.

More from guptadeepak.com

Further reading

Related obituaries

More from the consumer graveyard.