> Chrome keeps third-party cookies and most Privacy Sandbox APIs are retired. What it means for GDPR, ePrivacy consent and Consent Mode v2 on your website. > > Canonical: https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies [Marketing tools](https://www.flowconsent.com/en/blog?category=tools) # Google Privacy Sandbox: Impact on Cookie Consent and Third-Party Cookies By FlowConsent · Published 21 May 2026 · Updated 1 October 2026 · 8 min read In short Google has abandoned its plan to remove third-party cookies from Chrome and, in October 2025, retired most Privacy Sandbox APIs, including Topics and Protected Audience. Third-party cookies therefore still work in Chrome by default, while Safari and Firefox continue to restrict them. None of this changes the law: under Article 5(3) of the ePrivacy Directive and the GDPR, you still need prior, informed consent before setting non-essential cookies or using any equivalent tracking technology. For five years, "the end of third-party cookies" was the headline of every ad tech conference. Many website owners delayed decisions about their consent setup because they expected Chrome to change the rules of the game. The game has now settled, just not in the way most people predicted. This guide explains what happened, what is left of the Privacy Sandbox, and what you should actually do on your website today. ## From "cookie apocalypse" to U-turn: the timeline The Privacy Sandbox was launched by Google in 2019 as a set of browser technologies meant to support advertising without cross-site tracking. The original promise was simple: once these replacement APIs were ready, Chrome would phase out third-party cookies, as Safari and Firefox had already done in their own way. The deadline was postponed several times, and the UK Competition and Markets Authority (CMA) supervised the project after accepting legally binding commitments from Google in February 2022. The key milestones, all confirmed by Google's official Privacy Sandbox announcements and the CMA case page: - **4 January 2024:** Chrome restricted third-party cookies by default for 1% of users, as a large-scale test. - **22 July 2024:** Google announced it would no longer deprecate third-party cookies outright and would instead build a new Chrome experience letting people make an informed choice across their browsing. - **22 April 2025:** Google dropped that standalone prompt as well. Chrome keeps its current approach, where users manage third-party cookies in Chrome's privacy and security settings. Incognito mode continues to block them by default. - **17 October 2025:** Google [announced the retirement](https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies) of most Privacy Sandbox technologies, citing low adoption. The same day, the CMA released Google from its 2022 commitments, considering that its competition concerns no longer arose. The result is the status quo: in standard Chrome, third-party cookies remain enabled unless the user switches them off. ## What is left of the Privacy Sandbox in 2026 In its October 2025 update, Google listed the technologies it is phasing out across Chrome and Android: Attribution Reporting, IP Protection, On-Device Personalization, Private Aggregation and Shared Storage, Protected Audience, Protected App Signals, Related Website Sets, SelectURL, SDK Runtime and Topics. The Topics API was deprecated from Chrome 144, with removal planned in a later release, following the usual Chrome deprecation process. Only three technologies are kept and still supported: - **CHIPS** (partitioned cookies): lets a third-party service such as an embedded chat widget set a cookie that is tied to the site where it is embedded, so it cannot follow the user across sites. - **FedCM**: a browser API for identity flows such as "Sign in with..." buttons. - **Private State Tokens**: a way to pass anti-fraud trust signals without a cross-site identifier. If you had started testing Topics or Protected Audience (formerly FLEDGE), you can stop investing in them. If a vendor still sells you a "Privacy Sandbox ready" solution as a reason to skip consent, treat that as a red flag. ## Why the legal picture did not change A common misconception was that the Privacy Sandbox, or the end of third-party cookies, would make cookie banners obsolete. It never would have. European rules do not regulate a specific technology; they regulate access to the user's device. ### ePrivacy: the device is protected, not the cookie Article 5(3) of the ePrivacy Directive requires clear information and consent before storing information on, or reading information from, a user's terminal equipment, unless it is strictly necessary for a service the user explicitly requested. It applies whether or not the data is personal. In its [Guidelines 2/2023 on the technical scope of Article 5(3)](https://www.edpb.europa.eu/system/files/documents/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf), adopted in final form on 7 October 2024, the EDPB explicitly addresses new tracking methods designed to replace third-party cookies, and analyses tracking pixels, URL tracking, local processing on the device, IP-based tracking and unique identifiers. ### GDPR: consent and accountability When the information collected is linked to an identifiable person, the GDPR adds its own requirements: consent must be freely given, specific, informed and unambiguous, as easy to withdraw as to give, and you must be able to demonstrate it. This is why consent records matter as much as the banner itself. Each of these conditions is detailed in our guide to the [7 requirements for valid GDPR consent](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements). ### The UK position In the UK, PECR applies the same logic. The ICO's guidance on storage and access technologies is explicit: if you use them for online advertising purposes, you must get consent and cannot rely on any of the [exceptions](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/). In short, Chrome's decision affects what is technically possible, not what is legally allowed. A third-party advertising cookie still needs opt-in consent in the EU and the UK, whether the browser accepts it or not. ## What it means in practice for your website ### Your banner still has to block before consent Since third-party cookies keep working in Chrome, an advertising or social media script that loads before the visitor's choice will drop its cookies straight away on most of your traffic. That is precisely what regulators check first. Prior blocking, meaning that non-essential scripts only load after an explicit "accept", remains the core of a compliant setup. Our [Meta Pixel GDPR guide](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance) shows how this applies to one of the most widespread advertising tags. ### Measurement differs across browsers Safari has blocked third-party cookies by default since 2020 and Firefox isolates them per site with Total Cookie Protection. Chrome, meanwhile, keeps them by default. Your audience is therefore split between environments with very different tracking capabilities, and gaps in attribution are normal. Do not try to close that gap with fingerprinting or other workarounds: the EDPB guidelines make clear that they fall under the same consent requirement. Our article on [cookieless tracking](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) explains what genuinely works without consent and what does not. ### Google's own requirements are the real driver For anyone using Google Ads, Google Analytics or AdSense, the binding constraint is Google's [EU user consent policy](https://www.google.com/about/company/user-consent-policy/). It covers users in the EEA, the UK and Switzerland and requires you to obtain legally valid consent where the law requires it, to keep records of that consent and to clearly identify the parties receiving data. In practice, Google relies on [Consent Mode v2](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) to receive your visitors' choices through four signals: `ad_storage`, `analytics_storage`, `ad_user_data` and `ad_personalization`. Since March 2024, the last two have been required for features such as Customer Match audiences in the EEA. If Google Analytics is part of your stack, our analysis of [whether Google Analytics is GDPR compliant](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant) covers the questions it raises. ### First-party data gains value, not a free pass With retargeting via third-party cookies under pressure in Safari and Firefox, many advertisers are shifting to first-party data and server-side setups. These approaches can improve data quality, but they do not remove the need for consent when the purpose is advertising or cross-site profiling. See our guide to [server-side tagging and consent](https://www.flowconsent.com/en/blog/server-side-tagging-cookies-consent-impact) before moving your tags. ## An action plan for 2026 Rather than waiting for the next browser announcement, focus on what you control: 1. **Audit what your site really loads.** List every cookie, pixel and script, including those added by plugins and embeds. A [cookie audit](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) often reveals trackers nobody remembers installing. 2. **Remove dead Privacy Sandbox code.** If your tags call `document.browsingTopics()` or join Protected Audience interest groups, remove that code or ask your vendor for its deprecation plan. 3. **Enforce prior blocking.** Make sure no advertising or analytics cookie is set before consent, on Chrome as well as on Safari and Firefox. 4. **Offer a real choice.** "Reject all" must be as easy as "Accept all", on the first layer of the banner. Regulators such as the CNIL have fined major websites for making refusal harder than acceptance. 5. **Pass consent to Google correctly.** Configure Consent Mode v2 with denied defaults and update the four signals once the visitor decides. 6. **Keep proof.** Store a timestamped record of each choice and the banner version that was shown, so you can demonstrate consent if challenged. 7. **Update your cookie policy.** Remove references to Privacy Sandbox technologies you no longer use and describe the trackers you actually rely on. ## Where a consent management platform fits All the steps above can be done by hand, but they are tedious to maintain as your site and its tags evolve. A consent management platform (CMP) automates the repetitive parts. FlowConsent, for example, scans your site automatically to detect cookies, blocks scripts until consent is given, keeps consent records for 13 months and sends Consent Mode v2 signals to Google (and Microsoft UET Consent Mode signals to Microsoft Ads) with a single script, without needing Google Tag Manager. Its data is hosted in the EU, and the free plan covers up to 25,000 sessions per month on one domain. Our guide on [how to choose a consent management platform](https://www.flowconsent.com/en/blog/how-to-choose-consent-management-platform) sets out the criteria to compare. Whatever tool you choose, judge it on the essentials: does it really block before consent, does it give equal weight to refusal, and can it produce proof? If you are comparing options, our guide on [Consent Mode v2 setup](https://www.flowconsent.com/en/doc/google-consent-mode) shows what a correct integration looks like. On the proof side, the [FlowConsent proof report](https://www.flowconsent.com/en/doc/proof-report) turns a refusal scan into a dated, printable document for your DPO. ## Conclusion: stop waiting, start verifying The Privacy Sandbox saga is over. Chrome keeps third-party cookies, Topics and Protected Audience are being removed, and the CMA has closed its oversight. For website owners, this removes an excuse to postpone compliance rather than a reason to relax it: the ePrivacy Directive, the GDPR, the ICO and Google's own policies all still require prior consent for advertising and analytics trackers. The best next step is to check what your website does right now, before any click on your banner. [Scan your site for free](https://www.flowconsent.com/en/scan) to see which cookies and trackers load, and whether they wait for consent. The scan is free, and so is FlowConsent's free plan if you then need a banner. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgoogle-privacy-sandbox-consent-third-party-cookies) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgoogle-privacy-sandbox-consent-third-party-cookies) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Has Google removed third-party cookies from Chrome? No. In July 2024 Google abandoned its plan to phase them out, and in April 2025 it also dropped the planned standalone choice prompt. Third-party cookies remain enabled by default in Chrome, and users can block them in Chrome's privacy and security settings. Safari blocks them by default and Firefox isolates them per site. ### Is the Privacy Sandbox still active? Mostly not. On 17 October 2025 Google announced the retirement of most Privacy Sandbox technologies, including Topics, Protected Audience and Attribution Reporting, citing low adoption. Only CHIPS (partitioned cookies), FedCM and Private State Tokens continue to be supported. ### Do I still need a cookie banner now that Chrome keeps third-party cookies? Yes. Consent rules depend on the law, not on browser settings. Under Article 5(3) of the ePrivacy Directive and the GDPR (and PECR in the UK), you need prior, informed consent before setting non-essential cookies or using similar tracking technologies. Because Chrome still accepts third-party cookies, blocking scripts until consent matters even more. ### Did the Topics API require consent while it was available? Yes. In July 2023 the CNIL stated that publishers using Privacy Sandbox APIs must collect user consent under the same conditions as for cookies, and the EDPB's 2024 guidelines confirm that tracking techniques replacing cookies fall under Article 5(3) of the ePrivacy Directive. Topics was deprecated from Chrome 144, so the practical step today is to remove any remaining Topics code from your tags. ### Do I need Google Consent Mode v2 if I use Google Ads? If you have visitors in the EEA, the UK or Switzerland, Google's EU user consent policy requires valid consent where the law demands it, plus records of that consent. Consent Mode v2 passes your visitors' choices to Google through four signals (ad\_storage, analytics\_storage, ad\_user\_data, ad\_personalization), and since March 2024 the last two are needed for features such as Customer Match in the EEA. FlowConsent has Consent Mode v2 built in. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Comparisons · 22 October 2026](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) ### [First-party vs third-party cookies: differences, examples and GDPR](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) [What separates first-party and third-party cookies, real examples of each, how Safari, Firefox and Chrome treat them in 2026, and why consent depends on purpose rather than domain.](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) [Read the article ](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies)· [Marketing tools · 21 June 2026](https://www.flowconsent.com/en/blog/google-signals-gdpr-privacy-guide) ### [Google Signals and GDPR: privacy guide and compliance](https://www.flowconsent.com/en/blog/google-signals-gdpr-privacy-guide) [Google Signals links GA4 sessions to Google accounts for cross-device tracking and remarketing. This guide covers the GDPR implications, how to disable it, and compliant alternatives.](https://www.flowconsent.com/en/blog/google-signals-gdpr-privacy-guide) [Read the article ](https://www.flowconsent.com/en/blog/google-signals-gdpr-privacy-guide)· [Marketing tools · 27 March 2026](https://www.flowconsent.com/en/blog/consent-mode-v2-google-ads-campaign-impact) ### [Consent Mode v2 and Google Ads: impact on your campaigns](https://www.flowconsent.com/en/blog/consent-mode-v2-google-ads-campaign-impact) [Consent Mode v2 changes how Google Ads measures conversions in Europe. Basic vs advanced mode, modelled conversions, ROAS: what it means for your campaigns.](https://www.flowconsent.com/en/blog/consent-mode-v2-google-ads-campaign-impact) [Read the article](https://www.flowconsent.com/en/blog/consent-mode-v2-google-ads-campaign-impact) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)