Open two browser tabs. In the first, you spend ten minutes reading a long guide about trail running shoes on a sports blog. A few days later, in the second tab, you check the weather before a hike. Not long ago, a running shoe ad would almost certainly have followed you into that second tab. It was not a coincidence and it was not magic. A small file called a third-party cookie had quietly tagged your browser on the sports blog, and an ad exchange matched that tag the moment the weather page loaded.
On a growing share of browsers today, that handoff no longer happens. That is cookieless advertising in miniature: the running shoe ad does not show up on the weather page, not because nobody is buying ad space there, but because the thread connecting your two visits has been cut.
This article is about what that cut thread means in practice: what breaks, what quietly keeps working, and what has moved in to do the jobs the cookie used to do.
Why the thread got cut
Third-party cookies have been doing invisible plumbing work since the mid-1990s: behavioral targeting, frequency capping, cross-site attribution. For most of that time, they worked because browsers let any domain drop a file in your browser and read it back later from a different site.
That is no longer true everywhere. Safari and Firefox have blocked third-party cookies by default for years. Chrome, which carries the largest share of browser usage worldwide, has been tightening its own restrictions, and the industry has stopped assuming that cross-site tracking via cookies will keep working the way it did a decade ago.
The driver is not a single browser decision. Regulators in the EU (GDPR), California (CCPA and CPRA) and a growing list of other jurisdictions have made informed consent a legal requirement for this kind of tracking. At the same time, people have simply gotten more aware of, and more resistant to, being followed around invisibly. Browser vendors are responding to a demand that was already there.
What used to be invisible is now a setting on the home screen: browser cookies flagged for review, right next to virus and update status.
What actually breaks
The loss of third-party cookies does not touch advertising in general. It touches a specific set of workflows that were built on top of one shared identifier:
- Audience targeting: behavioral segments stitched together from browsing history across many sites become harder to build and to keep fresh.
- Frequency capping: without a shared identifier, limiting how many times one person sees an ad across different publishers is technically difficult.
- Cross-site attribution: connecting an ad impression on one domain to a conversion on another now requires infrastructure that did not exist before.
- Retargeting: showing an ad to someone who visited a brand’s site but did not buy relied, almost entirely, on a cross-site identifier.
The cookie never just targeted ads. It quietly paid for capping how often you saw one, linking a click to a sale, and reminding you about the cart you left behind. All three jobs still need doing. They just need a different tool now.
The old toolkit and the new one
It helps to see the shift side by side rather than as a single abstract loss. The old toolkit leaned on one identifier that worked everywhere. The new toolkit is a set of narrower tools, each good at part of the job.
One shared identifier used to cover three jobs. Today each job leans on a different, narrower signal.
No single replacement on the right side of that diagram does everything the cookie did. Together, they cover most of the same ground, with signals that are tied to consent, to context, or to a direct relationship rather than to silent cross-site tracking.
Five things filling the gap
First-party data
The most durable replacement is data collected directly by the brand or the publisher: email addresses, loyalty memberships, purchase history, on-site behavior. Because the person explicitly shared it, first-party data is both privacy-compliant and accurate. Turning it into something you can target against at scale usually means a customer data platform or a clean room arrangement with a publisher.
A session like this one, logged into a brand’s own site or app, is still fully recognizable to that brand. No cross-site tracker required.
Contextual targeting
Rather than targeting a person based on who they are, contextual targeting looks at what they are reading right now. An ad for running shoes on a fitness article is the classic example. Modern contextual tools have gotten considerably more sophisticated, reading sentiment and topic depth rather than just scanning for keywords.
Universal IDs and identity solutions
Several industry groups have built pseudonymous identifiers that persist across sessions with consent. Unified ID 2.0, built on a hashed, authenticated email address, is one example, and LiveRamp’s RampID is another. Both require the user to log in or consent somewhere, which narrows reach but raises signal quality where they apply. For how these pieces get stitched into one customer profile, see identity resolution and alternative IDs.
Cohort-based approaches
Rather than identifying an individual, cohort approaches group people who share interests and target the group. Google’s Privacy Sandbox experimented with this model. The appeal is that an individual’s browsing history never leaves their device, only an aggregated cohort label gets shared with advertisers.
Attention and engagement metrics
Some platforms have started measuring outcomes directly: time in view, scroll depth, interaction rate, rather than relying on identity-based targeting at all. These signals can shape both creative decisions and bidding strategy without needing a persistent identifier behind them.
What never depended on the cookie
Cookieless advertising does not mean untargeted advertising. A few tools were never built on third-party cookies in the first place, and they keep working exactly as before: location derived from device GPS or IP address, demographic inference from app context, audience segments a publisher builds on its own properties, and CRM lists you onboard yourself. None of that disappears. The industry is not starting from zero, it is leaning harder on the parts of the toolkit that were already sturdy.
Measurement is shifting the same way rather than vanishing. Media mix modeling, incrementality testing and attention measurement have all been gaining ground as complements, and in some cases replacements, for last-click attribution.
How bidding still works without a name
It is worth seeing, concretely, how an ad auction can still run well without any identifier attached to a person. Here is roughly what happens between a page opening and an ad appearing, in an auction that never needs to know who you are:
From page open to ad on screen in about 100 milliseconds, context and rules only, no identity required.
The page opens. A slot gets auctioned a few milliseconds later, described by its context, its format, the city it is loading in, and the device type: never a name. A buyer checks that slot against its own rules: is this an allowed site, does it sit inside a targeted zone, is there budget left. It bids or it passes, and if it wins, the ad appears. Every one of those steps runs on signals that were never cookie-dependent to begin with.
How Arago helps
Arago’s DSP buys this way by default: real-time bidding over OpenRTB on the open internet, across websites and mobile apps, deciding on context, zone, allowed sites and budget rather than on a cross-site identity. Map builds targeting zones around real driving time to each store, which keeps working whether or not a cookie survives the trip. Creative personalizes by product, offer and nearest store, signals that come from the campaign setup itself rather than from tracking a person across the web. None of it needs a contract or a minimum spend to try, you only fund the campaigns you run. For a closer look at the auction itself, see the ad auction in 100 milliseconds, and for the first-party side of this shift, building a first-party data strategy.
FAQ
Does cookieless mean my ads can no longer be targeted?
No. It means targeting that depended on tracking someone across unrelated sites gets harder. Location, context, device type, frequency rules and your own customer data all keep working.
What happens to retargeting without third-party cookies?
Classic cross-site retargeting, following someone from your site onto a news site, loses its main plumbing. What still works is retargeting inside a channel where you have a direct relationship: your own app, your own logged-in site, or a publisher’s first-party audience you can reach through them.
Do I need to adopt a universal ID myself?
Not necessarily. Universal IDs mainly help when you need to match your own customer list against a DSP’s inventory at scale. Many local and regional advertisers get most of their value from first-party data, contextual placement and location targeting, none of which require adopting an ID framework.
Does this change anything inside mobile apps?
Mobile apps were never built on the browser cookie in the first place. Their own signal loss happened earlier, when Apple made its device identifier opt-in by default. The practical response is the same one described here: lean on context, location and first-party relationships rather than a persistent cross-app identifier.
Is first-party data alone enough to replace cookies?
For many advertisers, especially local ones, first-party data covers the highest-value audience: people who already bought from you. It rarely covers prospecting on its own, which is why it tends to sit alongside contextual targeting and location-based signals rather than replacing them outright.
