For several years, small businesses heard the same warning: third-party cookies were going away, so plan accordingly. Agencies built roadmaps, ad platforms promoted alternatives and many site owners quietly hoped the deadline would slip again. Then, in July 2024, Google announced a different direction for Chrome. Instead of removing third-party cookies on a fixed schedule, it proposed letting people make their own choice.

That change of course left many owners unsure what to do next. Does it mean nothing changes? Should the work already started be abandoned? This guide explains what Google said, what it does and does not change for a typical business website, and why the privacy obligations that matter most never depended on Chrome’s timeline in the first place.

This article is general information, not legal advice. Talk with qualified counsel about obligations that apply to your business.

A quick refresher on third-party cookies

A cookie is a small file a website stores in the browser. First-party cookies are set by the site you are visiting and handle things like keeping you signed in, remembering a cart or saving preferences. Third-party cookies are set by a different domain, usually through an embedded script, pixel, ad or widget. Because the same third party can appear on many sites, its cookies can be used to recognize a browser as it moves across the web.

That cross-site recognition powers retargeting ads, audience building and some kinds of conversion measurement. It is also why third-party cookies became the focus of privacy concerns. Other major browsers already block many third-party cookies by default, so the question for Chrome was always whether, when and how it would follow.

What Google planned before July 2024

Google’s plan had been to phase third-party cookies out of Chrome gradually. In a December 14, 2023 post on the next step toward phasing out third-party cookies in Chrome, Google said it would begin testing a feature called Tracking Protection on January 4, 2024. The feature restricts website access to third-party cookies by default, and Google said it would roll this out to 1% of Chrome users globally.

The same post described that test as a key milestone toward phasing out third-party cookies for everyone in the second half of 2024, subject to addressing any remaining competition concerns from the UK’s Competition and Markets Authority. It also acknowledged that third-party cookies have been a fundamental part of the web for nearly three decades and that sites have used them for things like helping people log in and showing relevant ads.

Alongside the phase-out, Google promoted its Privacy Sandbox, a set of browser technologies meant to support advertising use cases with less cross-site tracking.

What changed in July 2024

On July 22, 2024, Google published a new path for Privacy Sandbox on the web. The post said Google recognized the transition would require significant work by many participants and would have an impact on publishers, advertisers and everyone involved in online advertising.

In light of that, Google said it was proposing an updated approach that elevates user choice. Instead of deprecating third-party cookies, it would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they would be able to adjust that choice at any time. Google said it was discussing the new path with regulators and would engage with the industry as it rolled out.

The post also said Google would continue to make the Privacy Sandbox APIs available and invest in them, and that it planned to introduce IP Protection into Chrome’s Incognito mode.

As of this writing, the details of the choice experience have not been finalized. That uncertainty is itself useful information: it is not a reason to rebuild around third-party cookies.

Hands in teal sleeves slide blank yellow cards into a magenta ring binder beside a closed laptop.

What this means for a small business website

For most small businesses, the practical answer is that the direction of travel has not reversed. Even with cookies remaining in Chrome for now, several things are true:

  • Some visitors already block them. Other browsers restrict third-party cookies by default, and many people use privacy extensions.
  • Chrome users may opt out. If Google introduces a choice prompt, some share of users will likely choose more privacy.
  • Measurement is already incomplete. Ad platforms increasingly rely on modeling to fill gaps, which means numbers from cookie-based tracking are estimates rather than counts.
  • Privacy laws apply regardless. State privacy laws regulate how you share personal information, whatever the browser does.

The work many businesses started, such as strengthening first-party data, reviewing tags and improving consent, remains worthwhile. It simply has less of a hard deadline attached.

The law did not wait for Chrome

Browser policy is one question. Legal obligations are another, and they already reach the tracking tools on many small business sites.

California offers a clear example. In an August 24, 2022 announcement of a settlement with Sephora, the California Attorney General described how many online retailers allow third-party companies to install tracking software on their website and app so that third parties can monitor consumers as they shop. The Attorney General said Sephora’s arrangement with these companies constituted a sale of consumer information under the California Consumer Privacy Act, which triggered obligations such as telling consumers about the sale and allowing them to opt out.

The settlement required Sephora to pay $1.2 million in penalties. Among other terms, it had to provide mechanisms for consumers to opt out of the sale of personal information, including via the Global Privacy Control. The announcement also explained that under the CCPA, businesses must treat opt-out requests made by user-enabled global privacy controls the same as requests made by users who click the “Do Not Sell My Personal Information” link. It noted that the law’s notice and cure provision would expire on January 1, 2023.

The lesson for a small business is direct. If your site loads advertising pixels, retargeting tags or analytics tools that share data with third parties, the question of whether you are selling or sharing personal information can arise no matter which cookies Chrome supports. Whether a particular law applies depends on your size, revenue, data practices and customers, so confirm with counsel.

Audit what your website actually loads

The most valuable step is usually the least glamorous: find out exactly which third parties your site sends data to.

  1. List every tag and script. Check your tag manager, theme files, plugins and any code added directly to pages.
  2. Identify each vendor’s purpose. Analytics, advertising, chat, video embeds, maps, reviews and social widgets all load third-party code.
  3. Note what data each receives. Page URLs, form entries, purchase details and identifiers can all be shared.
  4. Remove what you no longer use. Old pixels from past campaigns are common and add both risk and page weight.
  5. Check consent behavior. Confirm which tags fire before a visitor makes a choice, and whether opt-outs actually stop them.
  6. Test with a privacy signal on. Use a browser or extension that sends the Global Privacy Control and confirm your site responds.

Our trust and security work includes this kind of tracking review, because the same third-party scripts that raise privacy questions can also introduce security risks.

Ask your vendors the right questions

Most small businesses rely on outside platforms for advertising, analytics and email. Those vendors are already adapting to browsers that limit tracking, so ask them how. Useful questions include:

  • What data does your tag collect from our site, and where is it sent?
  • Does your tool honor consent choices and Global Privacy Control signals?
  • How will your measurement work for visitors who block third-party cookies?
  • Do you offer server-side or first-party options, and what consent do they require?
  • What contract terms describe how you may use our customers’ data?

Write down the answers and keep them safely on file. They help you decide which tools to keep and give counsel what they need to assess your obligations.

Build on first-party relationships

Whatever happens to third-party cookies, data customers share with you directly remains the most durable foundation.

  • Email and accounts. Newsletter sign-ups, loyalty programs and customer accounts provide a direct, consented relationship.
  • Server-side measurement. Sending conversion data from your own server, with appropriate consent, can be more reliable than browser pixels.
  • Contextual advertising. Placing ads based on page content rather than personal history avoids much cross-site tracking.
  • Clear value exchange. Tell visitors what they get in return for their information, such as order updates or member pricing.

Making these changes often requires development work on forms, consent tools and data flows. Our web development team builds these into sites so measurement and privacy support each other.

A young man in a yellow sweater taps his phone at a cafe table beside a magenta coffee cup.

Make your privacy choices easy to understand

Visitors are more willing to share information when they understand what happens to it. Review the plain-language parts of your site:

  • A privacy policy that names the categories of third parties you share data with.
  • A cookie or consent banner that offers a genuine choice, with rejecting as easy as accepting.
  • A visible opt-out link where required.
  • Help content that explains how to change preferences later.

A clear help section can answer common questions before customers have to ask. Our help center shows the kind of straightforward guidance that builds trust.

What to watch next

Keep an eye on three things over the coming months: how Google finalizes the Chrome choice experience, how regulators respond to the new approach and how your own advertising and analytics vendors adjust. Revisit your tag list at least twice a year so changes do not catch you by surprise.

A fictional example

Consider a fictional outdoor gear shop that paused its privacy project after hearing that Chrome would keep third-party cookies. Before shelving the work, the owner asked a developer for a quick tag audit.

The audit found nine third-party tags, three of them from campaigns that had ended two years earlier. Two advertising pixels fired before visitors made any consent choice, and the site ignored Global Privacy Control signals. The shop removed the unused tags, set the remaining advertising tags to wait for consent, configured the site to honor privacy signals and updated its privacy policy. Page load times improved, and the owner finally had a clear, written picture of exactly what data left the site.

A third-party cookie checklist

  • Every third-party tag and script is listed with its purpose.
  • Unused tags are removed.
  • Advertising and tracking tags respect consent choices.
  • Global Privacy Control signals are honored where required.
  • The privacy policy names categories of third parties.
  • Opt-out links are visible where required.
  • First-party data collection is clear and consented.
  • Measurement plans assume incomplete cookie data.
  • Counsel has reviewed which privacy laws apply.

Google’s change of course gives businesses more time, not a reason to stop. The sites that keep reducing unnecessary tracking will be better prepared whatever browsers decide next.