Chrome kept its cookies, but Safari and Firefox never did. Here's what first-party data actually means for SMB ad targeting in 2026, in full.
Chrome still allows third-party cookies in standard browsing, but your targeting and reporting should not depend on them. Safari has blocked them by default since March 2020, Firefox restricts cross-site tracking by default, and the UK regulator that supervised Google's replacement plan closed its case because Google dropped the plan, while noting it could look again if Google restricts cookies later. For an SMB, the question is where your lead reporting depends on signals that browsers, ad platforms or privacy rules can change. Map that first, then strengthen the data you hold in your own systems. Status checked October 2026.
If your cost per lead has crept up, or your ad platform's lead count and your CRM's closed deals drift apart, tracking is one possible cause among several. Competition, creative fatigue, landing-page friction and audience saturation can look identical. Although Google's decision to keep Chrome cookies seemed helpful, its benefits are limited.
What actually happened to third-party cookies?
As of October 2026, Chrome keeps its user-choice approach: third-party cookies are allowed by default in standard browsing, users can restrict them in settings, and Incognito restricts them by default. Google dropped its plan to remove them and retired most of the technology built to replace them.
Date | Event |
Jan 2020 | Google announces a plan to phase out third-party cookies in Chrome within two years |
8 Jan 2021 and 11 Feb 2022 | The UK Competition and Markets Authority (CMA) opens an investigation into Google's Privacy Sandbox plans, then accepts binding commitments from Google |
22 Jul 2024 | Google drops its plan to remove cookies and proposes a user-choice prompt |
22 Apr 2025 | Google drops the prompt and keeps its current approach to cookie choice |
17 Oct 2025 | Google retires most Privacy Sandbox technologies, citing low adoption, and keeps work on CHIPS and FedCM. The CMA releases the commitments the same day, ending its four-year investigation |
The CMA released the commitments because its concerns rested on Google's plan to remove cookies, which was not going ahead. All fifteen consultation respondents opposed the release, and the CMA said renewed scrutiny may be appropriate if Google later restricts cookies or related signals. Our interpretation: a regulatory backstop exists but is conditional, so treat tracking policy as something that will keep moving.
Why does Chrome's decision matter less than it looks?
Your customers are not all on Chrome. Safari has blocked all third-party cookies by default since March 2020, and Firefox has restricted known cross-site trackers by default since September 2019 (InfoQ). Firefox also isolates cookies per site through Total Cookie Protection. Neither company waited on the CMA case.
The number to check is your own: what share of your site sessions come from Safari, including every iPhone? That is the audience third-party cookie targeting could not reach well before Chrome decided anything. Shrinking retargeting pools and platform numbers that drift from CRM revenue are consistent with cookie loss, but consent banners, ad blockers and campaign fatigue look the same, so diagnose before you attribute the drift.
What does first-party data protect you from, and what does it not?
It protects you from dependence on cross-site tracking. It does not make data safe, and the limits change what you should build.
Browser storage has limits. Safari deletes cookies and other storage written by JavaScript after seven days of use without the visitor interacting with the site, and can cap link-decorated visits at 24 hours (PPC Land summary of WebKit's rules). An infrequent visitor can look new in analytics. CRM and email records are not affected.
Owned does not mean unrestricted. Your privacy policy, the privacy laws that cover your customers and each ad platform's customer-list rules govern how you use the data. We are not lawyers, so confirm the specifics with counsel.
Size and quality set the ceiling. A list becomes an ad audience only when a platform matches enough of it, and a CRM record depends on your vendor, your integrations and how consistently your team enters data. Bad CRM data feeds bad targeting as reliably as a lost cookie does.
What does signal drift cost a business?
When reported leads and closed revenue stop agreeing, three decisions get worse at once: where the next marketing dollar goes, what the pipeline forecast says, and which channels sales believes in. The cost is rarely one failed campaign. It is a slow loss of confidence in the numbers that run the business. That is our view of where the damage lands, and it is why we treat this as a measurement and systems question before an ad-targeting one.
The Abacus Signal Audit
The audit maps every signal behind targeting and reporting across three questions: how exposed is it to browser changes, how much it depends on a platform or vendor, and what is its main weakness. Consent and legal obligations apply to every row. Nothing is wholly owned, so the audit shows where you are most exposed and which dependency you can reduce.
Signal | Browser exposure | Platform or vendor dependency | Main weakness |
Retargeting audience from a site pixel | High | High (ad platform) | Shrinks as browsers restrict tracking |
Platform-reported conversions | Medium | High | Partly modeled, hard to audit |
Site analytics using JavaScript cookies | High on Safari | Medium (analytics vendor) | Returning visitors can look new |
Email list used as a customer-list audience | Low | Medium (platform matching and rules) | List size and match rates |
CRM closed-won records | Low | Medium (CRM vendor, integrations) | Data quality and governance |
Illustrative, and the ratings are our qualitative judgment. Your stack will differ.
The signals that drive the most day-to-day budget decisions, platform conversions and retargeting audiences, carry the heaviest browser and platform exposure. The business decision is how much of your lead generation you are comfortable having rest on them.
How should an SMB strengthen its first-party data?
Begin with the audit, then work in this order:
Make the CRM the source of truth. Bring email, CRM and analytics data into one view and fix obvious data-quality problems first.
Fix collection points. Ask for the minimum, state what the person gets in return, and store the consent record with the contact.
Connect CRM, email and ads. Use customer lists as audiences, and consider passing conversions from your own systems through tools such as Google's enhanced conversions or Meta's Conversions API. These can improve the signal platforms receive, but they do not remove platform dependency, consent obligations or every measurement gap, so scope them with your technical team.
Reconcile against revenue every month. Compare platform-reported leads with CRM closed-won deals. The gap shows how much of your reporting to trust.
Automate hygiene. Sync unsubscribes and consent changes between CRM and email so a list does not become a liability.
The same logic applies to search and AI-generated answers: visibility there is earned on platforms you do not control, so it belongs in a growth plan as its own risk.
FAQ
Are third-party cookies dead in 2026?
No. As of October 2026, Chrome allows them by default in standard browsing. Safari blocks them, Firefox restricts cross-site tracking, and Chrome restricts them in Incognito.
Did the CMA settle the tracking question?
No. It released Google from its commitments because the plan they covered was dropped, and said it could look again if Google later restricts cookies or related signals.
Should a small business change its ad setup now?
Don't rebuild everything, but stop treating browser-based signals as the foundation. Map your signals, reconcile platform numbers against CRM revenue, and shift new investment toward data you hold in your own systems.
Where do your campaign numbers stop agreeing with your revenue?
Book a measurement and data-flow review with Abacus Digital. We map how your campaigns, leads and revenue connect across your ad platforms, website, CRM and email, find where the numbers stop agreeing, and prioritize the fixes that make your reporting dependable. Book a call with our team.