Chrome kept its cookies, but Safari and Firefox never did. Here's what first-party data actually means for SMB ad targeting in 2026, in full.
In 2021, UK regulators opened an antitrust investigation into Google's plan to kill third-party cookies in Chrome, worried it would hand Google more ad-market power, not less. Google spent years building a replacement, then abandoned it in July 2024 and kept the cookies. In October 2025, Google shut down that replacement entirely, and regulators quietly closed the investigation the same day not because the concern was resolved, but because it stopped applying. Chrome "keeping" cookies never meant the cookie economy was safe: Safari and Firefox have blocked third-party cookies by default for years, untouched by any of this. For SMBs, the fix isn't watching Google's next announcement. It's owning first-party data that no browser policy or regulatory ruling can take away.
Every few years, someone announces the cookie is dead. It happened in 2022, then 2024, then 2025. If you run ads for a small business, you've probably tuned this cycle out.
That's the mistake. The real story isn't that Google saved the cookie. It's that the entire six-year fight over who controls it just ended in a shrug.
What Actually Happened to Third-Party Cookies?
Direct answer: Chrome still allows third-party cookies by default. Google abandoned its forced-deprecation plan in July 2024, confirmed in April 2025 it wouldn't add a consent prompt either, then shut down its replacement technology, Privacy Sandbox, entirely in October 2025.
Date | Event |
Jan 2021 | UK Competition and Markets Authority (CMA) opens an antitrust investigation into Google's plan to remove third-party cookies from Chrome |
Feb 2022 | CMA accepts binding commitments from Google governing how any replacement is built |
Jul 22, 2024 | Google abandons forced cookie deprecation, pivots to a "user choice" model instead |
Apr 2025 | Google confirms it won't add the standalone consent prompt either, cookie controls stay as they are |
Oct 17, 2025 | Google retires most Privacy Sandbox APIs; the CMA closes its four-year investigation and releases Google from its commitments the same day |
Why Did the Investigation That Started This Just End?
Not because the underlying concern was addressed. The CMA closed its investigation because Google decided not to remove third-party cookies at all, which made the original question of "will Google's replacement unfairly favor Google" moot by default, not by resolution.
This is the detail that gets lost in "Chrome kept cookies, crisis averted" coverage. The 2021 investigation existed because regulators worried a Google-built cookie replacement would let Google keep tracking users for its own ads while restricting competitors from doing the same. Google spent three years developing Privacy Sandbox under CMA supervision to answer that concern directly. In October 2025, Google retired most of it, citing what its own VP called technologies' "low levels of adoption". The CMA's response was to release Google from its commitments the same day because there was no longer a replacement left to police. google
Nobody won the argument. The argument just stopped being relevant. That's worth sitting with, because it means the next time Google or Safari, or Firefox, or a regulator moves on tracking, there's no settled precedent for how that fight resolves. It'll start from scratch, the way this one did.
What Does "First-Party Data" Actually Mean for an SMB?
Data a business collects directly from its own customers through channels it owns - website behavior, CRM records, transaction history, email engagement, direct form submissions instead of data purchased or tracked across other companies' sites. For most SMBs, it starts with three assets: an email list, a CRM, and site analytics.
Third-party data | First-party data | |
Source | Tracked or bought across sites you don't own | Collected directly through your own channels |
Browser dependency | High, degrades as browsers restrict tracking | None |
Who controls it | The platform | You |
Cost pattern | Recurring, rented | One-time setup, compounds over time |
No cookie policy, Chrome or otherwise, touches the bottom row, which is exactly why the six years of back-and-forth above shouldn't have been the thing your ad strategy was waiting on.
Why Should an SMB Care If Chrome Didn't Kill Cookies?
Safari has blocked third-party cookies by default since 2020. Firefox has done the same since 2019. Neither waited for Google, and neither was party to the CMA case at all. That means every visitor on Safari or Firefox has already been invisible to third-party cookie tracking for years regardless of what happened in Chrome or in a UK regulator's filing last October.
The practical symptom isn't a cliff, it's drift. Retargeting pools shrink a little each quarter. Platform-reported numbers and actual revenue disagree by a little more each month. It's easy to misread as "the campaign is underperforming" when the real issue is that you can no longer fully see what's happening.
It's the same pattern worth watching for elsewhere in your stack. Betting a core part of your growth on a platform you don't control, whether that's Google's cookie policy or Google's search rankings is a bet you can lose overnight, with no say in the timing. Owned assets, whether that's your customer data or your direct visibility with AI answer engines, don't carry that risk.
How Should an SMB Build a First-Party Data Foundation?
Direct answer: Audit what you already have, fix your collection points, and connect email and CRM data directly to your ad platforms. Most SMBs already own more usable first-party data than they realize, it's just scattered across tools that don't talk to each other.
Audit what you already own. Pull your email list, CRM export, and analytics into one view before buying any new tool.
Fix the collection points. Every form and checkout is a first-party data opportunity - ask for the minimum, and make the exchange feel fair.
Connect email to CRM to ads. Upload your list as a custom audience. This targeting survives any cookie policy change because it never depended on cookies.
Build lookalikes from real customers, not inferred cross-site behavior.
Track engagement, not just conversion. Opens, on-site behavior, and repeat visits are first-party signals you can act on immediately.
Frequently Asked Questions
Is the third-party cookie actually dead in 2026?
No, not in Chrome. Chrome still allows third-party cookies by default. But Safari and Firefox have blocked them for years, and Google shut down its own planned replacement in October 2025. Cookie-based tracking has been eroding across much of the web regardless of Chrome's decision.
Did Google's cookie reversal end the regulatory scrutiny around tracking?
Not really, it just closed one specific case. The UK CMA released Google from its Privacy Sandbox commitments because Google no longer had a replacement to supervise, not because the underlying competition concern was resolved. That question is effectively unanswered, not settled.
Do I need to stop using third-party cookies immediately?
Not immediately, but don't build new strategy around them. Any visitor on Safari or Firefox is already outside third-party cookie tracking, so your reporting is likely already incomplete. Treat it as a shrinking asset, not a stable one.
What's the fastest first-party data asset an SMB can build?
Your email list, connected to your CRM and uploaded as a custom audience. No new technology required for most businesses, just consistent collection and a willingness to use the list you already have for targeting, not just newsletters.
Bottom line
The fight over who controls cookie-based tracking didn't end, it just ran out of a reason to continue. That's a far less stable foundation than "Google decided cookies are fine," and it means the businesses pulling ahead right now aren't the ones waiting on the next ruling. They already own their customer data.
Ready to see how much of your ad targeting is still riding on borrowed data? Talk to Abacus Digital about a first-party data audit. For more on where digital targeting is headed, browse our resource library.