Third-party cookies are not going away in Chrome, and Google said so three times. The reason to send conversions from your server is a rule few have read.
Third-party cookies are not going away in Chrome, and the reason to move measurement to your server has almost nothing to do with them.
That first clause contradicts most of what has been written on this subject for five years, including a good deal published in 2026. It is also the settled, documented position, stated three times.
July 2024. Google’s vice president for Privacy Sandbox: “Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice.”
April 2025. The same author, retiring even that: “we’ve made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies.”
October 2025. The replacement technologies were withdrawn: “we’ve decided to retire the following Privacy Sandbox technologies: Attribution Reporting API (Chrome and Android), IP Protection, On-Device Personalization, Private Aggregation (including Shared Storage), Protected Audience (Chrome and Android), Protected App Signals, Related Website Sets, SelectURL, SDK Runtime and Topics (Chrome and Android).”
What survives is a much shorter list, and the stated reason is adoption: “CHIPS and FedCM, which improve cookie privacy and security and streamline identity flows respectively, have seen broad adoption, including support from other browsers.”
So in Chrome today: third-party cookies on by default, no removal timetable, no choice prompt, and most of the alternatives cancelled. Anyone still selling you a migration on the basis of the cookie deadline is selling a deadline that was withdrawn two years ago.
The real constraint is in Safari, it has been in force since 2019, and it is more specific than the folklore.
“Cookies can either be set in HTTP responses or through the document.cookie API, the latter sometimes referred to as client-side cookies. With ITP 2.1, all persistent client-side cookies, i.e. persistent cookies created through document.cookie, are capped to a seven day expiry.”
Read the scope carefully, because it is what makes this actionable:
“Only cookies created through document.cookie are affected by this change. The change covers cookies created in first-party contexts as well as in third-party iframes. Session cookies are not affected, they remain session cookies.”
Two things follow that most explanations skip.
This rule is universal. It does not depend on any classification of your domain, on any tracking score, or on the visitor’s behavior. Every cookie a script writes is capped, on every site.
And cookies set in an HTTP response header escape it. That is the entire technical case for moving identity to your server, and it has nothing to do with third-party cookies at all. A first-party cookie written by your own server, in a response header, is not subject to the seven-day cap.
There is a second, different seven-day rule that gets conflated with the first. Non-cookie storage is deleted “after seven days of Safari use without the user interacting with a webpage”, but only where the visitor “is navigated from a domain classified with cross-site tracking capabilities to a final URL with a query string and/or a fragment identifier”. That one is conditional. The cookie cap is not.
Safari also strips certain tracking parameters before navigation, and, since 2024, hides query strings from third-party scripts on the destination page: “all third-party scripts that attempt to read the full URL… will get a version of the URL that has no query parameters or fragment.” Campaign parameters survive, because Safari distinguishes them: “the campaign above represents a parameter that’s only used for campaign attribution, as opposed to click or user-level tracking.”
Firefox, for its part, partitions rather than blocks: “Total Cookie Protection works by creating a separate ‘cookie jar’ for each website you visit”, and the point of doing it that way is stated plainly, since the previous list-based approach could be defeated because “if an attacker wants to thwart ETP, they can set up a new tracking domain that isn’t on the list.”
The name suggests a replacement for the browser tag. The documentation says otherwise, and the details matter for anyone budgeting an implementation.
It runs alongside the pixel, not instead of it. Deduplication is the whole design: “We determine if events are identical based on their ID and name. So, for an event to be deduplicated: 1. In corresponding events, a Meta Pixel’s eventID must match the Conversion API’s event_id. 2. In corresponding events, a Meta Pixel’s event must match the Conversion API’s event_name.”
There are two different time windows, and confusing them is the most common implementation error. An event may carry a timestamp up to seven days old: “The event_time can be up to 7 days before you send an event to Facebook.” But deduplication only works within 48 hours: “events are only deduplicated if they are received within 48 hours of when we receive the first event with a given event_id.”
You are sending customer data, and the format is prescribed. Hashing is SHA-256, and the normalization is specified field by field: email trimmed and lowercased, phone numbers with symbols and leading zeros removed and a country code included, names “lowercase only with no punctuation”, state as “the 2-character ANSI abbreviation code in lowercase”, postal code as “only the first 5 digits for U.S. zip codes”. A few fields are sent unhashed, including the client IP address and user agent.
Google’s equivalent works the same way and adds a contractual layer. Enhanced conversions send hashed first-party data, using “a secure one-way hashing algorithm called SHA256”, and turning the feature on is a legal act: “By turning on enhanced conversions, you confirm that you comply with Google’s policies. You are instructing Google to process your data. The Google Ads Data Processing Terms apply.”
There is even a technical guardrail worth quoting to whoever signs off: “If the Google tag detects that user-provided data is being presented to the tag for a Google Ads or Google Analytics destination that has not accepted these terms of service, the data will not be collected or processed by Google.”
And when consent is refused, what appears in the report is a model, described honestly by its author: “We only include modeled conversions in our reporting when we’re highly confident that conversions actually occurred as a result of ad interactions”, and “for some users, we don’t observe enough conversions on a regular basis to be able to confidently model. In these cases, we don’t report any modeled conversions.”
Executives who conclude that privacy law does not apply to them almost always reason from the word “sell”. Californian law anticipated that, and defined a second term.
Selling is what you would expect: transferring personal information to a third party “for monetary or other valuable consideration”.
Sharing is the one that matters, and the crucial clause is at the end:
“‘Share,’ ‘shared,’ or ‘sharing’ means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.”
No money needs to change hands. And cross-context behavioral advertising is defined as targeting “based on the consumer’s personal information obtained from the consumer’s activity across businesses, distinctly branded internet websites, applications, or services, other than the business… with which the consumer intentionally interacts.”
An advertising pixel that feeds retargeting is a share. That is the whole analysis.
The second obligation is the one that trips up companies who have installed a consent banner and consider the matter closed. The regulation on opt-out preference signals is written as a duty:
“A business that sells or shares personal information shall process any opt-out preference signal that meets the following requirements as a valid request to opt-out of sale/sharing.”
And it extends further than most implementations do:
“The business shall treat the opt-out preference signal as a valid request… for that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles.”
Plus a rule against re-asking: “the business shall not interpret the absence of an opt-out preference signal after the consumer previously sent an opt-out preference signal as consent to opt-in.”
Twenty states now have a comprehensive privacy law in force, with three more arriving on 1 January 2026. That count comes from private trackers rather than an institutional source, so treat it as approximate, but the direction is not in doubt.
Six published actions, all involving advertising technology on a website rather than a data broker selling files.
A prescription discount service, February 2023. Uploading lists of users who had bought particular medications, with email addresses, phone numbers and advertising identifiers, to an advertising platform. $1.5 million, and the regulator’s first action under its health breach rule.
A therapy service, March 2023. Sharing email addresses, IP addresses and answers to a mental health questionnaire with four advertising platforms. $7.8 million in consumer refunds.
A cosmetics retailer, August 2022.$1.2 million, including for failing to process opt-outs sent by browser signal. The Attorney General’s framing is the durable part: businesses “must treat opt-out requests made by user-enabled global privacy controls the same as requests made by users who have clicked the ‘Do Not Sell My Personal Information’ link.”
A car manufacturer, March 2025.$632,500, including for sharing personal information with advertising technology vendors without the required contract terms.
A clothing brand, May 2025.$345,178, for failing to process opt-out requests for forty days because a consent tool was misconfigured. The regulator’s comment is the one to pin above the project plan: “Using a consent management platform doesn’t get you off the hook for compliance.”
A rural retailer, September 2025.$1,350,000, the largest fine that agency has issued, including for “failing to provide consumers with an effective mechanism to opt-out… including through opt-out preference signals such as Global Privacy Control”. The remedy required scanning its own properties “to inventory tracking technologies” and annual certification by an executive for four years.
In September 2025, the California agency and the attorneys general of three states announced a joint sweep specifically on businesses ignoring these signals.
Stop budgeting against the cookie deadline. It was withdrawn in July 2024, restated in April 2025, and the replacement technologies were retired in October 2025. If a proposal opens with the deprecation, it is two years out of date.
Move first-party identity to a response header. That is the fix for the seven-day cap, it applies to every visitor on Safari regardless of classification, and it does not require a conversions interface at all.
If you implement one, implement both sides. Send the same event identifier and event name from the browser and from the server, and get the events in within 48 hours of each other. A server feed without matching identifiers produces duplicates, not accuracy. Getting that pairing right is the first job on any account we take on, and our page on B2B paid acquisition describes how the pixel, the server feed and the analytics setup are settled before a campaign is built.
Inventory the tags before anything else. One of the published remedies literally required a company to scan its own properties “to inventory tracking technologies”. Most organizations cannot list what is firing on their site, and that inventory is the first artifact a regulator asks for.
Honor the browser signal, and test it. It is a “shall”, it covers pseudonymous profiles, and a misconfigured consent tool has already produced a fine on its own.
And do not import a number for what you are losing. No regulator, statistical agency or peer-reviewed study publishes the share of conversions lost to browser restrictions. Every figure in circulation comes from companies selling the remedy. Measure your own gap instead: run the pixel and the server feed together with matching identifiers, and compare what each reports. That number will be about your site, and it will be the only one you can defend.
Frequently asked questions
Are third-party cookies going away in Chrome?
No. Google said in July 2024 it would not deprecate them, confirmed in April 2025 that it would keep the current approach and would not roll out a standalone prompt, and in October 2025 retired most of the replacement technologies including the Attribution Reporting API, Topics and Protected Audience.
Why do my Safari conversions disappear after a week?
Because Safari caps every persistent cookie created through document.cookie at a seven day expiry. That rule is universal and does not depend on any classification. Cookies set in an HTTP response header are not affected, which is the real technical argument for server-side.
Does a conversions API replace the pixel?
No. Meta's own deduplication depends on matching an event identifier and event name between the two, within 48 hours of the first event received. The server interface is designed to run alongside the browser tag, not instead of it.
I do not sell data, so does California privacy law apply to me?
Probably yes. California defines sharing personal information for cross-context behavioral advertising as covered whether or not for monetary or other valuable consideration. An advertising pixel that feeds cross-site targeting is a share even when no money changes hands.
Do I have to honor the Global Privacy Control signal?
In California, yes. The regulation says a business that sells or shares personal information shall process a conforming opt-out preference signal as a valid request, and that it applies to any consumer profile associated with that browser or device, including pseudonymous profiles.