Cookie Deprecation
Data & TrackingAlso: Third-Party Cookie Deprecation · Cookieless Future
Quick definition
Cookie deprecation is the phasing out of third-party cookies, small files that let advertisers track a person across different websites. Browsers including Safari and Firefox already block them by default. Chrome is moving the same direction. The change breaks retargeting and cross-site attribution that relied on that tracking.
How it varies across Australia
Australian businesses relying heavily on third-party retargeting are seeing that audience shrink as browser defaults tighten, regardless of Chrome's own timeline. The businesses least affected are the ones that already built first-party data collection into their conversion rate and lifetime value work.
See data and tracking maturity across Australian industries →What it actually means
A third-party cookie is a tag dropped by a domain other than the one you're visiting, usually an ad network, so it can recognise you again on the next site. Cookie deprecation is browsers switching that behaviour off by default.
Safari and Firefox already block third-party cookies for everyone. Chrome, which still carries most of the browser market, has moved slower and changed its plan more than once, but the direction hasn't reversed. Whatever the exact date, the tracking method is already unreliable for a meaningful share of any Australian audience.
The practical damage lands on retargeting, frequency capping, and cross-site attribution. If your CPA or ROAS reporting assumes you can follow someone from a display ad on one site to a purchase on another, that assumption is already partly broken. UTM parameters still work because they travel in the URL rather than a third-party cookie, but they only tell you the last click, not the full path.
First-party data (information a business collects directly through its own site, app or CRM) doesn't rely on any of this. Consent-based email capture, logged-in experiences and server-side tracking through a data layer all survive the change intact.
Cookie deprecation isn't a future problem. It's a current one wearing a delayed deadline.
How it shows up
It shows up as retargeting audiences shrinking without warning, frequency caps failing so the same person sees an ad too often, and attribution reports that suddenly can't connect a display impression to a later sale. In GA4, it often looks like a jump in 'direct' or 'unassigned' traffic, because the tool has lost the thread that used to link sessions across a customer's journey.
The Australian context
The Privacy Act reforms moving through the Australian Government add a second pressure alongside browser changes. Even where a browser still allows some tracking, tightening consent requirements under the Act push the same direction: collect data directly, disclose what you collect, and don't rely on a third party's cookie to do the job for you.
Australian businesses running on Shopify, WooCommerce or similar platforms with bolted-on ad pixels are typically the most exposed, since those setups lean hardest on third-party cookies for retargeting and are the slowest to adopt server-side tracking.
Where people get this wrong
Cookie Deprecation vs First-Party Data
| Cookie Deprecation | First-Party Data | |
|---|---|---|
| Who collects it | A third party like an ad network | The business itself |
| Survives browser changes | No | Yes |
| Requires direct consent | Often bundled and unclear | Usually explicit |
| Typical use | Cross-site retargeting | CRM, email, personalisation |
Related terms
Common questions
Are third-party cookies already gone?
Not everywhere. Safari and Firefox block them by default already. Chrome, which still carries most browser traffic, has delayed full deprecation multiple times but keeps moving toward tighter defaults. Treat the change as already partly happened, not as a future event.
Does cookie deprecation affect Google Analytics?
It affects cross-site tracking and some attribution accuracy in GA4, often showing up as more traffic labelled direct or unassigned. First-party analytics on your own domain still works, since that data doesn't depend on third-party cookies.
What replaces third-party cookies for retargeting?
First-party data collected through logins, email capture and CRM systems, combined with contextual targeting and Google's Privacy Sandbox tools where adopted. None of these fully replicate old-style cross-site retargeting, which is the point.
Do small businesses need to worry about this?
Yes, if they rely on retargeting ads or third-party pixels for attribution. The fix isn't complicated, building an email list, using a CRM, and tracking on-site behaviour directly, but it needs to start before the audience gap becomes a revenue gap.
Debrief
Get the next one
No spam. No fluff. Just the next article, straight to your inbox.
Keep exploring
About New Rebellion
New Rebellion is a marketing intelligence consultancy. We build tools, score Australian businesses on how their marketing actually performs, and publish Debrief every day. This dictionary is part of how we work in the open.
How we think →