Chrome Kept Tracking Cookies. Here's How to Block Them.

Chrome is not phasing out tracking cookies. Google formally gave up on that plan in 2024 and 2025, and on October 17, 2025 it went further and retired most of the Privacy Sandbox tools that were supposed to replace third-party cookies. Safari, Firefox and Brave already restrict those cookies by default. The next change on the calendar is a California law that takes effect in January 2027. It requires browsers to include a "don't sell or share my data" signal that you can switch on. No industry-wide switch-off is coming: your browser and its settings decide how much you are tracked.

Key takeaways

Google promised in January 2020 to phase out third-party cookies in Chrome "within two years." It delayed the date three times, then announced in July 2024 and April 2025 that it would keep them and leave the choice to users.
Safari has blocked all third-party cookies by default since March 2020. Firefox has kept each site's cookies in a separate "jar" by default for all desktop users since June 2022.
Blocking cookies does not stop fingerprinting. According to the UK's data protection regulator, Google's ad platform rules stopped prohibiting it on February 16, 2025, a change the regulator called "irresponsible."
From January 2027, California's Opt Me Out Act requires browsers to offer an opt-out preference signal that you can configure. California and Colorado already require businesses covered by their privacy laws to honor signals such as Global Privacy Control.
Chrome users can block third-party cookies in Settings, under Privacy and security, then Third-party cookies. Incognito mode blocks them by default.

What it means for you

A third-party cookie is a small file set by a domain other than the site in your address bar, such as an ad network embedded on a news page. Because the same ad network sits on thousands of sites, its cookie can link your visits into one profile. How much of that happens to you depends mostly on your browser.

Chrome users: nothing changes automatically. Third-party cookies stay available in regular windows unless you block them. The steps are in the closing section.
Safari users: cross-site cookies are already blocked. The remaining risks are fingerprinting and tracking tied to your logins (see the section on what still tracks you).
Firefox users: Total Cookie Protection already separates cookies by site. The Global Privacy Control signal is a separate setting. Firefox 120 turned it on by default in private windows, but in regular windows it stays off until you check it.
Edge users: tracking prevention blocks trackers that appear on Disconnect's open-source tracker lists, and the default "Balanced" level allows more than "Strict."
People who use ad blockers in Chrome: older-style extensions stopped running in 2025. Check that yours has a current version.
People worried about fingerprinting: clearing cookies won't fix it. Browser-level protections and fewer tracking scripts help more.
Small site owners and sellers: if your business meets the thresholds of California's or Colorado's privacy law and sells or shares visitor data, those states already expect you to honor opt-out signals. California's browser law could put the signal in front of more visitors from 2027.

How Chrome's cookie plan unraveled

In its January 14, 2020 announcement, Chrome said it planned to "phase out support for third-party cookies" once replacement tools were ready, and that it intended "to do this within two years." That deadline passed in January 2022. The plan was abandoned about four and a half years after it was announced.

Date	What Google said
Jan 14, 2020	Phase out third-party cookies in Chrome within two years
Jun 24, 2021	New timeline: phase-out over three months, finishing in late 2023
Jul 27, 2022	Begin phasing out in the second half of 2024
Dec 14, 2023	Test cookie blocking for 1% of Chrome users from January 4, 2024
Apr 23, 2024	Not completing deprecation in 2024; aiming for early 2025, subject to UK regulators
Jul 22, 2024	Instead of deprecating, introduce a user-choice experience
Apr 22, 2025	Keep the current approach; no new standalone cookie prompt
Oct 17, 2025	Retire most Privacy Sandbox technologies, citing low adoption

The April 2025 post cited "divergent perspectives" among publishers, developers, regulators and the ad industry on any change that would affect third-party cookies. The October 2025 retirement covered Topics, Protected Audience, Attribution Reporting, Related Website Sets, Private Aggregation and IP Protection, among others. On the same day, the UK Competition and Markets Authority released Google from the Privacy Sandbox commitments it had accepted in 2022. The regulator concluded that its competition concerns no longer arose.

So the common belief that Google replaced cookies with the Privacy Sandbox is wrong twice over: the cookies stayed, and most replacement tools are gone. As of October 2026, about six and three-quarter years after the original announcement, cookie blocking in regular Chrome windows remains a setting you have to switch on.

Where each browser stands now

Other browser makers did not wait for an industry agreement. Apple's WebKit team announced full third-party cookie blocking on March 24, 2020, in Safari 13.1 and iOS 13.4. Mozilla made Total Cookie Protection the default for all Firefox desktop users on June 14, 2022. It gives each website its own cookie storage, so an embedded tracker sees your activity on one site but cannot join it to another.

Browser	Third-party cookies by default	Other built-in protection
Chrome	Allowed in regular windows; blocked in Incognito	Bounce-tracking cleanup, only for people who block third-party cookies
Safari	Blocked; sites can ask for access through the Storage Access API	Caps on disguised tracker cookies and link-tracking cookies; limits on known fingerprinting scripts
Firefox (desktop)	Partitioned per site (Total Cookie Protection)	Enhanced Tracking Protection; optional Global Privacy Control signal
Edge	Trackers on Disconnect's lists restricted, depending on the level chosen	Basic, Balanced (default) or Strict tracking prevention
Brave	Cross-site cookie tracking blocked by Shields; storage partitioned per site	Fingerprinting protection, debouncing of redirect trackers

Edge works differently from Safari and Firefox. According to Microsoft's tracking prevention guide, Balanced blocks potentially harmful trackers and trackers from sites you haven't visited. Strict blocks most cross-site trackers but may break some sites. Microsoft's developer documentation says Edge classifies trackers using Disconnect's open-source lists and that Balanced is the default level. Brave describes its Shields as blocking trackers, cross-site cookie tracking and fingerprinting. It also partitions storage for every site you visit.

What still tracks you without them

First-party cookies and logins

Cookies set by the site you are actually visiting are not affected by third-party blocking. Neither is anything you do while signed in. If you are logged in to a retailer, a social network or an email account, that company can connect your activity across its own services and devices through your account, with no cross-site cookie involved.

Fingerprinting

Fingerprinting identifies a browser from its characteristics, such as screen size, installed fonts, hardware and graphics details. Google's ad platform rules, announced December 18, 2024 and effective February 16, 2025, became "less prescriptive" about how partners target and measure ads. The UK Information Commissioner's Office responded on December 19, 2024 that the change meant advertisers using Google's products could fingerprint without breaching Google's rules, and it called this "irresponsible." Its central point for consumers is that fingerprints rely on signals people cannot easily wipe, so clearing cookies may not stop a company from recognizing you again. Apple's Safari 26 announcement described a countermeasure: known fingerprinting scripts are prevented from reliably reading details such as screen dimensions and hardware concurrency.

Bounce tracking and disguised trackers

In bounce tracking, a link briefly redirects you through a tracker's domain. That makes the tracker "first-party" for a moment so it can set or read its own cookie. Chrome's bounce tracking mitigations are on by default only for people who have chosen to block third-party cookies. They delete a redirecting site's stored data if you haven't interacted with it in the last 45 days. CNAME cloaking is a related trick. A tracker runs on a subdomain of the site you visit, such as metrics.example.com, so it looks first-party. Safari's tracking prevention caps cookies set through detected cloaking at 7 days. It also limits cookies created on a landing page reached through a link with tracking IDs to 24 hours.

The opt-out signal coming in 2027

Global Privacy Control (GPC) is a setting that sends every site you visit a "do not sell or share my data" message. It works alongside cookie blocking: GPC is a request, while blocking is a technical barrier. According to the GPC project, Brave and DuckDuckGo support it with the signal on by default, and in Firefox it is available in settings. Firefox's version 120 release notes say the option arrived in that version and is on by default in private browsing.

Whether a site must honor the signal depends on the law where you live:

California: the California Privacy Protection Agency's consumer FAQ says businesses must treat qualifying signals such as GPC as a valid request to opt out of the sale or sharing of personal information. The rule applies only to for-profit businesses covered by the California Consumer Privacy Act. According to the FAQ, that means doing business in California and meeting at least one threshold: gross annual revenue of $26.625 million or more, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning 50% or more of annual revenue from selling or sharing personal information.
Colorado: businesses within the Colorado Privacy Act's thresholds have had to let consumers opt out through GPC since July 1, 2024. The Colorado Attorney General recognized GPC as the first valid universal opt-out mechanism, and it is still the only one on the office's list. The opt-out covers the sale of personal data and its use for targeted advertising.
From January 2027: California's Opt Me Out Act (AB 566), which the CPPA announced on October 8, 2025 after the governor signed it, requires browsers operating in California to offer an easy-to-use opt-out preference signal. The CPPA's earlier summary of the bill describes "functionality configurable by a consumer," meaning a setting you control. Neither CPPA page says the signal must be switched on by default.

Several other states have their own opt-out laws with different scopes and start dates. This section is general information, not legal advice. Your rights depend on your state and on whether a particular business meets the law's thresholds.

Frequently asked questions

Does Chrome's Incognito mode block third-party cookies?

Yes. Chrome's help page says third-party cookies are blocked by default in Incognito. Google said in April 2025 that it planned to add IP Protection to Incognito, which would hide your IP address from some third parties, but it listed IP Protection among the technologies retired in October 2025. Incognito also does not hide your activity from sites you sign in to.

Will blocking third-party cookies break websites I use?

It can. Chrome's help page warns that sites may not work as you expect, and it lets you add exceptions for specific sites. Safari lets an embedded service ask for cookie access through its Storage Access API, with you in control of the answer.

Did Google keep any of its Privacy Sandbox tools?

A few. The October 2025 update said Google would keep supporting CHIPS, which lets an embedded service keep a cookie that is locked to one site, and FedCM, a way to sign in with an identity provider without third-party cookies. It also kept Private State Tokens for fighting fraud. The retired list covered the ad-targeting and measurement tools, such as Topics, Protected Audience and Attribution Reporting, along with IP Protection and Related Website Sets.

Does clearing my cookies stop fingerprinting?

No. A fingerprint is built from your device and browser characteristics, not from stored files, which is why the UK Information Commissioner's Office warned that people cannot easily wipe it. Browsers that limit what known fingerprinting scripts can read, or that randomize some values, reduce how stable the fingerprint is.

Do ad blockers still work in Chrome?

Yes, if the extension is built on Chrome's newer Manifest V3 system. Chrome's extension timeline shows that older Manifest V2 extensions were disabled for all users with Chrome 138 on July 24, 2025, and the policy that let managed company devices keep them was removed with Chrome 139. On August 31, 2026, Google removed the remaining ones from the Chrome Web Store. If an older blocker you rely on has gone quiet, install its current Manifest V3 version or a replacement.

Turn on stronger protection today

Chrome on a computer: open the three-dot menu, then Settings, then Privacy and security, then Third-party cookies, and choose Block third-party cookies. On Android: three-dot menu, then Settings, then Site settings, then Third-party cookies. Add exceptions only for sites that break.
Safari on a Mac: go to Safari, then Settings, then Privacy, and make sure Prevent cross-site tracking is selected.
Firefox: in Privacy and security, keep Enhanced Tracking Protection on (Standard includes Total Cookie Protection) and turn on the Global Privacy Control setting, which tells websites you don't want your data sold or shared.
Edge: go to Settings, then Privacy, search, and services, then Tracking prevention, and consider Strict if you can tolerate occasional site breakage.
Everywhere: sign out of accounts you don't need while browsing, and remove extensions you no longer use.
From January 2027: look in your browser's privacy settings for the new opt-out signal switch and turn it on. California's law requires a setting you can configure, and the state's privacy agency does not describe it as on by default.