Skip to content
Get in touch

Third-party cookies and first-party data

| Article: 3 min read | Privacy and law

Third-party cookies are cookies set not by the site the visitor opened but by someone else's content embedded on it, for example an advertising pixel or a widget. They make it possible to track a person across different sites. First-party data is what a company collects itself about its customers and visitors: orders, subscriptions, behavior on its own site.

This is not legal advice: below is what the sources say, with links.

What happened in Chrome

For years Google planned to remove third-party cookies from Chrome. But on 17 October 2025 Google announced that Chrome keeps its current approach to user choice about third-party cookies, meaning they are not being removed. At the same time Google is winding down most Privacy Sandbox technologies: the Attribution Reporting API, Protected Audience, Topics, Related Website Sets, IP Protection and others. CHIPS, FedCM and Private State Tokens continue to be developed (Google Privacy Sandbox, 17.10.2025).

There are no more recent official Google statements about changing this policy in 2026. So there is no "end of third-party cookies" in Chrome, but that doesn't mean tracking has become easier.

Why it still matters

  • Safari blocks all third-party cookies by default, with no exceptions. In addition, after 7 days without interaction with a site, Safari deletes cookies and storage created by script (JavaScript), and cookies created after following a link with click identifiers are limited to 24 hours. For cookies set via CNAME to a third-party tracker, the lifetime is also limited to 7 days (WebKit, Tracking Prevention).
  • Laws. For EU visitors, both third-party and first-party cookies for analytics and advertising require consent: Art. 5(3) of Directive 2002/58/EC does not distinguish them by origin (Directive). The EDPB notes that the rule also covers new tracking methods that have appeared to replace cookies (EDPB, Guidelines 2/2023).

First-party data for a store

First-party data gives you independence from other people's cookies, but requires honest collection and permissions:

  • Accounts and orders: email, phone, purchase history: the basis for CRM, RFM segments and repeat sales.
  • Subscriptions and newsletters with consent.
  • Events on the site in your analytics (product view, cart, checkout), see cart abandonment.
  • Passing data to ad accounts. Example: in Google Ads, "enhanced conversions" supplement conversion data with hashed first-party data, such as an email; SHA256 hashing happens before the data is sent to Google (Google Ads Help). The page doesn't explain consent requirements; check them separately (GDPR, Consent Mode).

First-party data is also personal data if it can identify a person: the rules of GDPR and the Ukrainian law apply to it.

Common mistakes

  • Assuming "first-party cookies" are automatically allowed: for analytics and advertising in the EU, consent is needed.
  • Collecting emails "just in case" with no purpose and no notice.
  • Building a strategy on the idea that a third party is "about to" disappear or, on the contrary, will never change: policies change, as Chrome's history showed.
  • Forgetting about Safari and other browsers.

FAQ

Has Chrome removed third-party cookies? No. On 17 October 2025 Google announced that Chrome keeps its current approach and is not abandoning third-party cookies.

What happened to Privacy Sandbox? Google is winding down most of its technologies, including Topics and Protected Audience; CHIPS, FedCM and Private State Tokens remain.

Does Safari block third-party cookies? Yes, by default, with no exceptions (according to WebKit documentation).

What is first-party data in plain words? Data you collect yourself about your customers: orders, subscriptions, events on your site.

Is consent needed for first-party cookies? Not for those necessary for the site to work; for analytics and advertising ones in the EU, yes.

Sources

Share

Related

  • Selling abroad from Ukraine: logistics, duties, payments

    | Article: 4 min read

    Cross-border e-commerce is selling goods to buyers in another country through your own site or a marketplace. For a Ukrainian store this means three separate tasks: getting the goods across the border, handling the duties and taxes of the buyer's country…

  • Personal data in Ukraine

    | Article: 4 min read

    Personal data in Ukrainian law is information or a set of information about an individual who is identified or can be specifically identified. Its processing is regulated by the Law of Ukraine "On Personal Data Protection" of June 1, 2010, No. 2297-VI. A new…

  • Returning goods to an online store

    | Article: 5 min read

    A product return is the process in which a shopper gives a purchased item back to the seller and receives money or an exchange. In Ukraine, the shopper's rights are defined by the Law "On Consumer Rights Protection," and the rules for returning an online…

  • PRRO and fiscalization for an online store

    | Article: 4 min read

    A PRRO (software cash register, "програмний реєстратор розрахункових операцій") is a program registered on the tax authority's fiscal server, through which the seller carries out a payment and creates a settlement document (a fiscal receipt) (Law No.…