Conversion Tracking & Data

First-Party Cookies vs Third-Party Cookies: What Still Works for Tracking

In short: A first-party cookie is set by the site in the address bar; a third-party cookie is set by another domain embedded on it. As of October 2026, Chrome still allows third-party cookies by default, Safari blocks them by default, and Firefox keeps them in a separate jar per site, so ad measurement that has to work everywhere runs on first-party cookies plus a hashed-data or server-side backup.

By the AdFlint research team · Fact-checked against current Google and Meta platform behavior · Last reviewed October 2026

What's the difference between first-party and third-party cookies, and are third-party cookies going away?

A first-party cookie is set by the site shown in your address bar. A third-party cookie is set by a different domain embedded on that page, such as an ad network. As of October 2026, Chrome is not removing third-party cookies: Google proposed user choice instead of deprecation in July 2024 and said on April 22, 2025 that it would keep that approach. Safari blocks them by default, and Firefox gives each site its own cookie jar.

For advertisers, the cookie that matters is first-party. Google's tag and Meta's pixel store your ad click IDs in cookies on your own domain. Those work in Chrome, Safari and Firefox but can expire early in Safari, so both platforms offer first-party backups: Google enhanced conversions and Meta's Conversions API.

First-Party Cookies

Set by the domain a visitor is actually on, readable only by that site, and used for sessions, carts, and measurement.

The browser stores them against your own domain, so they survive the third-party blocking that Safari and Firefox apply by default. Advertisers depend on them for session continuity and for holding click identifiers like the gclid. The limit people miss is lifespan: Safari's tracking prevention caps cookies written by JavaScript at seven days or less, which is why server-set cookies and server-side tagging exist.

Full definition

Third-Party Cookies

Written by a domain other than the one being visited, historically the backbone of cross-site retargeting and frequency capping.

An embedded script from an ad network writes a cookie under its own domain, letting it recognize the same browser across unrelated sites. Safari and Firefox have blocked them by default for years. Chrome's phase-out was repeatedly delayed and then abandoned in 2025, so they still function there, but building new measurement on them is a mistake, since the practical coverage they offer has already collapsed.

Full definition

Are third-party cookies going away? The Chrome timeline, dated

No, not in Chrome. Older pages still say Chrome is phasing them out because that was Google's stated plan as recently as December 2023. The plan changed, and Google's own Google Ads help FAQ still describes the phase-out as "planned for early 2025". Here is what happened, from Google's posts and the UK regulator's case file. As of Plausible's August 2026 update, Chrome has no 2026 deadline for removing them.

Chrome and third-party cookies, Dec 2023 to Oct 2026
DateWhat happenedSource
Dec 14, 2023Google announces Tracking Protection, which restricts third-party cookies by default, tested on 1% of Chrome users from January 4, 2024. The goal: phase out third-party cookies for everyone in the second half of 2024, subject to UK competition concerns.Google
Jul 22, 2024Google proposes that, instead of deprecating third-party cookies, Chrome would let people make an informed choice they can change at any time.Privacy Sandbox blog
Apr 22, 2025Google keeps its current approach: no new standalone cookie prompt. Users choose in Chrome's Privacy and Security settings. The UK Competition and Markets Authority records Google restating it does not intend to deprecate third-party cookies.Privacy Sandbox blog, CMA
Oct 17, 2025Google retires a list of Privacy Sandbox technologies, including Topics, Protected Audience, Attribution Reporting and IP Protection, citing low adoption. CHIPS and FedCM stay. The same day, the CMA issues its decision to release Google's commitments.Privacy Sandbox blog, CMA
Aug 14, 2026Google's status page, last updated this day, lists the web Topics API with a Chrome "Intent to Deprecate and Remove" notice and the Android Topics API as "Scheduled for phaseout". The page gives no removal date.Privacy Sandbox status

How Safari, Firefox, Edge, and Chrome treat third-party cookies

Many pages say "Safari and Firefox block third-party cookies". The Safari half is accurate; the Firefox half isn't. WebKit says Safari blocks all third-party cookies by default and that "there are no exceptions to this blocking", though access can still be granted through the Storage Access API. Safari was the first mainstream browser to do this, in March 2020.

Firefox takes a different route. Since June 2022, Total Cookie Protection has been on by default for desktop users worldwide. It creates a separate cookie jar for each website, so an ad network's cookie still gets written, but the copy on site A can't be read on site B. Mozilla says this confines each cookie to the site where it was created, so trackers can't follow you from site to site.

Edge, per MDN, blocks trackers from sites you haven't visited and known harmful trackers by default. And Chrome, per Chrome Help, blocks third-party cookies by default only in Incognito mode; any user can switch blocking on in settings.

Why first-party cookies still expire early in Safari

The sources we read describe no blocking of first-party cookies in these browsers, but Safari limits how long some of them last. WebKit's current tracking-prevention page lists three caps, and they matter for anyone counting ad conversions:

  1. 1.7 days without interaction: Safari deletes every cookie created in JavaScript, plus all other script-writeable storage, after 7 days in which the visitor doesn't interact with your site. LocalStorage counts as script storage, so moving a click ID there doesn't escape the cap.
  2. 2.24 hours after a click-ID link: when Safari detects link decoration (a tracking ID added to the URL), it caps cookies created in JavaScript on that landing page at 24 hours.
  3. 3.7 days for cloaked server cookies: if a cookie is set in the server response through third-party CNAME cloaking or IP address cloaking (a subdomain of yours that resolves through a CNAME, a DNS alias, pointing at a different domain), Safari caps it at 7 days.

What Google and Meta do with first-party cookies

Google's tag and Meta's default pixel setting both use first-party cookies. Google's conversion tracking help says the Google tag, or the Conversion Linker tag in Tag Manager, stores the ad click from the GCLID in new cookies on your domain. Google says opting out of first-party cookies "isn't recommended as it will lead to less accurate conversion measurement".

Meta's pixel saves an _fbp cookie on your website's domain and stores the ad click ID in an _fbc cookie, per Meta's developer docs. Its business help page says first-party cookies are "more widely accepted by browsers and stored for longer periods of time" than third-party ones, and that the default pixel setting uses both.

When cookies are missing, Google fills the gap with estimates. Its conversion modeling page says advertisers who rely on third-party cookies get modeled conversions for Safari and Firefox traffic, and that Google also models conversions that land after Safari's first-party cookie time limit. So the conversion number in your account can be part count, part estimate.

First-party does not mean consent-free. Under Google consent mode, when a visitor denies analytics_storage, Google tags won't read or write first-party analytics cookies, and when ad_storage is denied, no new advertising cookies may be written. Meta's business tools terms require you to tell visitors how you use cookies.

What a small advertiser should actually do

You can't change what Safari does. You can make sure every ad click is stored first-party and backed up with data that doesn't depend on a cookie. Some items below are settings you can check today. The server-side ones need a connection or infrastructure you control. For the full setup walkthrough, see our small-business conversion tracking guide.

  1. 1.Google: confirm first-party cookies are on. Pass if your Google tag does not set conversion_linker to false, or, in Tag Manager, a Conversion Linker tag fires on the pages people land on from ads.
  2. 2.Google: if the GA4 tag is your only Google tag, Google Ads isn't getting a stored GCLID from it. Google says the GA4 tag no longer preserves the GCLID in a cookie for Google Ads conversion tracking. Add the Google Ads conversion tag, or import your GA4 conversions.
  3. 3.Meta: check the pixel's first-party cookie setting. Pass if it's on the default (first-party and third-party cookies), not third-party only.
  4. 4.Google: turn on enhanced conversions if your thank-you page or form collects an email, phone number, name, or address. It adds that data, hashed with SHA256, to the conversions your tag already sends.
  5. 5.Meta: add the Conversions API alongside the pixel, not instead of it, and send the _fbc and _fbp cookie values in the fbc and fbp parameters when you have them.
  6. 6.Test it: 30 days later, compare platform-reported conversions with your own order or lead records, using the method in the worked example below.
First-party measurement options and what each one needs
OptionWhat it doesWhat it needs
Google tag first-party cookiesStores the ad click from the GCLID in a cookie on your domain.The Google tag, or a Conversion Linker tag in Tag Manager, with first-party cookies left on.
Google enhanced conversionsSupplements your conversion tags with hashed customer data, from website tags or imported offline events.An existing conversion tag plus an email, name, home address, or phone number captured at conversion.
Google Customer MatchReaches and re-engages your customers across Search, the Shopping tab, Gmail, YouTube, and Display.Your own online and offline customer data.
Google tag gatewayServes Google's tags through your own web infrastructure, which acts as a gateway between your site and Google's ad and measurement services.A CDN, content management system, or load balancer you control that can act as the gateway.
Meta pixel first-party cookiesSaves _fbp on your domain and keeps the click ID in _fbc.The pixel's cookie setting left on the default, first-party and third-party.
Meta Conversions APISends conversion events from your server. Meta says this data is less affected by browser loading errors, connectivity issues and ad blockers than the pixel.A server-side connection running alongside the pixel, ideally passing the fbc and fbp values.

Common cookie mistakes to check in your account

Setting the Meta pixel to third-party cookies only. Meta's own description of that option is "less effective in reaching customers" and "less accurate in measurement and reporting".

Turning off first-party cookies in the Google tag with conversion_linker set to false, which Google says leads to less accurate conversion measurement.

Assuming a vendor's server-side setup on a subdomain beats Safari's limits. If the subdomain is a CNAME pointing at a third party, WebKit caps those cookies at 7 days. How the Google tag compares with server-side tagging is covered on its own page.

Treating the Conversions API and enhanced conversions as the same thing. Both send first-party data, but to different platforms, with different inputs: Conversions API vs enhanced conversions lays out the split.

What we couldn't confirm

We found no published removal date or Chrome version for Topics and the other retired APIs; Google's status page, checked October 23, 2026, gives none. We found no primary source on whether the 2024 Tracking Protection test is still running. We have no verified browser market share figure, so check your own analytics for your Safari and Firefox share. We have only WebKit's own wording on when the 24-hour cap applies. The Google and Meta help pages we read don't state how long _gcl_aw, _fbp, or _fbc cookies last.

Side by side.

The differences that actually change what happens in your account.

 First-Party CookiesThird-Party Cookies
Who sets itThe site in the address bar. MDN's test: the cookie's domain and scheme match the page you're on.A different domain whose content (an image, an ad, a script) is embedded on the page. MDN notes "cross-site cookie" is the more accurate name.
Chrome, October 2026Works. The Chrome changes in the timeline below are about third-party cookies.Allowed by default. Blocked in Incognito, or when a user turns blocking on in Chrome's settings.
SafariAllowed, but cookies written by JavaScript are deleted after 7 days without user interaction, or capped at 24 hours on a landing page reached through a click-ID link.Blocked by default. WebKit says there are no exceptions to this blocking; access can only be granted through the Storage Access API and a temporary fix for popups. Blocking since March 2020.
FirefoxTotal Cookie Protection is aimed at cookies set by embedded sites, not the site you're on.Not blocked outright: Total Cookie Protection gives each site its own cookie jar, which stops cross-site tracking. Default for desktop users since June 2022.
What ad platforms use it forStoring the click ID from your ad: Google's tag reads the GCLID into a cookie on your domain, and Meta's pixel stores the click ID in the _fbc cookie.Counting ad impressions and recording interests across many sites, which lets an ad network build a browsing profile.
What Google does when it's missingModels conversions that happen after Safari's first-party cookie time limit.Models conversions for your Safari and Firefox traffic if you rely on third-party cookies there.
Meta pixel settingUsed in the default setting, which runs first-party and third-party cookies together.A third-party-only option exists; Meta says it makes the pixel less effective and less accurate.

What actually separates them.

01

The test is context, not the cookie itself: WebKit says there is no special kind of cookie that makes it third-party. The same Meta pixel can use first-party cookies (saved on your domain) or third-party cookies (belonging to another site), which is why Meta has a setting for each.

02

Browsers treat them differently in 2026: Chrome still allows third-party cookies by default, Safari blocks them by default, and Firefox splits them into a separate jar per site.

03

When a third-party cookie is blocked, the loss is cross-site recognition. When a first-party cookie expires early in Safari, the link between an ad click and a sale after the cap is what gets lost. Google says it models conversions beyond Safari's first-party cookie time limit.

04

Both platforms offer first-party options for blocked or short-lived cookies: enhanced conversions, the Conversions API, Customer Match lists, and serving Google's tags from your own web infrastructure. Google says its ads strategy stays on durable solutions regardless of Chrome's timing.

Which one should you use?

Use First-Party Cookies when

  • You're checking why Google Ads conversions from Safari look low: Safari's caps apply to cookies written by JavaScript.
  • You're storing a GCLID or fbclid from the landing page URL so a later sale can be credited to the ad click.
  • You want Google Ads or Meta measurement that works in Chrome, Safari and Firefox.
  • You're deciding whether to keep the Meta pixel's default cookie setting (keep it: the third-party-only option is the less accurate one, per Meta).

Use Third-Party Cookies when

  • You're auditing an old tag or vendor audience product and need to know where it can still work: Chrome by default, not Safari, and only per site in Firefox.
  • You're explaining why a result built on cross-site cookies looks fine in Chrome but thin everywhere else.
  • You're reading a vendor pitch that says Chrome is about to kill third-party cookies. Check its date against the timeline below.

Worked example: is Safari making a profitable campaign look unprofitable?

Say an online shop has a $60 average order and a 45% gross margin. Gross profit per order is $60 x 0.45 = $27, so the break-even cost per acquisition (CPA) is $27. Spend more than that per order and you lose money on each sale.

In one month the shop spends $1,200 on Google Ads, and the account reports 40 conversions (remember, some of these can be modeled). Reported CPA: $1,200 / 40 = $30. That's $3 over break-even, which looks like a loss of 40 x $3 = $120 for the month.

Now the shop checks its own order records and finds 48 orders that came in through its Google ad links (tagged with a UTM source of google, for example). Real CPA: $1,200 / 48 = $25. That's $2 under break-even, a profit of 48 x $2 = $96. The account was missing 8 of 48 orders, or 16.7%.

The decision flips from "cut the campaign" to "fix the measurement". Run the checklist above, then repeat the comparison next month. The two counts will never match exactly. A rule of thumb, not a Google or Meta figure: once the platform number lands within about 10% of your own records, treat it as close enough to make budget calls from. AdFlint's CPA calculator runs the same division if you'd rather not do it by hand.

Common questions.

Are third-party cookies going away in 2026?

Not in Chrome. Google proposed user choice instead of deprecation in July 2024 and said on April 22, 2025 that it would keep its current approach with no new prompt. Safari has blocked them since 2020, and Firefox has kept them in per-site jars since 2022.

Does Chrome block third-party cookies?

Only in Incognito mode, or when a user turns blocking on in Chrome's settings. Otherwise Chrome allows them by default.

Are first-party cookies going away?

None of the browser changes covered here block them. Safari does shorten how long cookies written by JavaScript last: 7 days without interaction, or 24 hours on a landing page reached through a click-ID link. Google and Meta both build their conversion tracking on cookies stored on your own domain.

Can retargeting work without third-party cookies?

Google and Meta both offer first-party routes. Google Customer Match uses your own customer data to reach people across Search, the Shopping tab, Gmail, YouTube and Display, and Meta's default pixel setting uses first-party cookies alongside third-party ones. We found no primary-source benchmark for how much audience size or ROAS cookie loss costs.

Do first-party cookies need consent?

It can. With Google consent mode, a denied analytics_storage choice means Google tags won't read or write first-party analytics cookies, and a denied ad_storage choice means no new advertising cookies are written. We couldn't confirm the exact legal rule for your country from a primary source.

Sources

Or stop choosing between them.

AdFlint picks the setting, writes the ads, and keeps optimizing inside the Google and Meta accounts you already own.

Try AdFlint freeSee how it works

Related comparisons

All comparisons