Google Officially Ends the Privacy Sandbox. The Third-Party Cookie Wins.

For six years, Google promised to kill the third-party cookie. This week it finally admitted what everyone already knew: it will not. In a Tuesday update, Privacy Sandbox vice president Anthony Chavez announced that Google "will not be rolling out a new standalone prompt for third-party cookies" in Chrome, and will instead "maintain our current approach to offering users third-party cookie choice in Chrome."

Translated from the press-release register: the tracking technology that has followed you around the web for three decades stays right where it is, enabled by default, managed through the same settings page in Chrome's Privacy and Security menu. One of the most ambitious rewrites of the web's advertising machinery ends not with a launch, but with a shrug.

What Google actually said

The update is modest in substance but decisive in meaning. Google had planned a one-time standalone prompt in Chrome, a clear choice asking users whether third-party cookies should keep working across the web. That prompt was already a retreat: in April 2025, the company said it would freeze the status quo rather than disable cookies outright. Now even the prompt is gone.

Chavez's stated reason: after engaging with publishers, developers, regulators, and the ads industry, "it remains clear that there are divergent perspectives on making changes that could impact the availability of third-party cookies." Everyone disagrees, so nothing changes.

Reaction was swift. The Movement for an Open Web, the ad-tech coalition that filed a complaint with the UK's Competition and Markets Authority back in 2020, called the announcement an "admission" that the Privacy Sandbox is over. Co-founder James Rosewell said Google had "recognised that the regulatory obstacles to their monopolistic project are insurmountable and have given up."

Google spent six years building a replacement for the cookie. The industry never showed up, the regulators never signed off, and the users never noticed.

How six years came to this

Privacy Sandbox began in 2019 as Google's answer to a real problem. Safari and Firefox had already started blocking third-party cookies by default, and regulators were circling. Google's plan was elegant on paper: instead of cookies following you across sites, Chrome would process your interests on your own device, group you into anonymous cohorts, and share only coarse signals with advertisers. The flagship piece, the Topics API, rolled out in Chrome in 2023. Companion APIs followed: Protected Audience for remarketing, Attribution Reporting for measuring ad effectiveness, CHIPS for partitioned cookies, FedCM for privacy-friendly sign-ins.

The timeline slipped, repeatedly. Google first promised cookies gone by 2022, then 2023, then 2024. In 2024 it abandoned the full-disable plan in favor of a user-choice prompt. In April 2025 it shelved even that prompt. In October 2025 it began phasing out the advertising APIs themselves, Topics, Protected Audience, and Attribution Reporting, keeping only a handful of platform features: CHIPS, FedCM, and Private State Tokens.

Meanwhile the lawyers kept the project in permanent limbo. The UK's Competition and Markets Authority spent years reviewing each proposal over concerns that a Google-designed cookie replacement would tilt the ad market toward Google. In the United States, a federal judge ruled that Google "willfully engaged in a series of anticompetitive acts" in the ad-technology market. Google was simultaneously the company designing the replacement and the biggest seller of the thing being replaced.

Why the replacement never took

The core failure was never the engineering. It was trust, and adoption.

Advertisers simply did not adopt the alternatives. Figures presented at a W3C advertising group meeting in March 2026 showed roughly 8 percent of top-1,000 Chrome advertisers had completed testing of the Topics API, 12 percent for Attribution Reporting, and 15 percent for Protected Audience. Years after launch, the replacements were still pilot projects. Even a 2024 experiment that limited cookies for roughly 30 million Chrome users failed to move the industry off the old rails.

Publishers and privacy advocates attacked the plan from opposite directions. Ad-tech firms argued the Sandbox would degrade targeting while handing Google a structural advantage, since Google sits on first-party data from Search, YouTube, and Android that no browser API can replicate. The Electronic Frontier Foundation told users to opt out of the program, arguing the system was "still tracking your internet use for Google's behavioral advertising," privacy theater with a Google logo.

And regulators never gave a final green light. Every iteration of the plan drew another investigation, another review, another set of conditions. Building the cookie's replacement inside the browser owned by the world's largest advertising company turned out to be the worst possible governance structure for winning trust.

What happens now

For Chrome users, almost nothing changes. Third-party cookies remain enabled by default, and if you want them gone, you already had options: Safari and Firefox block them by default, and both have for years. Chrome's existing Privacy and Security settings offer the same per-site and per-category controls they always have.

For the ad industry, the signal is unambiguous: the cookie lives, and the alternatives are museum pieces. CHIPS, FedCM, and Private State Tokens survive as infrastructure for sign-ins, partitioned storage, and fraud detection, but Google's grand plan to rebuild ad tech on device-side privacy APIs is finished.

The irony is sharp. After six years of regulatory warfare, engineering prototypes, and blown deadlines, the web's advertising model is largely unchanged. What changed is that everyone now knows Google could not kill the cookie alone, and nobody else trusted it to do it at all. The status quo was always the most likely ending. This week it just became official.