Privacy Sandbox Alternatives Now That Chrome Cookies Stay

Google confirmed this week that Chrome will not deprecate third-party cookies and will not ship the consent prompt it had planned to pair with that change. The Privacy Sandbox, the set of cookie-replacement APIs Google has spent four years building, now has a narrower job than the one Google hired it for. So which of last year's work still earns its keep? That's the useful question for UA teams that piloted Privacy Sandbox alternatives against web shop attribution.

This is not a return to the pre-2020 web. Cookies survive, but browser defaults and regulatory pressure still constrain third-party tracking, and Apple's own restrictions on WebKit haven't moved. What has changed is urgency. The deadline that made Privacy Sandbox testing feel mandatory has gone, which means some of that work is still worth keeping and some of it was only ever a hedge against a date that kept slipping anyway.

What Google actually reversed

Google said it will not deprecate third-party cookies in Chrome and will not introduce the new consent step it had been designing to sit alongside that change. That consent prompt, which would have asked Chrome users directly whether they wanted tracking across sites to continue, had drawn criticism from regulators and ad tech firms alike over how neutral its wording could be. With deprecation off the table, that argument is moot.

None of this kills the underlying APIs. Attribution Reporting and Topics, along with the rest of the Privacy Sandbox suite, remain live in Chrome for sites that choose to use them; what shrinks is the mandate. Google's own timeline for Privacy Sandbox on both Chrome and Android has already slipped repeatedly since 2022, and this reversal reads as the clearest sign yet that cookie deprecation, specifically, is no longer the forcing function behind any of it.

Separate the Chrome announcement from the Android side of the Privacy Sandbox, which governs how apps, rather than websites, share signals for attribution and fraud checks. Nothing in this week's news changes the Android APIs directly. But the Chrome reversal removes the closest thing Google had to proof that its browser-side privacy roadmap would actually ship on schedule, and that context matters when deciding how much weight to put on Android commitments that have not yet arrived either.

Why this mattered for web shop attribution

Game publishers have spent the past year building out web checkout flows, first to comply with DMA link-out rules in the EU and now, increasingly, wherever platform terms allow it. A web checkout sits outside SKAdNetwork and AdAttributionKit. Its attribution depends on browser-side signals, and browser-side signals are exactly what the Privacy Sandbox set out to replace once cookies went away.

As we noted in Web Shop Attribution Basics as Link-Outs Go Live in the EU, most of that measurement already ran on a patchwork of first-party pixels and server-side postbacks, with discount-code matching on top, rather than anything Privacy Sandbox native. Teams that built Privacy Sandbox alternatives on top of that patchwork, rather than instead of it, are in the better position this week. Teams that treated the Attribution Reporting API as the eventual system of record have more to unwind, and the unwinding won't be quick.

A decision framework for choosing Privacy Sandbox alternatives

Not every Privacy Sandbox alternative deserves the same treatment now that the clock has stopped. A simple three-way split works for most UA and measurement teams reviewing their roadmap this quarter.

Keep and prioritise: first-party data capture at checkout (email, logged-in state, loyalty identifiers) and server-side conversion APIs. Both reduce dependence on any single browser mechanism and pay off whether or not cookies eventually go away.

Keep but deprioritise: live Attribution Reporting API pilots. They still produce event-level data that is hard to get elsewhere, and pausing them entirely throws away real learning, but they no longer justify pulling engineering time from other work this quarter.

Retire or shelve: audience-building work built specifically around the Topics API, and any consent-flow redesign that assumed the prompt Google has now cancelled. Both existed for a deadline that no longer exists.

Run that split as an actual meeting, not a hallway decision. Ask each API owner on your measurement team to state, in one sentence, what the API was for and whether that job still exists without a deprecation deadline behind it. If the answer only makes sense in a world where cookies disappear on a fixed date, retire it. If the answer holds regardless of what Chrome does, it belongs in the keep column, and this week's news is a reason to fund it properly rather than treat it as insurance.

Worked example: a mid-size puzzle publisher running a web shop for EU and, since April, opportunistic US traffic built three pieces of Privacy Sandbox infrastructure last year: a Topics-based lookalike audience, an Attribution Reporting integration for post-click conversions, and a consent-prompt variant aimed at the Google step that has now gone. Under the framework above, the lookalike audience gets shelved because direct-response games UA rarely benefits from cohort-level interest signals over individual conversion data. The Attribution Reporting integration stays live at reduced priority because it still fills a gap that server-side postbacks alone do not close. The consent-prompt work simply comes off the roadmap.

What to stop doing now

Two things deserve killing outright. First, any "cookie deprecation day" runbook, the kind of document that lists what breaks and when the browser flips a switch; there is no switch flipping, so the document describes nothing. Second, consent-copy testing aimed at Google's cancelled prompt, work that now has no destination.

What should not stop is basic web measurement hygiene: server-side tagging; deduplication between app and web conversions; and clear ownership of the web shop funnel inside the same team that owns app attribution. None of that was ever contingent on Privacy Sandbox timing, and all of it gets harder to retrofit the longer a web shop runs without it.

Google's history with the Privacy Sandbox is one of repeated delay dressed up as reform, and this week's announcement fits that pattern closely enough that treating it as final would be its own mistake. The teams that come out ahead will keep the parts of their Privacy Sandbox alternatives that were good measurement practice regardless of the deadline, and quietly retire the parts that only ever existed to survive one.

Related archive reading

These articles provide related context and remain subject to their stated review status.

• Privacy Sandbox Retirement: What Buyers Actually Lose
• The Ledger #9: Contempt, DMA Fines and a Sandbox U-Turn