First-Party and Third-Party Cookies in Ad Tracking

First-party data and first-party cookies now outrank every other identification method advertisers use, cited by 58% of the advertisers, agencies and publishers IAB Europe surveyed in 2025 - ahead of IP matching, third-party cookies, publisher IDs and hashed email. The cookie itself did not disappear; the market simply stopped depending on one signal.

Key Takeaways

• First-party data and cookies lead identification at 58% adoption.
• Third-party cookies sit at 45% adoption, tied with publisher IDs.
• IP address matching reaches 50% of surveyed organizations.
• Google retired ten Privacy Sandbox APIs on October 17, 2025.
• Third-party cookies remain on in Chrome by default, indefinitely.
• Cross-platform data access is the top challenge, cited by 68%.
• Privacy regulation affects 58% of organizations surveyed.
• Signal loss from cookie deprecation still impacts 48%.
• Consent banners are accepted 68.82% of the time on desktop when a visitor interacts.
• Mobile consent acceptance runs higher, at 76.35%.
• 47.01% of desktop visitors register no consent choice at all, up 7.74 points.
• Data Clean Rooms and Unified IDs each exceed 50% adoption in Europe.
• 82% of marketing leaders now prioritize first-party data (Deloitte/Meta).
• First-party personalization cuts acquisition cost by 18%.
• It lifts conversion rate by 27% and spend per customer by 20%.
• US programmatic ad revenue reached USD 162.4 billion in 2025, up 20.5%.
• Total US internet ad revenue hit USD 294.6 billion, up 13.9%.
• Search still holds 38.8% share but growth slowed to 11.0%.

Why one cookie was never going to be the whole answer

The framing that tracking is "the cookie versus no cookie" was always too simple. IAB Europe's first pan-European study, released November 26, 2025 after gathering 79 advertiser, agency, publisher and ad-tech responses across 27 markets between August and September 2025, found organizations running multiple identification layers at once rather than swapping one for another.

First-party data plus first-party cookies leads at 58%, IP address matching sits at 50%, third-party cookies and publisher-based IDs are tied at 45%, and hashed email addresses trail at 43%. Larger-budget organizations run more of these layers simultaneously than smaller ones - the tracking stack, not the single cookie, is the real 2026 unit of measurement.

What actually happened to the third-party cookie in 2025

Chrome's cookie story went through three separate reversals, and conflating them is the most common mistake in a 2026 compliance plan. In July 2024, Google abandoned its original fixed-deadline plan to phase out third-party cookies. In April 2025, it dropped the fallback plan too - a one-time browser prompt asking users whether they wanted third-party cookies on or off - leaving preferences buried in Chrome settings instead. Then on October 17, 2025, Chrome retired ten remaining Privacy Sandbox APIs - Attribution Reporting, Topics, Protected Audience, Protected App Signals, Private Aggregation, Shared Storage, On-Device Personalization, SelectURL, SDK Runtime and IP Protection - across both Chrome and Android.

Three narrower pieces survive: CHIPS (partitioned first-party cookies), FedCM and Private State Tokens. Third-party cookies themselves stay on in Chrome by default, indefinitely, for everyone outside the 1% testing cohort Chrome restricted starting January 2024 to let the ad-tech industry test migration. The GDPR and ePrivacy consent obligation on those cookies is completely unchanged.

The addressability gap surveyed advertisers actually name

Cross-platform data access is the top operational challenge, cited by 68% of IAB Europe's respondents, ahead of privacy regulation at 58% and signal loss from cookie deprecation at 48%. Buy-side organizations feel cross-platform access hardest, at 78%, while publishers report signal loss and audience segmentation as their sharper pain points. More than half of surveyed organizations now adopt or test Data Clean Rooms and Unified ID solutions, with Contextual Data at 46%, Seller-Defined Audiences at 38% and Customer Match at 36%.

A structural gap sits underneath the adoption numbers: nearly nine in ten respondents report only moderate familiarity with addressability, and true expertise concentrates inside ad-tech companies and agencies rather than advertisers themselves. Organizations managing smaller budgets show measurably less in-house expertise than larger ones running the same technologies.

Why the consent banner accept rate is not the real tracking rate

The number marketers quote most - "roughly 70% accept cookies" - only describes people who interact with the banner at all. Commanders Act's Privacy Barometer 2026, built from 2,391 real consent management platform configurations, found that when a visitor does interact, they accept 68.82% of the time on desktop and 76.35% on mobile. But 47.01% of desktop visitors in 2026 generate no signal at all - neither acceptance nor refusal - up 7.74 points from 2025 and now the majority behavior on desktop.

That "no-choice" segment is not hostile; it is unreached. Sector performance diverges sharply: Travel/Tourism posts the highest desktop consent rate at 81.73% because a user booking a trip is already paying attention, while Public Administration shows the highest no-choice rate at 76.22% from passive, often automated traffic.

What first-party data is actually worth when it works

The reason 82% of marketing leaders now prioritize first-party data, per IAB Tech Lab's summary of Deloitte Digital research commissioned by Meta in July 2023, is a measured performance gap. Businesses running tailored, data-driven experiences on first-party data saw an 18% reduction in acquisition cost, a 27% increase in conversion rate, a 20% increase in spend per customer and a 23% increase in customer satisfaction, against untailored control experiences.

IAB Tech Lab's own framing is blunt about the dependency: first-party data "is only usable if it is collected and governed through valid consent" - so the consent infrastructure covered above is not a side issue to first-party strategy, it is the precondition for it. Consent that is collected inconsistently and never passed to downstream analytics, CDP and ad-platform systems breaks the value chain before a single personalization rule ever runs. Our data intelligence practice builds that consent-to-activation pipeline before any tracking or measurement work starts.

Where the ad dollars are actually landing

The tracking debate matters commercially because of where spend is concentrating. IAB and PwC's Internet Advertising Revenue Report for Full Year 2025 put total US internet advertising revenue at a record USD 294.6 billion, up 13.9% year over year. Programmatic advertising - the buying method most dependent on reliable identification signals - grew by USD 27.6 billion to USD 162.4 billion, a 20.5% increase and the fastest-growing major format alongside digital video's 25.4% YoY growth. Search kept the largest single share at 38.8%, though its growth rate slowed to 11.0% from 15.9% the year before as advertisers diversify spend toward AI-driven search and other channels.

How to read your own tracking stack against these benchmarks

Start by counting how many of the five identification layers above your own stack actually uses in parallel - most organizations surveyed run three or more, not one. Then separate your reported consent "accept rate" from your actual reach: multiply the interaction accept rate by the share of visitors who interact at all, and compare that number, not the headline rate, against your broader digital marketing benchmarks. A tracking setup that looks compliant on paper but reaches under half of desktop traffic is not measuring what leadership thinks it is measuring.

Sector context matters too: a travel or booking site sitting on an 81.73% desktop consent rate has a fundamentally different addressable audience than a passive-content publisher buried in no-choice traffic, so benchmark your own customer experience data against sites with a comparable intent profile, not against the industry-wide average.

Finally, treat first-party data investment as a consent-infrastructure project before it is a personalization project. The 18-27% performance gaps only materialize when consent signals survive the trip from banner to CDP to ad platform intact - skip that plumbing and the tailored experience never gets built in the first place.

Frequently Asked Questions

Are third-party cookies actually disappearing in 2026?

No. Google confirmed on October 17, 2025 that it was retiring ten Privacy Sandbox APIs, including Attribution Reporting and Topics, rather than deprecating third-party cookies. Chrome keeps cookies on by default indefinitely, and the only surviving pieces of Sandbox are CHIPS, FedCM and Private State Tokens. The compliance obligation to run a consent banner over those cookies has not changed.

What identification method do advertisers actually lean on most?

First-party data plus first-party cookies, at 58% adoption among the advertisers, agencies and publishers IAB Europe surveyed across 27 markets in 2025. IP address matching followed at 50%, third-party cookies at 45%, publisher-based IDs also at 45%, and hashed email addresses at 43% - a field, not a single winner-take-all replacement.

Why does the consent 'accept rate' overstate how much data gets through?

Because most visitors never register a choice at all. Commanders Act's 2026 barometer, built on 2,391 real consent configurations, found that when someone does interact with a banner they accept it 68.82% of the time on desktop and 76.35% on mobile - but 47.01% of desktop visitors generate no signal whatsoever, up 7.74 points year over year. That silent majority is the real tracking gap.

Does first-party data actually perform better, or is that just a talking point?

Deloitte Digital's July 2023 research, commissioned by Meta, found that businesses running tailored experiences on first-party data saw an 18% reduction in acquisition cost, a 27% increase in conversion rate, a 20% increase in spend per customer and a 23% increase in customer satisfaction. That is the evidence behind the 82% of marketing leaders IAB Tech Lab cites as now prioritizing it.

Where is ad spend actually moving as tracking shifts?

Toward automated buying. IAB and PwC's Full Year 2025 report put US programmatic advertising revenue at USD 162.4 billion, up 20.5% and USD 27.6 billion year over year, inside a total US internet advertising market that reached USD 294.6 billion. Search still holds the largest share at 38.8%, but its growth rate has slowed to 11.0% from 15.9% the year before.

Sources

_{IAB Europe - Pan-European addressability and measurement study, Nov 2025
Google Privacy Sandbox - Third-party cookie exceptions update
TechSpot - Google retires Privacy Sandbox, cookies stay
Secure Privacy - What changes for cookie consent in 2026
Commanders Act - Privacy Barometer 2026
IAB Tech Lab - First-party data begins with consent
IAB / PwC - Internet Advertising Revenue Report, Full Year 2025}