Privacy Sandbox is being removed and cookies survived

Google is removing Privacy Sandbox from Chrome and third-party cookies are still enabled by default. If your measurement plan still opens with a slide about cookie deprecation, it is describing a future that was cancelled.

The dates matter, so here they are. On 17 October 2025 Google announced it was retiring the remaining Privacy Sandbox APIs: Attribution Reporting, Topics, Protected Audience, IP Protection, Related Website Sets, Shared Storage, Private Aggregation, Protected App Signals and SDK Runtime. Deprecation landed in Chrome 144 in January 2026. Removal lands in Chrome 150 in July 2026. Third-party cookies remain on by default under a user-choice model, following the April 2025 decision not to ship a standalone prompt at all.

Six years of industry preparation for an event that did not happen.

What this actually changes for you

Three things, in order of how much money they involve.

First, stop budgeting for Sandbox migration work. Any statement of work that includes Topics API readiness, Protected Audience integration or Attribution Reporting API pilots is billing you to build against code that is being deleted. Cancel it and redirect the hours.

Second, do not conclude that tracking is fine. This is the trap. Chrome kept third-party cookies, and Chrome is not where your measurement broke.

Safari broke it, years ago, and quietly. Intelligent Tracking Prevention caps first-party cookies written by JavaScript at seven days. When a visitor arrives through a link carrying tracking parameters from another site, that cap drops to 24 hours. Safari is over half of mobile browsing in this country. So a buyer who clicks your ad on an iPhone, comes back nine days later and converts, arrives as a brand new direct visitor no matter what Chrome does about third-party cookies.

That is not a policy problem you can wait out. It is a technical one, and it has a technical fix: set identifiers server-side with an HTTP response header rather than in the browser with JavaScript. Cookies set that way are not subject to the seven-day cap.

Third, keep going with first-party infrastructure, because the reasons for it were never really about Chrome. Ad blockers, script blockers, browser extensions, corporate networks and iOS Mail privacy all sit between your site and Google's servers. First-party serving reduces that gap. Google's own Tag Gateway exists precisely for this and takes days to deploy rather than months.

The roadmap that replaces the dead one

Here is what a serious 2026 measurement plan looks like once you delete the Sandbox slides.

Consent handling that is technically correct. Google Tag consent mode is now the thing that governs whether GA4 shares identifiers with your linked Google Ads accounts, following the June 2026 change that made ad_storage the sole control. Audit what your banner actually sets, in the network tab, on a real page. Do not trust the tag diagnostics screen, which reports on a 48 to 72 hour lag.

First-party tag serving. Serve your Google tags from your own domain through a supported CDN. No change to the on-page snippet, meaningful recovery in measured conversions, and cookies that survive Safari's cap.

Enhanced conversions and first-party uploads. Hashed customer data sent server-side from your CRM. As of 1 April 2026 those uploads run through Google's Data Manager API, and anything still calling the old path stopped working.

Incrementality, not attribution theatre. Last-click and data-driven are the only two models left in the Google stack. Neither one tells you whether the revenue would have happened anyway. Geo holdout tests do. So does marketing mix modelling, which Google now embeds inside Analytics 360 through Meridian.

Data retention that outlives the platform. Turn on the BigQuery export from GA4 if you have not. The event-level data lands raw and stays yours regardless of what any interface does to lookback windows or reporting identities.

The honest limitation

None of this restores the visibility marketers had in 2018 and nothing will. A meaningful slice of your buyers will always arrive unattributed: they saw a video, asked an assistant, remembered a name, typed it in six weeks later. Server-side infrastructure narrows the gap. It does not close it.

The correct response is to stop trying to attribute every dollar and start testing whether spend causes revenue. That means holding out regions, turning channels off deliberately for defined windows, and accepting a measurement approach that gives you a confidence interval instead of a number that looks precise and is not.

What to do this week

Pull every document, deck and vendor contract that mentions cookie deprecation. Mark the parts that are now false. There will be more than you expect, and some of them will be plans you are still being invoiced for.

Then check one thing on your own site: open the network tab, load a page, and see whether your Google tag is being served from your domain or Google's. That single answer tells you how much of your measurement is exposed to everything sitting between your visitor and Google.

The industry spent six years preparing for a deadline and skipped the work that was actually load-bearing.