For about six years, the Privacy Sandbox was the plan. Google would phase out third-party cookies in Chrome and replace them with a set of browser-based technologies that could target and measure ads without tracking individuals across the web. Ad tech companies rebuilt roadmaps around it, marketers sat through countless webinars about Topics and Protected Audience, and the whole industry braced for the switch. Then, in October 2025, Google retired almost all of it.
A year on, it's worth asking a question the headlines skipped: if the Sandbox was meant to replace cookie-based targeting, what actually replaced the Sandbox? The honest answer is that no new technology stepped in. Instead, targeting power moved to whoever owns logged-in users and first-party data. Understanding that shift, rather than the technical details of APIs that no longer exist, is what matters for planning ad spend in late 2026.
This is general guidance for marketers, not legal advice. Browser and platform policies change quickly; check current documentation and confirm compliance obligations with a qualified professional.
Where this fits
We covered the wider picture in life after third-party cookies: why cookies are unreliable rather than gone, and the privacy-first stack of first-party data, server-side measurement, contextual targeting and consent-based modeling. This piece is narrower. It is a post-mortem of the Privacy Sandbox itself, an explanation of why it failed, and a look at where the targeting power it was meant to protect has actually ended up.
What was retired, and what survived
The end came in two steps. In April 2025, Google said it would not force third-party cookies out of Chrome and would leave them under users' existing browser controls. That removed the deadline the whole project depended on. Then, on October 17, 2025, Google announced it was retiring the remaining Privacy Sandbox advertising technologies, citing low adoption and ecosystem feedback. The retirement covered both Chrome and Android wherever versions existed.
| Technology | What it was for | Status |
|---|---|---|
| Topics | Interest-based targeting from browsing | Retired (Chrome & Android) |
| Protected Audience | Remarketing without cross-site tracking | Retired (Chrome & Android) |
| Attribution Reporting | Conversion measurement | Retired (Chrome & Android) |
| Shared Storage, Private Aggregation, SDK Runtime and others | Supporting infrastructure | Retired |
| CHIPS, FedCM, Private State Tokens | Partitioned cookies, sign-in, fraud signals | Kept |
The survivors are useful plumbing. CHIPS partitions cookies more safely, FedCM supports privacy-friendly sign-in, and Private State Tokens help separate real users from fraud. But none of them targets an audience or measures a conversion. For marketers, the practical outcome is simple: the browser-based replacement for cookie targeting is not coming.
Why it failed
No single flaw sank the Sandbox; several problems fed one another. The first was adoption. Using it meant rebuilding how ads are bought, targeted and measured around unfamiliar interfaces, and many companies were reluctant to invest heavily in technology that looked less effective than what they already had. Smaller ad tech firms, in particular, struggled to keep pace with specifications that kept changing.
The second was trust. The system was designed and controlled by Google, which also runs the largest advertising business on the web. Competitors worried it would tilt the field further toward Google, and regulators, most visibly the UK's Competition and Markets Authority, scrutinised the plans closely. That oversight slowed everything down and never fully resolved the underlying concern.
The third, and probably decisive, factor was urgency. Once Google decided to keep third-party cookies in Chrome, there was little reason for the industry to rebuild around a replacement when the original technology was still available. The Sandbox depended on the cookie actually disappearing. When that stopped being true, so did the case for adopting it.
Calilio
Cloud-based business phone system with virtual numbers, AI call features and pay-as-you-go rates.
Best for: Affordable cloud phone system with AI built in
What actually replaced it
With no browser-level standard, the market filled the gap on its own. The common thread is that targeting moved toward whoever can recognise people directly, because they are logged in, have shared an email address or are shopping on that company's site.
The big platforms. Google, Meta, Amazon and other large ecosystems increasingly target using their own signed-in audiences, and their AI-driven campaign types decide much of the targeting internally. Advertisers supply goals, creative and conversion data; the platform finds the people.
Retail media. Retailers now sell advertising based on what their shoppers actually buy, both on their own sites and increasingly across the wider web. For many brands, that purchase data is more valuable than any interest signal the Sandbox was designed to provide.
Publishers with logged-in audiences. Publishers that know who their readers are, through subscriptions, registrations and newsletters, sell targeting based on their own first-party segments rather than cross-site tracking.
Clean rooms and authenticated identity. Data clean rooms let two companies match their audiences without handing raw data to each other. Identity frameworks built on hashed, consented email addresses offer another route to recognising people across sites, but they only work for people who have signed in and agreed.
Contextual targeting, upgraded. Placing ads by what a page is about has improved a lot, with AI now reading meaning and intent rather than matching keywords. It needs no personal data at all, which makes it the most privacy-proof option on the list.
The shift The Privacy Sandbox tried to keep targeting inside the browser, available to everyone. What replaced it wasn't a technology but a power shift: targeting moved to whoever owns logged-in users and first-party data.
The catch: concentration and fragmentation
There is an irony here. One of the Sandbox's goals was to keep targeted advertising viable on the open web, so that independent publishers and smaller ad tech companies could still compete. Its failure pushes in the other direction. The companies with the most logged-in users and the richest first-party data, which are mostly the largest platforms and retailers, now hold even more of the targeting advantage.
Measurement fragmented too. The Sandbox's Attribution Reporting API was meant to provide a standard, privacy-preserving way to count conversions across the web. With it gone, measurement now depends on a mix of each platform's own reporting, modeled conversions, server-side collection and your own analytics. Each walled garden grades its own homework, which makes honest cross-channel comparison harder and attribution more of a judgement call than ever.
Sort every targeting signal you rely on into three groups:
→ Owned: first-party data you collected with consent, such as customers, subscribers and signed-in visitors. It's durable and fully yours.
→ Borrowed: signals that only exist inside a platform, retailer or publisher. They can be powerful, but you rent them and they can change terms, prices or access overnight.
→ Contextual: signals from the content and moment, not the person. They're privacy-proof and portable across any site.
The warning sign: if nearly all of your targeting sits in "borrowed," a single platform decision can reshape your results. The aim isn't to abandon platforms but to grow the owned and contextual shares so that no one gatekeeper controls your reach.
What hasn't changed: the rules
It's easy to read "cookies stay in Chrome" as "tracking is back to normal." It isn't. Google changed the browser's technical defaults, not the law. In Europe and the UK, non-essential cookies still need consent, and Google still requires Consent Mode v2 for EEA and UK traffic. In the United States, roughly 20 states now require opt-outs from targeted advertising, consent for sensitive data and, in many cases, honoring browser signals like Global Privacy Control, as we covered in US state privacy laws in 2026.
So a cookie that technically works in Chrome still has to be used lawfully, which means proper consent collection, a cookie banner that actually controls your tags, and the foundations in our GDPR and CCPA checklist. Cookies also remain blocked by default in Safari and Firefox, so even setting the law aside, they only ever reach part of your audience.
What marketers should do now
First, stop waiting. Any budget or roadmap time still set aside for Sandbox integration should be reallocated; the APIs are retired, not paused. Second, grow the signals you own. A first-party data strategy built on a consent flow people actually complete is the one asset no browser or platform decision can take away. Owned channels such as newsletters turn anonymous visitors into people you can recognise with permission.
Third, fix measurement at the source. Server-side tracking collects conversion data in a way that survives short cookie lifespans and ad blockers, while still honoring consent. Fourth, diversify. Use the big platforms and retail media where they perform, but test contextual targeting and publisher first-party audiences so your reach doesn't depend on one gatekeeper. Finally, judge results on outcomes you can verify in your own data rather than each platform's self-reported numbers, using the discipline of an end-to-end funnel audit.
The short version
Google spent six years building the Privacy Sandbox as a browser-based replacement for cookie targeting, then abandoned it. In April 2025 it decided to keep third-party cookies in Chrome, and on October 17, 2025 it retired the remaining advertising technologies, including Topics, Protected Audience and Attribution Reporting, across Chrome and Android, citing low adoption. Only CHIPS, FedCM and Private State Tokens survived, and none of them targets ads or measures conversions. The project failed through a mix of weak adoption, distrust of a Google-controlled system, regulatory scrutiny and, finally, the loss of urgency once cookies stayed. Nothing replaced it directly. Instead, targeting power moved to whoever owns logged-in users and first-party data: the big platforms and their AI campaign types, retail media, publishers with signed-in audiences, clean rooms and authenticated identity, alongside a much smarter generation of contextual targeting. That concentrates power and fragments measurement, while privacy rules stay exactly as strict as before. The durable response is to grow owned and contextual signals, measure server-side with consent, and avoid depending on any single gatekeeper.
Want targeting that doesn't depend on one gatekeeper?
We help brands build paid media on owned, contextual and consented signals.
Explore Performance Marketing →Frequently asked questions
Is Google's Privacy Sandbox still active in 2026?
No, not as an advertising project. In April 2025 Google said it would keep third-party cookies in Chrome under users' existing controls rather than phasing them out, and on October 17, 2025 it announced the retirement of the remaining Privacy Sandbox advertising technologies, citing low adoption and ecosystem feedback. The retired list includes Topics, Protected Audience, Attribution Reporting, Private Aggregation and Shared Storage, Protected App Signals, Related Website Sets, SelectURL, IP Protection, On-Device Personalization and the SDK Runtime, covering both Chrome and Android where versions existed. A few pieces survived because they had broader adoption or security value: CHIPS for partitioned cookies, FedCM for privacy-friendly sign-in, and Private State Tokens for fraud signals. None of those surviving technologies provides audience targeting or conversion measurement, so for marketers the practical answer is that the browser-based replacement for cookie targeting is not coming.
Why did the Privacy Sandbox fail?
Several problems reinforced each other. Adoption was low: the ad industry had to rebuild buying, targeting and measurement around unfamiliar APIs, and many companies were unwilling to invest heavily in technology that seemed less effective than what they already had. Trust was a persistent issue, because the system was designed and controlled by Google, which also runs the largest advertising business, and regulators, particularly the UK's Competition and Markets Authority, scrutinised whether it would advantage Google. Smaller ad tech firms found the changing specifications expensive to keep up with. And once Google decided to keep third-party cookies in Chrome, the urgency to switch disappeared: there was little reason to rebuild for a replacement when the original technology was still available. Google itself cited low adoption and ecosystem feedback when it retired the APIs in October 2025.
What replaced the Privacy Sandbox for ad targeting?
No single technology replaced it. Instead, targeting shifted toward whoever holds logged-in users and first-party data. The large platforms, such as Google, Meta and Amazon, increasingly rely on their own signed-in audiences and AI-driven campaign types that decide targeting inside their ecosystems. Retail media networks let brands target based on a retailer's shopper data. Publishers with authenticated audiences offer their own first-party segments. Data clean rooms let two parties match audiences without handing raw data to each other. Some advertisers use authenticated identity frameworks built on hashed, consented email addresses. And contextual targeting has improved considerably, using AI to understand page content and intent rather than tracking the person. Third-party cookies still work in Chrome for users who allow them, but they remain blocked in Safari and Firefox and are increasingly unreliable, so most durable strategies lean on first-party data, contextual signals and platform ecosystems rather than cookies.
Do privacy rules still apply now that cookies remain in Chrome?
Yes, completely. Google's decision to keep third-party cookies in Chrome changed the browser's technical defaults, not the law. In Europe and the UK, placing non-essential cookies and tracking still requires consent under GDPR and ePrivacy rules, and Google still requires Consent Mode v2 for EEA and UK traffic on its advertising and analytics products. In the United States, roughly 20 states now have comprehensive privacy laws that require opt-outs from targeted advertising, honoring signals such as Global Privacy Control in many states, and opt-in consent for sensitive data. So a cookie being technically available in Chrome does not mean you are permitted to use it for every visitor. The end of the Privacy Sandbox removed one potential tool, but the obligations around consent, opt-outs and data minimisation are exactly where they were, and in many places they are getting stricter.
