TL;DR: Chrome kept third-party cookies, but Safari has blocked them since March 2020, and Safari is 28.98% of North American browser traffic. Retargeting without cookies means rebuilding on four signals: server-side events, hashed first-party identifiers, platform engagement audiences, and contextual intent. Here is the five-step order we run.
What actually broke, and what didn’t
Chrome never killed the third-party cookie.
On April 22, 2025, Google’s Privacy Sandbox team announced it would “maintain our current approach to offering users third-party cookie choice in Chrome,” with no new standalone prompt. The phase-out that the ad industry planned around for five years simply stopped.
Six months later Google went further. On October 17, 2025, it announced it was retiring 10 Privacy Sandbox technologies, including Topics, Protected Audience, and the Attribution Reporting API. Only CHIPS, FedCM, and Private State Tokens continue.
So the old system stayed, and the replacement died. That reads like a reprieve. It is not one.
Retargeting already broke. It broke browser by browser, starting in 2020, and most ad accounts never adjusted the plumbing underneath.
Safari is where your list disappears
Apple shipped full third-party cookie blocking in Safari 13.1 on March 24, 2020. WebKit engineer John Wilander put it plainly: “Cookies for cross-site resources are now blocked by default across the board.”
The same release capped script-writable storage at seven days. That covers cookies written by JavaScript, LocalStorage, IndexedDB, and Service Worker registrations. A Safari visitor who does not return inside a week looks like a brand new person to your tags.
Now size the hole. Statcounter measured Safari at 28.98% of North American browser traffic in August 2026. Firefox, which also blocks third-party cookies by default, added 3.89%. Chrome held 55.06% and Edge 7.3%.
Roughly a third of your North American traffic sits behind default cookie blocking. Not in 2027. Today, in every account you run.
That is what retargeting without cookies actually means. It is not a planning exercise for next year. You lost a third of your audience six years ago and have been buying it back at full price ever since.
The four signals that still work
Cookieless retargeting is not one replacement technology. It is four separate signals, stacked. Each one covers a gap the others leave open.
| Signal | Survives Safari | What it needs | Where it breaks |
|---|---|---|---|
| Third-party pixel audience | No | Tag on site | Blocked by default in Safari and Firefox |
| Server-side events | Yes | Server endpoint, event_id deduplication | Double counting when dedup is misconfigured |
| Hashed identifiers | Yes | Email or phone capture, SHA256 hashing | Thin lists, 540-day membership cap |
| Platform engagement audiences | Yes | Active organic, video, and lead form presence | Colder intent, smaller volume |
| Contextual and search intent | Yes | Keyword research, creative rotation | No person-level frequency control |
1. Server-side events
A browser can block a script. It cannot block a request your own server makes.
Server-side tracking sends the conversion event from your backend straight to the ad platform. Meta calls this the Conversions API. Google’s equivalent paths are enhanced conversions and server-side tagging. The event carries the same payload the pixel would have carried, minus the parts the browser strips out.
Run it alongside the browser pixel, never instead of it. Then deduplicate. Meta’s documentation is specific: the pixel’s eventID must match the Conversions API event_id, and the pixel event must match event_name. Meta only deduplicates inside a 48-hour window from the first event it receives.
Get that wrong and you double count every purchase, which corrupts bidding for weeks. Get it right and you recover events the browser dropped. For a Shopify store this is the highest value fix on the board, and our walkthrough of the Meta Conversions API setup for Shopify stores covers the exact field mapping.
Meta publishes its own figures on advertiser results after Conversions API adoption. Meta’s own published figure is an average, not a median, and it compares having a Conversions API setup to having none: in its April 2026 Pixel and Conversions API announcement, Meta reported that advertisers with a Conversions API setup for web events “saw an average 17.8% lower cost per result compared to those without Conversions API.”
2. Hashed first-party identifiers
Your customer gave you an email address. That identifier is durable, and it does not expire in seven days.
Google Ads enhanced conversions takes first-party data captured in your conversion tag, hashes it with SHA256, and sends only the hash. Google matches that hash against signed-in Google accounts to attribute the conversion. The raw email never leaves your site.
The same identifiers build Customer Match lists, and those lists are the backbone of cookieless retargeting. Membership does not depend on a browser at all. Google caps membership duration at 540 days, so a list refreshed on a schedule stays alive indefinitely.
The practical implication is simple. Every form, every checkout, and every gated download should write a hashed identifier into your audience layer. If you sell on Shopify, our guide to Shopify conversion tracking with GA4, enhanced conversions, and the Conversions API covers the tag order that makes this fire reliably.
3. Platform-owned engagement audiences
The cleanest cookieless audience is one that never touched your website.
Meta knows who watched half your video, who opened your lead form, who saved your Instagram post, and who messaged your page. Google knows who watched your YouTube channel and who engaged with your Shopping listings. None of that needs a cookie on your domain, because the interaction happened inside the platform.
These audiences are underused because they sit further from purchase. They do. They are also the only warm audience that survives Safari completely untouched.
Smaller accounts gained an advantage here recently. Google Ads now requires only 100 active users in the last 30 days for a data segment to serve on Search, Display, or YouTube, down from the old 1,000-user threshold on Search. Lists that were unusable two years ago are eligible now.
4. Context and sequence
When you cannot follow the person, follow the intent.
Search retargeting through RLSA still works wherever the list exists. Where it does not, bid on the mid-funnel query instead: comparison terms, “vs” terms, sizing and spec queries, and review terms. You buy the same moment without needing to identify the same person.
Creative sequencing handles the rest. Instead of one retargeting ad chasing everybody, run three: proof, objection, offer. Rotate them on a fixed schedule rather than on a per-user frequency cap you can no longer measure accurately.
The five-step rebuild
This is the order we run it in. Order matters, because step four is worthless if steps one and two are broken.
Step 1: Audit what is firing today
Open the network tab in Safari, not Chrome. Complete a real purchase or form fill. Watch which requests succeed and which quietly fail.
Then compare platform-reported conversions against your back office numbers for the same period. A gap between Meta’s reported purchases and your actual order count is normal for a pixel-only setup. That gap is your recoverable volume, and it is the number that justifies the engineering work.
Step 2: Ship server-side events with deduplication
Stand up the Conversions API for Meta and enhanced conversions for Google. Send a matching event_id on both the browser event and the server event. Confirm deduplication in Meta Events Manager before you touch anything else.
Do not skip that verification step. A silently doubled purchase event teaches the bidding algorithm the wrong lesson, and you will not notice until ROAS collapses.
Step 3: Capture identifiers everywhere
Email capture is a retargeting investment, not a newsletter tactic. Add capture at checkout, on quote forms, on intake forms, and behind any gated asset.
For law firms, the intake form is the retargeting list. For eCommerce, the abandoned cart email field is doing double duty. Both should be feeding your audience layer automatically, not sitting in a CRM nobody syncs.
Step 4: Rebuild audiences on lists, not pixels
Replace cookie-based site audiences with Customer Match and platform engagement audiences wherever you can. Keep the pixel audiences running as a supplement, because Chrome traffic still populates them at 55.06% of the market.
Segment by value, not just recency. Past purchasers, high-value purchasers, and non-converting leads deserve different budgets, different bids, and different creative.
Step 5: Reset durations and measure at the account level
Stop leaning on long cookie windows you no longer have. Judge retargeting on account-level results: blended ROAS, blended customer acquisition cost, and total qualified leads against total spend.
Platform-reported ROAS in a fragmented tracking environment is a directional number. Your bank account is not.
What the numbers look like in real accounts
Our 2026 benchmarks come from accounts we manage, not from industry surveys.
Meta CPM across our portfolio hit $11.54, up 38% year over year. Meta CTR sits at 0.90% and is still declining on creative fatigue. Meta conversion rate is 1.85%, which is the post-iOS 14 baseline, not the 2019 one. Google Search averages $2.32 CPC, 4.23% CTR, and 3.48% conversion rate.
Read those two lines together. Meta media costs 38% more than it did last year, while measurement is weaker than it was. That combination is why retargeting hygiene now moves more money than pumping out extra creative does.
Here is what it looks like when the plumbing is right. Wish Rock Relaxation runs 10x ROAS at over $80K per month, with conversion rate up 62%. We Love Eyes holds 10x ROAS with blended customer acquisition cost down 28% and Amazon orders up 340%. Zager Guitars scaled from $300K to $1.5M per month at 8.4 blended ROAS.
Across 250-plus clients and $61M-plus in managed spend since 2017, our average conversion goal lift is 41%.
Four mistakes that quietly kill cookieless retargeting
- Running the Conversions API without deduplication. Your conversion count inflates, your reported ROAS looks great, and your real revenue does not move. Check event_id matching first, always.
- Treating platform-reported ROAS as truth. Each platform now models a portion of what it reports. Reconcile against Shopify, your CRM, or your billing system monthly.
- Letting Performance Max absorb the retargeting budget. Our benchmark data shows Performance Max cannibalizes Shopping in more than 80% of the accounts we audit. It will happily eat your warmest traffic and bill you for it.
- Treating retargeting as one audience. A cart abandoner and a blog reader are not the same person at the same stage. One list, one bid, and one creative wastes most of the budget.
B2B has a different problem
For B2B advertisers, the cookie is not the main constraint. The sales cycle is.
A 90-day cycle with six touchpoints across three people at one company will never resolve cleanly in a last-click report, cookies or not. The fix is an attribution model that matches the cycle length. Our comparison of B2B attribution models from first-touch to data-driven walks through how to choose one.
Retargeting still matters in B2B. It just gets measured differently. Judge it on pipeline created and demos booked, not on view-through conversions inside the ad platform.
All of this connects into the wider measurement, tracking, and attribution playbook, which covers the full stack from tagging through model selection.
Get a written read on what your tracking is missing
Most accounts we audit are losing conversions somewhere between the browser and the platform. It is usually one of four things: no server-side events, broken deduplication, no hashed identifiers, or audiences built entirely on pixels.
Our free PPC audit is a 47-point written PDF, delivered in five business days, with no sales call required. We tell you which of those four is costing you money and what order to fix them in.
Sources
- Google Privacy Sandbox, “Next steps for Privacy Sandbox and tracking protections in Chrome,” April 22, 2025
- Google Privacy Sandbox, “Update on Plans for Privacy Sandbox Technologies,” October 17, 2025
- WebKit, John Wilander, “Full Third-Party Cookie Blocking and More,” March 24, 2020
- Statcounter Global Stats, Browser Market Share North America, August 2026
- Meta for Developers, “Deduplicate Pixel and Server Events,” Conversions API documentation
- Google Ads Help, “About enhanced conversions”
- Google Ads Help, “About audience segments in Audience manager”
- Google Ads Help, “About Customer Match” (540-day membership duration)
- iClick Advertising, 2026 PPC Benchmarks (first-party data from iClick-managed accounts, 2024 to 2025)
- iClick Advertising, Client Case Studies (Wish Rock Relaxation, We Love Eyes, Zager Guitars)
- Meta for Business: Pixel and Conversions API updates announcement (April 15, 2026)
Frequently asked questions
Does retargeting still work now that Chrome kept third-party cookies?
Yes, but not the way it did in 2019. Chrome keeps third-party cookies, so roughly 55% of North American traffic still works the old way. Safari and Firefox together account for about 33% and block them by default. Build on server-side events and hashed first-party lists so both halves of your audience stay reachable.
What is the fastest cookieless retargeting fix for an eCommerce store?
Ship server-side conversion events with proper deduplication. For Meta that means the Conversions API with a matching event_id on both the pixel and the server event. Verify deduplication in Events Manager before you scale spend. Bidding improves once the platform sees complete data, and the recovered event volume usually shows up within two weeks.
Is Customer Match better than pixel-based retargeting?
It is more durable, not automatically better. Customer Match uses hashed emails and phone numbers, so it works regardless of browser cookie policy, with a 540-day maximum membership duration. Pixel audiences still capture Chrome visitors who never gave you an email address. Run both, and segment your lists by customer value rather than recency alone.
How small can a retargeting audience be in Google Ads?
Google Ads now needs only 100 active users in the last 30 days for a data segment to serve on Search, Display, or YouTube. That is down from the old 1,000-user requirement on Search. Small first-party lists that were unusable two years ago are eligible now, which helps law firms and niche stores the most.
Should we still build on Privacy Sandbox APIs like Topics?
No. Google announced on October 17, 2025 that it is retiring Topics, Protected Audience, the Attribution Reporting API, and seven other Privacy Sandbox technologies. Only CHIPS, FedCM, and Private State Tokens continue. Do not put a measurement roadmap on the retired APIs. Spend that engineering time on server-side tagging instead.
