UNDERCOVERLABIn 2024 half the industry got ready for a funeral. Google had announced it would block third-party cookies in Chrome and everyone rushed to catch up. Then Google backtracked. The funeral was called off, but plenty of people had already paid for the coffin. It's worth telling what really happened, because the lesson isn't the one it seems.
What was announced and what came next
Let's recall the sequence without dressing it up. In 2024 Google said it would phase out third-party cookies in Chrome, the browser most people use. Those cookies are the ones that let an advertiser follow you from one site to another, the ones propping up much of digital advertising and retargeting. The announcement set the whole sector in motion: consultancies, tools, certifications, webinars. Everyone had to get ready for a world without that data.
In July 2024 Google changed the script. Instead of blocking the cookies, it would let each user choose through a prompt inside the browser. It was no longer a withdrawal, it was a choice. And in 2025 Google confirmed the line: it wouldn't introduce that new prompt and it wouldn't remove third-party cookies. It would keep them. The timeline half the sector had taken for granted dissolved.
The funeral was called off, but plenty of people had already paid for the coffin.
Why many companies panicked too much
The problem wasn't getting ready. The problem was organising around a timeline they didn't control. When a giant announces a date, the market treats it like a law of physics. Projects get set up, services get contracted, decisions get made assuming that day will arrive exactly as stated. And then the giant rethinks, because it has regulators on its back, angry advertisers and an advertising business to defend, and the date vanishes.
Here's what others may have kept quiet about while they were selling urgency: a good part of the 2024 anxiety came from treating a commercial announcement as if it were a verdict. It wasn't. It was the intention of a company that also answers to its own interests, and those interests changed.
Don't organise around what a giant announces. Organise around what you control.
What genuinely has changed
Now the uncomfortable part, because this is where many people draw the wrong conclusion. Google failing to meet its timeline doesn't mean nothing has changed. Two things remain true, and both matter.
Consent Mode v2 is still mandatory
If you advertise on Google and you have traffic from the European Union or the European Economic Area, you need Consent Mode v2 for Google's tools to work properly with consent data. This doesn't depend on whether third-party cookies live or die. It's a requirement that was already there and that continues. Google's U-turn on cookies hasn't touched it. Anyone who treated it as a passing fad got the fad wrong.
The underlying direction hasn't reversed
Even though the timeline slipped, the general course hasn't changed sign. There's more privacy regulation every year, more browsers that already block third-party cookies by default, like Safari and Firefox for a long time now, and more users who say no to tracking when asked. Third-party data, the kind you buy or rent about people who aren't yours, keeps getting more expensive and degraded. First-party data, the kind a customer gives you directly because they trust you, is worth more and more.
Put another way: Google got the when wrong, not the where to. Dependence on third-party data is still ground that's sinking slowly. The fact that it didn't sink on the day it was meant to is no reason to build on it again.
What a company should do today
The useful work isn't guessing Google's next date. It's no longer needing Google to get it right. Three concrete things.
- Consent done properly, not a banner to get it over with. A CMP that actually asks for consent, records it, and is wired to Consent Mode v2 so your advertising and your analytics respect what the user chose. Done well it's a foundation; done to tick the box it's a risk.
- Owned data and first-party data. The email a customer leaves you, what they buy, what they look at on your site, what they tell you in a survey. It's data you control, that doesn't depend on any browser, and that's usually worth more than any segment you can buy. Building that direct relationship is the investment that doesn't expire when a giant changes its plans.
- Measurement that doesn't hang on a single third party. Server-side analytics, your own events, models that hold up even if part of the cookie signal is lost. Not out of paranoia, but because measurement that depends one hundred per cent on an external tool leaves you blind the day that tool changes the rules.
Google got the when wrong, not the where to.
The lesson, which is business before it's technical
What happened with cookies is a case study in dependence. Half the sector built plans on a decision that wasn't theirs and could change, and it did. The good part is that the work done properly, serious consent, owned data, robust measurement, still holds. The bad part is that anyone who did it purely out of fear of Google's date worked with the wrong motivation, and it shows in how it holds up afterwards.
At Undercoverlab we build it on this logic. GTM and Consent Mode v2 set up for real, consent that's recorded and respected, and analytics that don't fall apart every time a platform makes an announcement. We don't sell the panic of the moment. We build the foundation that holds whether Google blocks cookies or not, because what matters isn't Google's decision, it's that you control your own data and your relationship with the customer.
