Third-party Cookie

A cookie is originally a small record a site keeps so it can recognize its own visitors. Staying logged in and remembering a shopping cart both run on it. In that case the domain that planted the record and the site being looked at are the same.

The problem sat on the advertising side. When Pagedeck ran ads, people came in, looked around and left, and a few came back two weeks later and paid. There was no way to know which ad any of them had arrived from. With money split across four channels, the only evidence left was that revenue rose in the month the ads ran, which says nothing about which of the four did the work.

Third-party cookies created that link. When an ad company places the same script on many sites, one cookie is stored under that company's domain, and the same cookie is read when the person moves to another site. Records that used to end at each site's boundary become one person's path.

The problem arrived from the same place. Nobody agreed to hand their browsing path to an ad company. As that became clear, regulators and then browsers blocked the record, and it's now on its way out.

This record carried three jobs.

1. Showing the ad again. Retargeting — putting one more ad in front of someone who visited and left — depends on it. The reason it runs cheaper than advertising to people who have never seen the product is that only people who already showed interest are selected. Someone who has read the pricing page is a different prospect from someone who has never heard the name, and the bid reflects that.
2. Deciding which ad gets credit. Attribution, connecting a conversion back to the path that produced it, leaned on this record. Two weeks can separate the click from the payment, and as long as the same cookie is there, the two events get treated as one person's.
3. Capping how often the same ad appears. An ad appearing ten times in a day pulls response down and damages the impression of the brand. You have to recognize the same person to stop at three.

All three were about spending less to get the same result, which is why losing this record is less like losing a measurement tool and more like watching ad prices rise.

The blocking came from two directions. On the regulatory side, GDPR required consent before tracking cookies could be set, and that procedure is the cookie consent banner. On the browser side, vendors switched to blocking these cookies by default one after another. Between the two, the volume collected fell and what remained skewed toward people who had consented.

Nothing replaces it singly. Four approaches cover the gaps between them.

1. Build up first-party data — what customers gave you directly. Login accounts, the company size someone entered at signup, behavior recorded inside the product. It isn't affected by blocking, but it only contains people who already use the product.
2. Report conversions from the server. Instead of relying on a browser record, your own server tells the ad platform that a payment happened. Identifying values travel with it, so check the scope of consent first. This is also the piece that needs engineering work rather than campaign work, which is why it tends to get scheduled late.
3. Accept the share that gets modeled. Ad platforms fill in conversions they can't connect directly using statistics. Because you can't verify it at the level of an individual user, on small campaigns the error can exceed the result being measured.
4. Choose the page instead of the person. Rather than following who someone is, the ad is matched to what the page is about — a collaboration tool advertised beside an article about how teams work. It's free of the regulatory problem and gives up precision in exchange.

In apps the mechanism was a device identifier rather than a cookie, and App Tracking Transparency (ATT) played the same role there: a rule requiring that the user be asked before activity is tracked across other companies' apps and sites.

Changing the measurement method is also on the list. Rather than following one person's path, you compare a group that saw the ads with a group that didn't and measure only the share the advertising created. It holds up without tracking individuals, which is why it came back into use as blocking spread.

"Ad performance looks 40 percent down since last month. We need to separate a real drop from a reporting drop."

Conversions that could no longer be connected may simply be missing.

"Retargeting isn't what it was. The audience we can assemble has halved."

Tracking is blocked, so the list of people to show ads to again got smaller.

"This needs to move to first-party. Let's clean up anything depending on third-party cookies."

Switch from records on someone else's domain to data collected directly.

Ravi first ran into this when the numbers in the ad report dropped suddenly. Payments were unchanged; only the payments credited to advertising had fallen. Performance hadn't gotten worse — conversions that couldn't be connected had moved into another bucket.

Ravi did two things. He added a question to the signup screen asking how people heard about Pagedeck, starting a store of answers given directly, and he switched each ad channel's budget off for a month at a time to watch the difference in revenue. Neither is as precise as what came before, but both were enough to decide which channel to increase.

The most common belief is that cookies as a whole are going away. Headlines say cookies are disappearing, so it reads that way. What's disappearing is cookies planted by other domains; cookies your own domain sets are untouched. Both are the same technology under different ownership, which is where the confusion starts. Staying logged in and remembering a cart still run on those. Conflate the two and you end up removing functionality you need.

The second is expecting to switch to one replacement. It looks like changing a tool. But the jobs the third-party cookie did don't move onto any single method. Data collected directly only holds people who already know you, server-side reporting runs only within the consent you have, and modeling arrives carrying error. It becomes a combination rather than a substitution, and the fact that measurement precision won't return to its old level has to go into the plan. Teams that miss this cut the wrong channel because the numbers stopped looking familiar.