Justin Schuh, then Director of Chrome Engineering, wrote on January 14, 2020, that Chrome planned to phase out support for third-party cookies within two years.1 Ten weeks later, on March 24, 2020, John Wilander of Apple's WebKit team announced that Safari 13.1 blocked cookies for cross-site resources by default.2 Firefox had turned Enhanced Tracking Protection on by default in 2019. On June 14, 2022, Mozilla began rolling out Total Cookie Protection to every Firefox user, giving each website what Mozilla called a separate "cookie jar."3 Chrome's two years passed with the cookie still in place.

On July 22, 2024, Anthony Chavez, Google's vice president for Privacy Sandbox, announced a change of plan.4 Instead of deprecating third-party cookies, Chrome would let people make an informed choice that applied across their browsing.4 That choice never arrived as a prompt. On April 22, 2025, Chavez wrote that Chrome would not roll out a new standalone prompt and that users could continue to choose in Chrome's Privacy and Security Settings.5 On October 17, 2025, he announced that Google would retire a list of Privacy Sandbox technologies that included Topics, Protected Audience, and Attribution Reporting, citing their low levels of adoption.6 As of August 14, 2026, the Privacy Sandbox feature status page marks each of those three "Deprecate and remove."7

An advertiser who budgeted for the end of the cookie was budgeting against a date that was never met. The January 2020 post gave a reason for not blocking outright: blunt approaches to cookies, it said, encourage opaque techniques such as fingerprinting, which can reduce user privacy and control.1 The July 2024 post acknowledged that the transition would have an impact on publishers, advertisers, and everyone involved in online advertising.4 Both reasons concern the reader's browser, and neither concerns the page the ad appears on. A method that matched an ad to the page had nothing to wait for.

The position in September 2026, across the three browsers, is therefore two that block or confine the cookie by default and one that leaves it to a setting. The Privacy Sandbox interfaces meant for advertising have been withdrawn, with low adoption given as the reason.6 A campaign that targets an audience rather than a page depends on whatever identifier the reader's browser allows through.

Wilander's post called Safari the first mainstream browser to fully block third-party cookies by default.2 Mozilla's post described Total Cookie Protection as keeping the cookies set on one site apart from those set on another.3 From 2020 a Safari reader on the default settings sent no third-party cookie with an impression. From 2022 a Firefox reader sent none that had been set while visiting another site. An advertiser who paid for behaviorally matched impressions across the open web was buying two things at once: readers a cookie could describe and readers it could not.

A bought word is matched on the page and not in the reader's browser

AdBubbles sells words rather than audiences. An advertiser buys a keyword for a calendar month, and on a publisher's page where that word appears, its first occurrence gets a light dotted underline. A hover or a tap opens a bubble carrying an "Ad" label, a short headline and body, the advertiser's domain, and one link. The match uses the text of the page and the word the advertiser bought, and nothing about the reader. A bubble therefore behaves the same for a Safari reader, a Firefox reader, and a Chrome reader.

Building a campaign costs nothing. Before paying, an advertiser sees, for each keyword, how many sites carry it and their estimated monthly page views. A word already taken on a site is shown as taken, with the next free month. The three packages are set out on the pricing page; the advertiser page covers the rest.

The limit of what we do is the match itself. We match a word on a page to the advertiser who bought that word for the month, one advertiser per keyword per site. We do not decide which people see the bubble, and we do not follow a reader from one page or site to another. Nor do we promise that an open will become a sale.

Google's own experiment, published on August 27, 2019, turned off personalized data for a small fraction of randomly selected users in the programmatic arm of Google Ad Manager.8 It ran for 96 days across the top 500 global publishers.8 Average revenue in the treatment group decreased by 52 percent, and the median per-publisher decline was 64 percent.8

Garrett Johnson, Scott Shriver, and Shaoyin Du measured the buyer's side in Marketing Science the following year. Ads for users who had opted out of behavioral advertising fetched 52.0 percent less revenue on the exchange than comparable ads for users who allowed it.9 The loss in ad spending came to about US$8.58 per opted-out American consumer, borne by publishers and the exchange.9

Veronica Marotta, Vibhanshu Abhishek, and Alessandro Acquisti counted from the publisher's side and found much less. Their preliminary draft for the Workshop on the Economics of Information Security in May 2019 examined millions of transactions at one large media company during one week in May 2016.10 When a user's cookie was available, the publisher's revenue increased by only about 4 percent.10 The authors set that beside an industry report that an ad without a third-party cookie sells for 2 percent of the cost of the same ad with one.10 They asked how the premium advertisers pay is distributed.10

Those three figures do not measure one thing. The first is revenue publishers lost when personalization was withheld. The second is the discount an exchange applied to an opted-out user, and the third is the uplift one publisher received when the cookie was present. Whatever accounted for the gap between premium and uplift lay somewhere between the advertiser and the page, in a sequence of matching steps that a bought word does not use.

Chrome's April 2025 post left the third-party cookie to each user's choice in the browser's settings.5 A bubble never reads that setting, because the match does not use it. AdBubbles sets no cookie, stores no identifier, and collects no personal data from readers. The embed sends one view beacon per page load, one open beacon when a bubble has been visible for one second, and one click beacon when the link is followed. Those three beacons are all that leaves the page. The privacy policy sets out the same position.

The record leaves an advertiser one number to set against any premium asked for a matched audience. Across the top 500 publishers in Google's experiment, withholding personalization cost 52 percent of revenue on average.8 An advertiser buying a word on a page pays for the page's text, which no browser setting has ever removed. For the publisher's side of that page, measured over one week at one media company, the published figure for what the cookie added is about 4 percent.10