Chrome and third-party cookies: why tracking checks still matter

The web industry spent years waiting for Chrome to remove third-party cookies. Then the timeline shifted, plans changed, shifted again, and finally moved in a different direction. Google did not proceed with the broad default phase-out as originally planned. Instead, Chrome continues to rely on existing user settings and Privacy Sandbox APIs.

For website owners, the wrong conclusion is: “Great, we can ignore tracking.” The right conclusion is: the browser will not solve this for you. You still need to know which scripts, cookies, and data flows actually exist on your website.

Why the issue did not disappear

Third-party cookies are only one part of the tracking problem. Modern websites use a mix of:

• analytics scripts,
• marketing pixels,
• consent management tools,
• embedded videos,
• maps and fonts,
• chat widgets,
• affiliate and retargeting scripts,
• server-side tracking,
• CRM and newsletter integrations.

Even if a browser blocks certain cookies or users choose stricter settings, technical and privacy questions remain: Which providers load? Before or after consent? Which cookies are created? Which data is transferred? Were old scripts removed after relaunches?

The real risk: tracking drift

Many websites start with a reasonably clean consent setup. Then comes a campaign, a new form, a newsletter tool, an ad pixel, an A/B test, or an embedded widget. Six months later, nobody knows what is actually active.

That is tracking drift: the website gradually moves away from its documented state.

Typical symptoms:

• The cookie banner lists fewer providers than the page actually loads.
• Scripts run before consent.
• Old pixels remain active after campaigns.
• Staging or test tools make it into production.
• Consent categories no longer match real data flows.
• External resources are loaded from new subdomains.

This is not a dramatic hack. It is worse: normal project life with a privacy hangover.

What a tracking check should cover

A good check does not only look at the visible cookie banner. It checks technical reality:

1. Network requests: Which third parties are contacted when the page loads?
2. Cookie behavior: Which cookies and local storage values appear before and after consent?
3. Consent logic: Does the tool actually block scripts or just describe them nicely?
4. Script inventory: Which tags, pixels, and tag managers are active?
5. Page variants: Check homepage, landing pages, checkout, contact forms, blog posts, and embedded media separately.
6. Documentation: Do privacy notices, consent texts, and real providers still match?

For small businesses, this is the difference between “we have a cookie banner” and “we know what our website does”.

Where Website-Pflichtencheck helps

Website-Pflichtencheck can make these technical mismatches visible: loaded third parties, cookie behavior, suspicious script patterns, performance side effects, and areas where documentation likely needs updating.

It does not replace legal advice. But it gives website owners, agencies, and privacy consultants a technical basis to work from.

Conclusion

Chrome did not simply switch off third-party cookies for everyone. But that does not close the tracking topic. Quite the opposite: when browsers, vendors, and regulation remain uneven, websites need their own transparency even more.

Teams that regularly check which scripts and cookies are active reduce privacy risk, improve performance, and prevent their website from quietly becoming a tool graveyard.

Sources

• Google Privacy Sandbox: A new path for Privacy Sandbox on the web
• Reuters: Google opts out of standalone prompt for third-party cookies
• Google Chrome Help: Change your cookie settings

Note: This article is a technical overview and does not constitute legal advice.