The Cookie Apocalypse: how you can start planning now

18 November 2020
Suraj Pabari

Suraj Pabari, a partner at Sydney-based data consultancy SingleView, reveals how advertisers can plan for a cookieless future. 

Fast Facts

● Apple’s making Intelligent Tracking Protection (ITP) almost impenetrable. So, marketers have been forced to accept third - and some first-party cookies will not be part of audience tracking in future.
● Advertising platforms can no longer use unique identifiers to track users across sites. This will reduce the platforms’ knowledge of users, limiting both the scale and performance of audience targeting.
● Analytics platforms, which rely on first-party cookies, will also be impacted. With the most recent iterations of ITP, any first-party cookie set by the browser will have a shelf life of seven days, and this will make user journey tracking beyond that period much more difficult. So, where the buying cycle is longer than a week - such as automotive and finance products - there is a significant problem.
● With these seismic changes, we must understand the implications on marketing strategy and reporting and adjust to improve audience insights.

The Cookieless Future

In early 2017, Apple’s Intelligent Tracking Protection (ITP) was born; Apple decided it was their mission to target the big walled gardens of the advertising world in the name of consumer privacy. Adtech platforms developed sneaky workarounds to minimise the impact of ITP on their revenue, yet Apple was ready each time, enforcing additional measures to thwart the advertising ninjas. Eventually, the platforms were forced to accept there was no fighting back, and that the future would be a cookieless one. 

More recently the industry press has signaled the ‘death of the cookie’, noting that larger ad tech platforms will struggle to support the advertisers’ quest to deliver profitable advertising, with a potential for smaller platforms that don’t rely on single customer identifiers to step in. Third-party cookies will soon become relics of a bygone age. We’ll tell our grandchildren about the ‘good old days’ in advertising when tracking customers was easy and predictable.

For those working in marketing and data analytics, their ‘source of truth’ will no longer be reliable. As a result, our data-driven decision-making - and the resulting business outcomes - will become dependent on the assumptions rather than raw data.

Given the wide-reaching implications of The Cookie Apocalypse, we’ll examine the changes taking place, the impact on decision-making and budget allocation, and the possible ways to prepare people, processes and platforms to ensure you’re not left behind.

The New Normal

As advertisers, we are able to understand who we are targeting based on a small file - a cookie - which collects details about a user's browsing behaviour (such as the pages visited and actions taken on the site) along with an anonymous identifier. As a user visits a site, the browser (or server) sets several different cookies on their browser; these cookies can be read at a later date (or even across various sites) by the same domain. When the cookie is created by any domain other than the domain that the user is visiting, it is called a third-party cookie. Imagine you visit and shows an ad on the page. In addition, the ad platform also drops a cookie onto your browser. Now the advertiser can use data from that cookie as you browse other sites (such as to understand more about you. In this example, it knows you have visited and may be interested in buying holiday clothing.


How ad platforms use cookies to track users across sites


Third-party services commonly build up user profiles along with the sites that the user has visited and their behaviour on these sites so that we can target them with personalised advertising. However, in late 2017, Apple blocked all third-party cookies on Safari. As a result, we can no longer rely on these third-party cookies to know who the users are and what they’re interested in. We will therefore have to resort to using context from the site that the user is on to infer their interest, much like magazines that may show an ad for men's grooming products in a Men's Health magazine.

Another way to use third-party cookies is when we run brand or conversion lift experiments to understand the impact of advertising. These experiments involve splitting customers into a ‘test’ and ‘control’ group and use the difference in the response metric to measure the impact of exposure to the ad. However, with third-party cookies blocked, we are forced to move into using different, less precise methods of splitting the audience, such as probabilistic matching. The impact in the short-term would be increased difficulty in ensuring a user in the ‘control’ group is not exposed to the ad, making it harder to accurately measure brand impact. In addition, any tracking of a customer from clicking an ad to the conversion becomes less reliable given the deletion of these advertising cookies in, at most, 24 hours.

Not only is it more difficult to measure performance, but the channel specific performance we measure seems to decline. No matter what we believe about privacy implications of ads that rely on audience data, users will be more likely to click on ads that have a deeper understanding of what they want. Without such context, advertisers will see a decline in site visits and even conversions from the higher value Safari users.

The lesson for marketers is to rethink audience targeting across display and video, specifically where the advertising platform relies on a third-party (such as Google or Facebook) and an ID to understand the user. Unfortunately, audience targeting, a metal detector that you had previously relied on to find your best customers, is no longer functional, and you have to rely on intuition to decide where to dig in order to find these customers. Initially, impressions will fall, with a resultant drop in traffic, particularly relevant traffic. Eventually, performance will fall off the same cliff as conversions see a decline in both volume and quality.

An Unfortunate Casualty

Retailers (and many other businesses) need to store data on their customers such as cart details, order details and customer interests to support them with personalisation. Again, cookies play a vital role. However, because these cookies are set in a first-party context, Apple has rightly realised that many of these cookies are likely to be used for non ‘creepy’ purposes, and so gives them a free pass.

Historically, many third-party ad tech providers worked with retailers and others to use first-party cookies to capture customer data. The retailers then sent the providers this data following a user visit. Apple countered with a right-hook straight to the jaw, knocking these platforms out cold by blocking first-party cookies when the users came from specific ‘cross-site tracking domains’. This list of domains is maintained through a machine learning algorithm which determines sites with ‘cross-site tracking capabilities’.

Analytics platforms are one casualty of the battle between advertisers and tech companies like Apple. Traditionally these platforms use first-party cookies to track user behaviour over time so that when a user revisits a few weeks after their first visit, the platform can identify them as the same user. This is crucial when it comes to accurately attribute your visit (and potential sale) to the most appropriate channel. However, because of the ITP rules, analytics first-party cookies are deleted after seven days, which as we’ve already pointed out, makes customer journey tracking much more difficult. Notably, however, companies like Google have made efforts to remedy the potential missing data using the power of modelling.


How Google Analytics works with first-party cookies

As a result, attribution modelling will become a considerable challenge. This modelling has traditionally relied on a third-party cookie from an analytics platform to track users across different sessions and across devices. However, given the shift to a first-party analytics cookie with a shelf-life of seven days, it will be even more challenging to do any form of accurate modelling outside the confines of a walled garden (such as Google or Facebook). On a related point, channel-specific marketers will find that, despite using a Non-Direct Last Click attribution model, conversions from their channel will be attributed to Direct where the conversion occurs more than seven days after the channel click. This is particularly relevant in industries such as the automotive and finance where many conversions take place outside the seven-day window.




 If the referrer is tracking domain and uses link decoration:

Deleted after 24h

e.g. Ad tech platforms

Other: Deleted after 7 days

e.g. Analytics platforms



Summary of ITP restrictions with first and third-party cookies

Apocalypse Preparation 101

The Cookie Apocalypse is coming. Hopefully, you now have a better understanding of how the world as we know it will change. Here are some of our suggestions to help you navigate an uncertain future:

1. Make sure you understand the details of the tech changes that we have outlined above, and consider how they impact your business overall.

2. Once you’ve grasped the technicalities, now is the time to start planning the changes you need to make in terms of what budgets are assigned to specific digital advertising channels, how you construct the ROAS and the changes that you need to make.

3. Keep a close eye on press announcements over the next 6-9 months. There are bound to be a series of developments which will impact your digital marketing strategy and the campaigns you run. Periodicals such as AdNews will have broad coverage about the future of the cookie, so would be a good starting point to use as your source of updates.