For years, digital advertising ran on two quiet workhorses: third-party cookies on the web and mobile advertising IDs (like Apple's IDFA and Google's AAID) on phones. They let advertisers recognise users across sites and apps, build audiences, retarget abandoners, and measure what worked. Both are now fading — restricted by browsers, operating systems, and privacy law — and marketers who built their entire strategy on them are scrambling.
This guide explains what's replacing third-party cookies and mobile IDs, what actually works in the UK market, and how to rebuild your targeting and measurement on foundations that will last.
What's happening — and why
The short version: the industry is moving from tracking individuals across the internet to privacy-preserving alternatives, driven by three forces pulling in the same direction.
- Browsers. Safari and Firefox blocked third-party cookies years ago; Chrome — the last major holdout — has been phasing them out. Cross-site tracking on the web is effectively over.
- Operating systems. Apple's App Tracking Transparency made IDFA opt-in, and most users declined. Google is restricting its advertising ID similarly. Mobile app tracking as marketers knew it is gone.
- Regulation. UK GDPR and the PECR require consent for tracking technologies, enforced increasingly seriously. The legal basis for much of the old tracking was always shaky; now it's indefensible.
The result: retargeting audiences shrank, cross-site attribution broke, and lookalike audiences degraded. If your 2021 playbook still runs your 2026 campaigns, you're spending on fumes.
First-party data: the foundation everything else sits on
The single most important response is also the least glamorous: collect your own data, with consent, and use it well. First-party data — email addresses, purchase history, site behaviour, app activity, loyalty programme data — doesn't depend on cookies or device IDs, and it's more accurate than anything a third party ever sold you.
Building it is a programme, not a project:
- Earn the data. People trade information for value: useful content, genuine personalisation, loyalty rewards, better service. "Sign up for our newsletter" earns nothing; a preference centre that improves their experience earns plenty.
- Unify it. Data scattered across email tools, ecommerce platforms, CRMs, and spreadsheets is nearly useless. A customer data platform — or even a well-structured CRM — that joins behaviour to identity is the goal. Our CRM development work often starts exactly here.
- Activate it. Use first-party audiences for suppression (stop advertising to existing customers), upsell, win-back, and lookalikes built on your best customers rather than cookie pools.
- Respect it. Transparent consent, easy opt-out, data used for the purposes promised. Trust is the asset; one misuse destroys years of accumulation.
Contextual advertising: the comeback
Targeting based on what the user is looking at — rather than who the user is — is back in fashion, and modern contextual is far smarter than the keyword matching of old. Natural language processing now understands page sentiment, topic depth, and suitability. An ad for running shoes appears alongside marathon training content; a B2B software ad appears in relevant industry analysis.
Contextual works without any personal data, which makes it future-proof by design. It can't retarget or frequency-cap individuals precisely, but for prospecting and brand building it's remarkably effective — and it places your brand in environments that reflect well on it, which behavioural targeting never guaranteed.
Privacy Sandbox and platform solutions
Google's Privacy Sandbox proposes browser-based alternatives: interest-based audiences (Topics API), retargeting without cross-site tracking (Protected Audience), and aggregated attribution reporting. These are real, shipping technologies — but be clear-eyed: they're less capable than the cookies they replace, they keep Google in a privileged position, and the details keep changing.
The pragmatic stance: implement what's available (particularly the attribution APIs, which beat having no measurement), but don't bet your strategy on any single vendor's sandbox. The same applies to the walled gardens — Meta, Google, Amazon, and TikTok all offer targeting within their own ecosystems using their own first-party data. That works, but it concentrates your spend and your dependence. Diversification is a strategy, not just a preference.
Retail media and other first-party-data-rich channels
Some of the most effective post-cookie advertising runs on other companies' first-party data. Retail media networks let brands target based on actual purchase history and measure ad-to-sale in a closed loop — no cookies required. Our guide to retail media networks explains how UK brands are using them.
Similarly, publisher first-party data (logged-in audiences on major media sites), connected TV (household-level targeting without cookies), and digital out-of-home all operate without third-party identifiers. The common thread: advertising is moving toward environments with known audiences rather than tracking unknown ones across the web.
Server-side tracking and measurement rebuild
On the measurement side, the shift is from client-side pixels to server-side tracking: conversion data sent from your server to ad platforms rather than relying on browser cookies. It's more reliable (ad blockers and cookie deletion don't break it), more privacy-compliant (you control exactly what's shared), and increasingly necessary for platforms to optimise your campaigns.
Beyond that, rebuild measurement for a modelled world:
- Media mix modelling (MMM). Statistical analysis of how spend drives sales, using aggregated data — no user tracking needed. Once only for big budgets; now accessible to mid-market.
- Incrementality testing. Hold out audiences or regions and measure the true lift from advertising. The honest answer to "did this work?" that platform dashboards can't give you.
- First-party attribution. Your own data — email-driven revenue, logged-in user journeys, post-purchase surveys ("how did you hear about us?") — becomes a primary measurement source, not a supplement.
The practical roadmap
If you're starting from a cookie-dependent setup, prioritise in this order: (1) audit what breaks — which audiences, campaigns, and reports depend on third-party data; (2) accelerate first-party data collection with genuine value exchanges; (3) implement server-side tracking and consent-mode properly; (4) test contextual and first-party-data-rich channels like retail media; (5) rebuild measurement around MMM and incrementality. This is a 6–12 month programme, not a settings change.
The marketers thriving in this transition share one trait: they stopped mourning the old identifiers and started building owned assets. If you need help with the technical side — server-side tracking, consent infrastructure, or PPC advertising rebuilt for the privacy era — talk to us for a free consultation. We'll audit what's actually at risk in your setup and give you a straight priority list.
FAQs
Are third-party cookies really going away?
Effectively yes. Safari and Firefox blocked them years ago, and Chrome has been phasing them out — cross-site tracking on the web is over regardless of the exact timeline. Any strategy depending on third-party cookies is already degraded and will only get worse.
What replaced Apple's IDFA for mobile advertising?
Nothing directly — that's the point. Apple's App Tracking Transparency made the identifier opt-in and most users declined. Advertisers have shifted to SKAdNetwork-style aggregated attribution, first-party app data, and contextual or publisher-based targeting instead of device-level tracking.
Is contextual advertising effective without personal data?
Yes, particularly for prospecting and brand building. Modern contextual uses NLP to understand page content, sentiment, and suitability — far beyond old keyword matching. It can't do individual retargeting, but it works without any personal data and places brands in fitting environments.
What is server-side tracking and do I need it?
Server-side tracking sends conversion data from your server to ad platforms instead of relying on browser pixels and cookies. It's more reliable (unaffected by ad blockers and cookie deletion) and more privacy-compliant. If you run significant paid media, you almost certainly need it now.
How should small businesses respond to cookie deprecation?
Focus on first-party data: build your email list with genuine value exchanges, use your customer data for targeting and measurement, and lean on channels that don't need cookies (search, contextual, retail media, email). You don't need enterprise infrastructure — you need owned relationships with your customers.
