As an internet marketer with 14 years of experience at CIMA agency, I've witnessed numerous significant changes in digital marketing. However, the upcoming disabling of third-party cookies in Google Chrome browser is one of the most important shifts in recent years. In this article, I'll share exactly what's changing, how these changes will impact web analytics and advertising (particularly affecting Google Analytics 4 and Google Ads), what risks small and medium businesses will face, and what new approaches will help adapt. I'll also tell you about a private alternative in analytics – the Matomo platform – and give practical advice on what you can do right now to ensure your business feels confident in a world without third-party cookies.

Chrome Disables Third-Party Cookies: What's Happening and Why

Third-party cookies are small files created not by the website visited by the user, but by external services. A classic example: advertising banners or social media widgets on a page. They load from third-party domains (for example, ads from adserver.com or a "Like" button from facebook.com) and record a cookie file by which the same user can be recognized on other sites. For many years, such cookies were the foundation for cross-site tracking of user behavior. Thanks to them, marketers could show personalized ads to people across different resources and precisely understand their journey: where they've been, what they looked at, which ads they clicked.

However, users and regulators increasingly raise alarms about privacy. Collecting such detailed data about people without their explicit consent has come to be considered unethical. In recent years, browsers have begun introducing restrictions: back in 2019, Firefox started blocking tracking cookies, and since 2020, Safari from Apple has completely disabled third-party cookies by default. Google Chrome, being the most popular browser, maintained the status quo longer to give the industry time to adapt and find alternatives. But its turn has come.

Initially, Google planned to completely end support for third-party cookies in Chrome by the end of 2024. In early 2024, the company even launched a test: for 1% of Chrome users, these files are already being blocked. Nevertheless, by summer 2024, Google slightly adjusted its plans. Instead of abruptly "killing" cookies, it was decided to give users more control: Chrome will have a new interface allowing users to disable or enable third-party cookies at their choice. In fact, for most people, they will be turned off by default unless the user themselves decides to turn them on.

For us marketers and for businesses, this means practically the same as a complete rejection: the majority of the audience will not be available through third-party cookies, as few regular users will specifically turn them back on. In other words, we're entering an era where third-party trackers will almost universally stop working in Chrome – following other browsers.

An important point: the reasons for these changes. Google is implementing this policy not on a whim, but under pressure from several factors:

  • Privacy regulations and laws. Europe has the strict GDPR, requiring minimization of collected personal data and transparency. Regulators directly state that uncontrolled tracking through third-party cookies violates user rights. Google risks facing restrictions in its markets if it does nothing.
  • User demand. In recent years, society has become more aware of how their data is used. Many don't want to be "tracked" without permission. Ad blockers and anti-tracking extensions have gained popularity, signaling that users value privacy and are ready to act. To maintain trust, it's important for Google to show that they also care about privacy by disabling methods of covert data collection.
  • Competitive browsers. Safari and Firefox are already positioning themselves as more private. Google can't lag too far behind, otherwise it risks losing an audience sensitive to these issues.

Thus, Chrome will effectively stop allowing third-party cookies from 2024-2025. This is a turning point for digital marketing. Let's examine how it will impact the familiar tracking and advertising tools that businesses use.

Impact on Web Analytics: What Will Happen to Google Analytics 4?

One of the first questions that came to my mind as an analyst was: "How will we track traffic and user behavior on the site now?" After all, we're used to relying on web analytics systems, primarily Google Analytics. The current version — Google Analytics 4 (GA4) — was created with an eye toward the new reality, but the changes will still affect its operation.

It's important to understand: Google Analytics (including GA4) primarily uses first-party cookies. This means that when you put GA code on your site, it saves the user ID in a cookie file on your domain. Such basic cookies aren't being eliminated by Chrome or other browsers yet. Therefore, basic tracking of visitors on your own site will continue. If someone visits your site and accepts cookies, GA4 will mark them with a unique ID and recognize them as a returning user during repeat visits in the coming days or weeks. There are no major changes here.

However, third-party cookies did indirectly affect Google Analytics through connections with advertising and other sites. Here are a couple of scenarios that will become more difficult:

  • Attribution of advertising traffic. Previously, when a user clicked on an ad banner on another site and landed on yours, third-party cookies from the ad network could be used to track this transition. In GA, the source/campaign was recorded, often through URL parameters (e.g., gclid for Google Ads). Without third-party cookies, everything still works if tags are in place – GA4 will identify the campaign through the URL. But problems arise if conversion doesn't happen immediately. Let's say a visitor came from an ad, didn't buy anything and left, then returned directly 10 days later and placed an order. Previously, cookies could "remember" them longer and connect these visits. Now, in conditions of increased privacy, the lifespan of such identifiers is reduced (in Safari already to 7 days). If Chrome introduces similar restrictions, GA4 may count such a user as new during the second visit, losing the connection to the original advertisement. This impacts the accuracy of attributing sales to advertising channels.
  • Google Signals and cross-domain tracking. GA4 has a Google Signals feature – it aggregates data about users who are logged into Google accounts to build cross-device reports. Here, third-party cookies aren't needed either, as accounts are used. But for users without Google accounts, GA4 could previously rely on Client ID + third-party cookies from advertising services to understand that it's the same person who came from one of your sites to another of your resources (cross-domain) or interacted with your advertising earlier. Now such data will decrease. The picture of the customer journey will be more fragmented: GA4 will see behavior on your site, but won't always be able to know what the user was doing before or after, on other sites, unless they themselves left their data somewhere.
  • Repeat vs. new users. Although GA4 stores its cookies on your domain, a significant portion of the audience may simply refuse any cookies (on the wave of all this privacy). In the EU, visitors see consent banners and often click "decline." Without cookies, analytics is limited. GA4 in such cases tries to apply mathematical modeling – guessing the behavior of those who declined based on those who agreed. Nevertheless, the "new vs returning users" statistic will become less accurate. One can expect an increase in the proportion of "new users" in reports, simply because it's harder to identify returns (cookies are cleared more often, live less, etc.).

Google anticipated these difficulties and began adapting GA4 in advance. In 2023-2024, GA4 received updates helping to work in conditions of data scarcity:

  • Modeling of conversions and behavior. If some users didn't consent to data collection or can't be tracked due to absence of cookies, GA4 statistically completes the overall picture. For example, if out of 100 visitors 20 converted, but information is known about 80, GA4 can estimate that there were also conversions among the rest, and adjust the final numbers. These models are based on machine learning and data from those who could be tracked. For small businesses, this is a blessing: even if you lose data, the system will try to fill in the gaps so you can optimize marketing.
  • Integration with Privacy Sandbox API. Google isn't just cutting out cookies – it's offering alternatives (more on these below). It's already been announced that GA4 will support the new Protected Audience API (formerly known as FLEDGE) for remarketing without third-party cookies. This means GA4 will be able to form audiences for re-engagement without storing specific people's identifiers on the server, but using browser mechanisms instead. From a user perspective this is safer, and from a marketer's perspective – a chance to still show personalized ads.
  • Updated Consent Mode. If Google Consent Mode is set up on the site, GA4 knows how to work even with those who declined cookies: it doesn't store their data, but records anonymous events. For example, it saw that there was an ad click and then a purchase, but without personal labels. Ultimately, GA4 will count the conversion in aggregate form. For the EU this is critical, and GA4 is quite an advanced tool here, allowing compliance with the law while still not completely losing analytics.

To summarize: Google Analytics 4 will continue to function for your site, but there will be less data obtained, and its accuracy will be lower. Familiar reports on funnels, retention, lifetime value may show less impressive numbers because part of the user journey will "fall out" of the field of view. A business owner may notice that overall traffic is the same, but conversions from advertising "are decreasing" – not at all because the ads suddenly don't work, but because not all those who reached the purchase can be linked to their ad click in the past. We marketers will have to get used to making decisions based on incomplete data and trusting models.

What Will Happen to Google Ads: Retargeting and Campaign Effectiveness

Even more noticeable changes await the Google Ads system and online advertising in general, which relied on third-party cookies. This especially concerns remarketing (also called retargeting) and fine-tuned behavioral targeting.

Remarketing is a favorite tool of small businesses, allowing them to "chase" visitors with ads. For example, a person visited a store site, looked at a product and left; thanks to third-party cookies, we could later show them this product in a banner on another site or on YouTube, reminding them of us.

How did this work? When a visitor came to your site, the Google Ads tag (or Google Analytics linked to advertising) wrote a third-party cookie from the Google domain with a unique user identifier. Then, when this same person browsed other sites containing Google ad blocks, the system understood from the cookie: oh, this is the same one who was interested in your store – and slipped them your ad.

Without third-party cookies, this scheme collapses. The Chrome browser will simply not allow reading the identifier on third-party sites that was issued by your site through the Google domain. As a result, Google Ads won't be able to recognize "that same" user on someone else's site to show them your ad. That is, the classic remarketing list of visitors to your site will lose connection with users when they leave your resource.

Besides remarketing, targeting by interests and demographics will suffer. This data was often collected through cookies: what sites you visited, what you searched for – based on this, advertising systems assigned you interests (for example, "sports enthusiast," "looking for a car"). Third-party cookies allowed compiling a fairly accurate profile. Now, if such profiles are collected at all, it will be without the help of browser trackers, but by other means (mainly on the side of the platforms themselves, which have accounts, or through new APIs, more on this later).

The effectiveness of advertising campaigns in Google Ads may initially decrease. Expected issues:

  • Increased cost per conversion. If remarketing and precise behavioral targeting work worse, advertising will reach a less "warm" audience. For example, instead of precisely targeting those who've already been to your site, you'll have to target more broadly by context or similar segments. Conversion from such advertising is lower, meaning the cost of acquiring a customer (CPA) will rise. This is sensitive for small businesses, as budgets are limited.
  • Less data for optimization. Google Ads algorithms (auto-strategies) learn from data about users: who clicked, who bought, which audience segments yield the best results. If some of this data disappears, Google's machine learning will also find it harder to identify optimal customers. As a result, advertising campaigns may not work as precisely, requiring more time and money for their "acceleration" and learning in the new conditions.
  • Harder to track conversions. As with GA4, Google Ads has tools for tracking conversions (for example, when a user clicked on an ad and then made a purchase on your site). Previously, this was done either through Google Analytics or through a separate conversion tag, which relied on cookies (Google recorded a special click identifier in a cookie to link the purchase with the ad click). Without third-party cookies, Google Ads will switch to other ways to connect events – for example, using the Attribution Reporting API (a new browser mechanism) or unique URL parameters. But small businesses will need to make sure these new schemes are implemented. And in the first months, data discrepancies are possible: conversions may be "lost" in reports somewhere, requiring manual reconciliation.

However, not everything is so dramatic. Google is interested in keeping advertisers from running away, which means Google Ads will also adapt:

  • A system of "closed" remarketing through the browser is already being launched. Within Privacy Sandbox, the Protected Audience API has appeared: your site can mark a visitor as, say, "was on site A in the smartphones section," and the browser will locally remember them in the "A_smartphone_interest" group. When the user goes to another site with ads, the browser itself (without transmitting the identifier to external servers) will decide whether to show them an ad from site A. That is, the ad auction happens right in the user's browser. Google Ads is integrating this technology with GA4, so you'll still be able to target campaigns to the audience of visitors, just their storage and identification are implemented in a new way. For me as a marketer, I still need to place the code and form an audience, but I don't need to store personal data – the Chrome algorithm will do everything for me.
  • Topics instead of individual profile. Instead of detailed tracking, Google offers the Topics API approach – the browser will determine several general topics of user interest (for example, "technology," "travel," "sports") based on their recent browsing history. These topics are stored locally and updated every week. Advertiser sites and ad platforms will be able to request from the browser a list of topics of user interest and, if there are intersections with their target audience, show relevant advertising. This means that interest targeting won't disappear, but will become less precise, yet more private: you'll be targeting not "25-year-old John Doe, who looked at sneakers three times on sites X, Y, Z," but an unnamed user whom the browser classifies in the category "sports and fitness." For small and medium businesses, this is actually not so bad – they often don't need hyper-precise profiles, just an audience by interests. Especially since very narrow targeting in Google Ads was already working unstably and expensively.
  • Attribution Reporting API for measuring conversions. This is another component of Privacy Sandbox, addressing the question: how to measure that an ad from site A led to a purchase on site B, without revealing the user's identity. The solution is this: the browser itself tracks the ad click and subsequent conversion, and then sends an aggregated report to the server. There are no personal data, only the fact that X clicks led to Y purchases. Google Ads plans to use this approach so advertisers can see results. For businesses, this means: campaign effectiveness indicators (conversions, revenue) will be calculated more aggregately. We'll know less about which specific user bought after which ad, but we'll still know that, for example, the "Spring Sale" campaign brought 50 sales and paid off.

Summarizing the impact on advertising: targeting becomes more generalized, remarketing gets more complicated but doesn't disappear completely, transforming into a new form. Campaign effectiveness may temporarily dip, especially for those who relied on narrow behavioral targeting or a long deal cycle. Small and medium businesses will have to closely monitor results and be ready to change strategies: possibly investing more in contextual advertising (by keywords, where cookies aren't needed), strengthening work with the primary audience (own customer bases, email newsletters) and trying new Google Ads tools that will replace cookies.

New Approaches: Privacy Sandbox, Attribution Reporting, Topics API and Other Solutions

I've already mentioned Privacy Sandbox several times above – this is the general name for Google's initiative to preserve advertising on the internet without violating privacy. Within Privacy Sandbox, a whole set of technologies (APIs) is being developed that should replace the functionality of third-party cookies. Let's structure what new things await us and how they work:

  • Privacy Sandbox and its goals. Essentially, Google is trying to create a "sandbox" inside the browser where some advertising algorithms can be executed locally on the user's device. Instead of trackers across the internet dumping data onto servers of dozens of companies, the browser itself will remember some facts about the user and provide limited access to them for advertising systems. The goal is to preserve user anonymity (data doesn't leave their device in an identifiable form), while giving advertisers the ability to show relevant ads and measure effectiveness.
  • Topics API. As already mentioned, Topics API highlights the main interests of a user. For example, your browser may determine that over the past week you most often visited sites about cooking, football, and cars – so the topics might be "cooking," "sports," "auto." When you visit a site participating in an ad network, it will ask through the API: "What 3 topics interest this user?" The browser will return, say, ["sports," "auto," "music"] (topics are randomly selected from your top ones over recent weeks). The advertiser, having received this data, selects a banner corresponding to one of the topics. Importantly, the specific sites you visited aren't disclosed, and the topics are quite general, with a limited list. For small businesses, Topics API means they can continue thematic targeting. If you sell sports goods – your ads will likely still be visible to people whose browser is marked with the "sports" topic. Perhaps the precision is lower, but it's all legal and without complex settings.
  • Protected Audience / FLEDGE. This is a solution for remarketing and custom audiences. Google once called this technology FLEDGE, now they call it Protected Audience API. It works like this: your site during a visit can place the user in a local list (Interest Group) through the browser, for example "user_bought_X" or "was_on_site_but_didn't_buy." This list is stored in the browser. When the user later visits a site with ads (a partner site in the network), the ad platform launches an auction inside the browser: among ads that match the user's interests. If the user is in the "didn't buy product X" group, the browser might choose an ad with a reminder about product X and display it. Everything happens without identifiers, only based on participation in interest groups. For a marketer this means: you still create a campaign for the audience "abandoned cart" or "former clients," and your banners will be shown to them, but Google won't give you either a "list of names" or the actual cookies of these people – everything is on the user's side. An important nuance: these audiences are formed by the advertiser (you), not the browser. That is, Privacy Sandbox won't suggest to you who to consider as a target audience – that's still your task, just the method of implementation has changed.
  • Attribution Reporting API. This mechanism is designed to replace classic cookies and pixels that reported "user A clicked on ad #5, and then made a purchase." Now such things can't be tracked directly, so Attribution API does it differently: when there's a click on an ad, the browser marks it (locally); when a conversion is recorded on the advertiser's site (for example, a purchase), the browser matches the facts locally (yes, there was a click X days ago on an ad) and after some time sends a report without personal data. The report may be aggregated or with a small amount of noise to exclude the possibility of identifying a specific person. For advertising this means: we'll receive information about conversions with a delay and without details about users. For example, a report: "100 clicks on the campaign -> 3 conversions" instead of data for each click. For small businesses, however, this level of detail is often sufficient – the main thing is to know the overall return on advertising. We'll just have to accept that we can no longer walk through the user journey in detail: who came through which channel and at what time – such things will become less accessible.
  • Other innovations. Privacy Sandbox includes other proposals: restrictions on shared identifiers, API for spam filtering and anti-bot (Trust Tokens, to distinguish real users from bots without captcha), Private Aggregation API for obtaining aggregated statistics from the browser. They're all aimed at one thing – transferring those functions that trackers previously performed inside the browser with privacy control.

Of course, at the time of writing this article (early 2025), these technologies are still being actively refined. Some are available for testing, but not in final form. Changes are quite likely to be made. Small businesses don't need to delve into the technical details of all these APIs, but it's important to understand the general trend: data on user behavior won't completely disappear, just the methods of obtaining it are changing. There's more automation "on browser terms": the browser kind of tells us – "We'll learn everything about the user ourselves and give you a bit of necessary information, but trust us – we won't reveal personal details." Google, in essence, is asking us to trust their "black boxes" (algorithms) that guarantee privacy to the user and sufficient effectiveness to the advertiser.

Risks and Limitations for Small and Medium-Sized Businesses

Now, having realized the scale of changes, let's look through the eyes of a small business owner. What does the transition to a world without third-party cookies threaten specifically for small and medium-sized businesses (SMBs), which don't have multi-million marketing departments?

1. Loss of some marketing data

Small businesses often value every clue about a customer: where they came from, what they looked at, did they return or not. With cookies being disabled, some of this data will simply stop being collected. For example, reports on what your visitors are interested in outside your site are no longer available. If Google Analytics previously showed you that 30% of your audience are men aged 25-34 interested in technology (based on their web profile), soon such information may be missing. You'll have to work with narrower data: only what users do on your site or tell you themselves. For companies accustomed to relying on extensive analytics, this can be a shock. You'll have to make decisions blindly more often than before, or spend on alternative market research.

2. Difficulties with personalization and remarketing

Small online stores and services really loved personalization tools: for example, automatic recommendations "you looked at X, you might like Y" or newsletters and ads targeted at recent visitors. With the departure of third-party cookies, real-time personalization becomes more difficult, especially if the user is not logged in. The site won't recognize that this visitor was on another of your resources an hour ago or that they already looked at this product a week ago. Remarketing, as we discussed, will also get more complicated. For SMBs, this means a risk of losing some repeat sales. If previously conversion among those who returned to the site through reminders was high, now you'll have to find other ways to bring the customer back (for example, through email, messengers, push notifications – which requires your own contact base).

3. Increased dependence on large platforms

Paradoxically, abandoning third-party cookies may strengthen the positions of giants like Google, Facebook, Amazon. Why? They have a huge amount of their own data (1st party): user accounts, search query history, activity in their apps. They can target ads within their ecosystems as effectively as before. If previously you could place ads through independent ad networks with cookie tracking, now these networks lose effectiveness and, possibly, budgets will flow to the big players. Small businesses will have to accept the terms of these platforms and compete within them, which may raise the cost of advertising. In addition, Google with its Privacy Sandbox is kind of saying: "Trust us with data, we'll do everything." As a result, businesses own less information directly, relying more on Google's reports. This carries risks for transparency: you'll have to believe that the indicators are correct, and there's not much to compare with, because the old methods don't work.

4. Legal nuances and responsibility

In the EU, small businesses are already accustomed to being responsible for data collection themselves before the law. Using third-party cookies (for example, connecting a third-party widget or analytical script to a site), the company had to ensure that it complied with GDPR, and obtain consent. In the new world, it seems easier – there are no third-party cookies, so less headache with consents? Yes, partly banners "we use third-party cookies" may disappear, which pleases users. But the responsibility for data hasn't gone anywhere. The focus has just shifted: regulators now monitor that you correctly use the new APIs. For example, you can't try to be clever and collect digital fingerprints (fingerprints) without consent – that's also prohibited. Businesses will have to carefully monitor their privacy policy, update documents, explain to users what data (albeit generalized) you now receive. Additionally, for example, if you decide to switch to your own analytics, then data storage must be secure and legal. In general, compliance is still important, just the focus slightly changes.

5. Need for technical upgrades

To adapt to changes, you'll need to modify some settings on your site and tools. Small businesses don't always have developers or analysts on staff – sometimes the site was "made and it works, don't touch it." Now, to keep up, you may need to:

  • update the Google Analytics code to GA4 (if someone hasn't yet migrated from Universal Analytics);
  • configure Google Tag Manager with consent mode;
  • implement new tags for Privacy Sandbox (when they become publicly available) – for example, code for Topics API or for calling Protected Audience API;
  • switch to server-side data collection (Server-side tracking) for some cases, to bypass browser limitations;
  • integrate the site more with your CRM system to connect offline data with online (for example, pass order ID and client directly to analytics without cookies).

All these tasks require either learning or hiring specialists/agencies. Not every small business is ready to invest, especially if it's not entirely clear whether it will pay off. But ignoring the changes is also fraught with consequences: you might suddenly discover that the advertising budget is being spent, but conversions aren't being recorded – simply because outdated code no longer works properly.

To summarize: the main risks for SMBs are losing some effectiveness of advertising and analytics, as well as being technically unprepared for new requirements. Nevertheless, knowing about them in advance can minimize the negatives. Next, I'll tell you what steps to take so your marketing doesn't sag, but might even become stronger in the new landscape.

Matomo – A Private Alternative to Google Analytics with Data Control

Before moving on to general advice, I'll separately focus on a solution like Matomo. This is a web analytics system that positions itself as an alternative to Google Analytics, focused on privacy and complete ownership of data. Why do I think it's important to mention Matomo to business owners in the EU in the context of abandoning third-party cookies?

Complete control over data

In Matomo, your visitor data is stored either on your own server or on the European cloud of the Matomo provider. In any case, they aren't transferred to third parties, such as Google. For European businesses, this is a significant plus: less risk of violating GDPR and leaking customers' personal information abroad. If you're concerned that data from GA4 might be used somewhere by Google for its own purposes (which is generally true, Google can use GA data for its services), then with Matomo you're the master of the information. No one will gain access to it without your knowledge.

Absence of third-party cookies by default

Matomo was initially developed with privacy in mind. It can work completely without cookie files or only using first-party cookies. Moreover, it can be configured so that it doesn't collect personal data, then in some countries you don't even need to show the annoying cookie consent banner. For example, Matomo knows how to disable tracking by cookies and use other aggregation methods (less accurate, but sufficient for general statistics). Yes, if you completely disable cookies, some metrics will decrease in accuracy (the same person coming from different devices won't be recognized as the same without additional tricks). But you get honest analytics without violating user privacy. Many visitors appreciate this: they don't feel "under surveillance," there's no sense of being tracked. For brand reputation, this is a plus.

Transparency and flexibility

Matomo is an open-source platform (previously known as Piwik). You can see how it collects data, extend its functions through plugins, customize it to your needs. There are no "black boxes" in it – you can track all calculations of indicators. When GA4 builds a conversion model, you just believe in it. In Matomo, you yourself determine what to consider a conversion and how to attribute channel credits. For small businesses that want to have maximum transparency of web analytics, this is a significant advantage. Plus, if you have specific indicators or reports, Matomo will allow customizing data collection for you (for example, additionally tracking certain actions, combining them with CRM).

Compliance with European laws

It's no secret that in some EU countries, regulators have already recognized the use of Google Analytics as illegal if data leaks to American servers without sufficient guarantees (there have been cases in Austria, France, Italy, where local authorities issued such verdicts). Matomo, being installed on your server in Europe, automatically bypasses this problem. Your data isn't transmitted anywhere, which means there's no cross-border transfer, no violation of GDPR. You still need to get user consent for data collection (if you collect something beyond purely technical statistics), but you can honestly say: "We use our own analytics, data stays with us." Many European companies have already chosen this path to avoid depending on Google's policy and reduce legal risks.

Matomo vs. GA4 functionally

Matomo provides almost all similar metrics and reports: visits, conversions, traffic sources, site behavior, funnels, goals. In some areas GA4 is more powerful (for example, with built-in machine learning capabilities, predictive audiences, integration with Google Ads), but Matomo is actively developing and even offers additional features not in the free GA4 (for example, heat maps, session recording – though for a separate paid subscription). If you have a small site, Matomo can completely cover your analytics needs. Especially if you're dissatisfied with the complexity of GA4 or fundamentally don't want to share data with third parties.

How to implement Matomo

The transition isn't so difficult: Matomo provides instructions for migration from GA, there's even the possibility to import historical data from GA4 to not lose context. It can be installed on your hosting (you need a database and some server resources) or use the Matomo cloud service (for a relatively small fee, depending on traffic volume). It's important that during installation you immediately configure what data to collect, and enable the modules you need. For correct work without cookies, you sometimes need to set up so-called cookieless tracking – Matomo also provides information about this.

Of course, switching to Matomo is a balanced decision. I'm not advocating immediately dropping GA4: Google Analytics has advantages, especially deep integration with Google's advertising tools. However, as a parallel step or as additional insurance, Matomo is very useful. For example, you can use GA4 for advertising and operational marketing decisions, and Matomo for long-term storage of clean data and independent analytics. If suddenly the rules of the game change (say, GA4 introduces more restrictions or it's even prohibited to use without a data processing agreement), you'll already have your own system. For small businesses, control over data often means control over the situation. When you yourself see and store your numbers, you depend less on others' changes. In light of the upcoming disabling of cookies, Matomo gives confidence that you'll still be able to collect data about visits to your site within your domain and use them as you see fit, without looking back at corporate policies.

Practical Tips: What to Do Right Now

Realizing everything described above, a logical question arises: what specifically should a business and marketer do to prepare for a world without third-party cookies? Below I've gathered practical recommendations that we at CIMA agency consider useful for our clients – owners of small and medium businesses in the EU. These steps will help soften the blow and possibly even find new opportunities.

1. Update to Google Analytics 4 and set up Consent Mode

If you're still using the outdated Universal Analytics, immediately switch to GA4 – the old GA has not been collecting data since July 2023. In GA4, be sure to enable consent mode and check region settings (indicate that you're in the EU, so it automatically enables the necessary features). Consent Mode will allow GA4 and Google Ads to work legally: without it, if a user refused cookies, you would simply lose their data, but with it – you'll get aggregated information. Also study GA4 functions related to conversion modeling, and make sure they're activated – this way you'll compensate for some data losses.

2. Audit tags and third-party scripts on your site

Look at what external services are installed on your site (chat widgets, ad pixels, social buttons, etc.). Everything that sets third-party cookies will soon either stop working or require explicit user permission. Decide what you really need from this. There may be more private replacements. For example, a script for online chat can be replaced with a variant that doesn't track users outside your site. And advertising pixels (Facebook, LinkedIn, etc.) – switch to server-side event sending mode or use through Google Tag Manager with Consent Mode. By minimizing unnecessary trackers, you'll kill two birds with one stone: both from a legislation standpoint everything is cleaner, and the user has fewer reasons to worry.

3. Focus on collecting your own (first-party) data

In the absence of third-party data, the real treasure becomes data that users voluntarily leave to you themselves. This could be registration on the site, newsletter subscription, filling out a form to participate in a loyalty program, etc. Conduct a brainstorming session: what useful information can we request from the client, giving something valuable in return? Maybe a small bonus for filling out a profile, or an interesting PDF with tips in exchange for an email. It's important not to overdo it: collect only what will really help in business. The goal is to create your own database of clients and leads, with which you can work directly (email-marketing, segmentation, analytics in CRM). The more of your own data you have, the less you depend on the whims of browsers. For example, instead of relying on cookies to recognize a regular customer, you can motivate them to log into the site – then upon each login you exactly know who it is, and can personalize the service without cookies at all.

4. Combine disparate data into a unified system (CDP/CRM)

Small businesses often store information in different corners: something in email, something in spreadsheets, something the sales manager knows. Now it's vitally important to consolidate data. If you have a CRM system – make sure online conversions are flowing into it: for example, deals from the site are configured to be transmitted to CRM. If there's no CRM – at least bring data together manually into one repository. The point is that you could build a holistic portrait of the client based on your data: here they subscribed, here they bought, here they responded to a promotion. This information will help you set up audiences for advertising already without third-party cookies. For example, upload a list of client emails to Google Ads for targeting (Customer Match function) – this is your honest first-party method of remarketing, which will work even in the new conditions, since you yourself received these contacts. Plus, having centralized data, you'll be able to calculate ROI and analytics even manually, if suddenly auto-reports start to limp.

5. Monitor the development of Privacy Sandbox and test new tools

Google will gradually introduce new APIs. I recommend subscribing to official blogs or checking news for developers. As soon as the opportunity appears in your advertising cabinet to enable, say, a campaign based on Topics API or to use Attribution Reporting, try it. Yes, it may be technically complex, but possibly, Google will implement everything transparently: clicked a checkbox – and the system itself works in a new way. The earlier you start testing "cookieless" methods, the faster you'll find what's effective for your business. Don't wait until old approaches are completely disabled – experiment in advance on a small portion of the budget, compare results. For example, if Google Ads offers a beta of a new type of remarketing – sign up and try it. This way you'll avoid a situation where suddenly the old campaigns stopped working, and you don't know what to replace them with.

6. Consider implementing server-side analytics and tagging

It's clear that the advice is rather for the advanced, but still: Server-side tracking is gradually becoming a trend. The essence is that instead of the browser, data about user actions first goes to your own server (or Google Tag Manager server), where you decide what to do with it – and only then is sent to analytics systems. This allows bypassing some browser restrictions and blockers. For example, you can make the browser think that data is going to your site (first party), although you then forward it to Google Analytics – and thus no third-party cookie is visible. Of course, this isn't a magic wand: you need to comply with the law, and completely covertly tracking the user isn't allowed. But the server approach gives more stability: your site itself collects information (IP, user-agent, clicks) and stores the identifier in its database, and browser restrictions don't concern it. Google already offers a server version of Tag Manager, Facebook – its Conversion API. If you have the opportunity to hire specialists or use a service like DataTag/OWOX, it makes sense to at least partially move tracking to the server. In the future, when browsers become even stricter, you'll be ready.

7. Diversify marketing and don't rely only on targeted advertising

In an era when personalized advertising was king, many businesses reduced efforts in other channels. Now is a good time to reconsider the strategy. Contextual marketing, content marketing, SEO, working with communities, collaborating with influencers – these are all ways to attract clients without depending on cookies. For example, if your site receives organic traffic from search or you've gathered a loyal community on social media, you're not so afraid that targeting has worsened: you have direct channels. Small businesses benefit from investing in brand and loyalty. Then advertising will need to be less aggressive, and clients will return on their own. Targeted advertising won't disappear, of course, and abandoning it isn't necessary. But the balance of channels should be distributed so that not all eggs are in one basket of personalized ads.

8. Think about alternative analytical solutions

We've already discussed Matomo as one option. Besides it, there are other private or simple analytics (Plausible, Yandex Metrika – the latter, however, outside the EU now, but in some CIS countries they use it). It's important to have at least a basic backup of data. For example, install some light system on the site that records visits and sources in your database (even through hit logging). This isn't complicated and can help if suddenly something disappears in GA4 or you need to reconcile data yourself. Analytics is the lifeblood of digital marketing. You can't be left entirely without it. So take precautions: in parallel with GA4, collect critical indicators by other methods. It's like insurance: better to have and not use, than to unexpectedly lose everything.

9. Train the team and prepare clients

Changes will affect not only your tools, but also people. If you have marketer(s) or an agency – make sure they're increasing expertise in the new realities. Perhaps worth taking courses or webinars on Privacy Sandbox, on working with GA4 (if previously worked only with the old version). For the sales department or account managers, it's useful to explain that some data about clients may disappear, so it's important to more carefully enter information into CRM manually. And communication with clients: prepare a clear explanation if they notice changes (for example, "why don't I see personalized ads anymore, only general ones?" or "why are you asking for my email for access to something you didn't ask for before?"). Tell them it's all for their own privacy and better experience. Most people will perceive this positively if presented correctly.

10. Don't panic and look to the future with positivity

My last advice is psychological. Yes, the industry is changing, but it's not the end of the world. Remember how a few years ago everyone was worried about GDPR: like, marketing will die, there will be no sales. However, businesses adapted: introduced honest subscriptions, became more creative in attracting attention, and the market lives on. Similarly with cookies: there will be turbulence at first, but then new methods will show their effectiveness. It's quite likely that user trust in online advertising and sites will increase as a result, because they will feel less tracking. And trust is the foundation for good relationships with clients. Small businesses, being the most flexible, may even win: you'll quickly implement new tools while large corporations are getting up to speed. Remember the evolutionary principle: it's not the strongest that survives, but the most adaptable. So perceive what's happening not only as a challenge, but also as a chance to make your marketing cleaner, more transparent, and, ultimately, more effective in the long run.

Conclusion

The disabling of third-party cookies in Google Chrome is a landmark event that transforms digital marketing. Yes, we'll have to adapt to new rules of the game: work with a smaller volume of data, build targeting and remarketing in new ways, invest in our own data and relationships with clients. It may not be easy for small and medium businesses in this transition, but, armed with knowledge and an action plan, it's quite possible not only to maintain marketing effectiveness, but also to increase audience trust.

Personally, I can say: as a marketer, I see in these changes not only difficulties, but also opportunities. We are witnessing the birth of a more ethical and honest internet, where the user has more control over their information. This is a positive trend. Businesses that respectfully treat client privacy will gain a competitive advantage – loyalty and good reputation.

We're already helping our clients adapt: updating analytical solutions, testing campaigns without cookies, setting up Matomo for those wanting complete data privacy. I recommend you start preparing too – don't put it off until tomorrow, but take the first steps today. Review your tools, talk to your marketers or contractors, make an action plan according to the advice above.

In the end, abandoning third-party cookies is not the end of targeting and web analytics, but an evolution. Those who flexibly approach this evolution may even improve their marketing practices. Remember: the main thing is to know your client and give them value. Cookie files were just one means to know the client. Now there will be other means, possibly more respectful to the person themselves. And this means that cooperation between business and client will become more transparent and trustworthy.

I wish you successful adaptation to the new conditions. The marketing world is changing – change with it, and your business will surely continue to grow and prosper!

Google Analytics Privacy Third-Party Cookies Digital Marketing Privacy Sandbox

Share this article: