Privacy Sandbox and Cookies: Identity Options for 2026

Chrome kept third-party cookies as Google changed its Privacy Sandbox plans. Retirement announcements, API deprecation and browser removal are different events. Check each API’s status and supported browser versions before changing identity or measurement integrations. Compare first-party data, consented IDs and contextual approaches against the permissions and signals your workflow actually has.

This page is general information for programmatic and privacy teams. It is not legal advice.

Two things to read from the table. First, the retirement was not a surprise: Google had spent 2024 moving from deprecation to "choice", and the CMA's June 2025 testing summary reported publisher revenue falling by around 30% when Privacy Sandbox tools replaced cookies (PPC Land, 18 October 2025, citing the CMA). Second, an earlier removal target is not confirmation of every API’s availability. As of the status page's 14 August 2026 update, the deprecated APIs still appear without a removal milestone, so a team should test rather than assume that document.browsingTopics() has gone from every Chrome 150 build.

Sources for status: Privacy Sandbox blog, 17 October 2025; Privacy Sandbox status page, updated 14 August 2026.

The arithmetic matters for planning. Roughly a fifth of global browsing was already cookieless before 2025 and remains so. Chrome's decision froze the open web's addressability at that level rather than cutting it further.

The table lists the solutions a buyer or publisher will meet in 2026. Adoption figures are only given where a dated source exists; "n/d" means no disclosed figure.

A cookie is set and read by a domain and dies with Safari, Firefox, Incognito and cookie clearing. UID2 is a token derived from a hashed email, so it survives across devices and browsers but only exists where a user has logged in or supplied an email. The practical difference is coverage: cookies reach most Chrome users without a login; UID2 reaches authenticated users on any browser. UID2 also moves the privacy risk from the browser to the operator. The public operator is run by The Trade Desk; a private operator keeps the hashing and token generation inside your own environment (UID2 docs). For an EU deployment the relevant framework is EUID, which is "driven by the General Data Protection Regulation" and the TCF rather than US state law (EUID docs).

The two solve different problems. UID2 and EUID are deterministic: no email, no ID. ID5 combines publisher signals and hashed emails where present with probabilistic linking, which is why its site coverage is wide and why its EU position depends on the publisher's consent capture rather than on a login (PPC Land, 22 August 2026). Deterministic IDs give higher match quality on authenticated inventory; ID5 gives reach on unauthenticated inventory. Most buyers in 2026 pass several IDs in the OpenRTB user.eids array and let the bidder choose (IAB Tech Lab, OpenRTB 2.6).

Four decisions set the boundaries. None of them is about Privacy Sandbox. All of them apply to its replacements.

• The consent signal is itself personal data. On 7 March 2024 the CJEU held that a TC String is personal data when it can be linked to an IP address, and that IAB Europe is a joint controller for it (CJEU C-604/22). An ID framework that carries a consent string carries personal data.
• Platforms in the chain cannot borrow consent. The Norwegian DPA fined Xandr €8.6 million in a decision of 2 October 2026 for real-time bidding with Grindr users' advertising ID and IP, finding Xandr a joint controller that could not rely on the app's consent: "accountability cannot be outsourced" (EDPB, 16 October 2026). Every operator in the identity table is in the same position.
• "Consent or pay" needs a real alternative. The EDPB's Opinion 08/2024 of 17 April 2024 says large platforms should offer an equivalent alternative without behavioural advertising, and should give "significant consideration" to a free one (EDPB, 17 April 2024). The Commission fined Meta €200 million on 23 April 2025 under the DMA on the same model (European Commission, 23 April 2025).
• The TCF keeps tightening. TCF v2.2 removed legitimate interest for personalized advertising purposes 3 to 6 and became mandatory on 20 November 2023 (IAB Europe, TCF v2.2); v2.3 made the Disclosed Vendors segment mandatory with a deadline of 28 February 2026 (IAB Europe). The field-level rules are in GDPR, ePrivacy and the bidstream; the wider set of pages is in the identity and privacy hub.

The standards bodies are moving in step. IAB Tech Lab released GPP updates and the Data Deletion Request Framework v2 on 23 October 2025 and put a privacy standards portfolio update out for public comment on 11 August 2026 (IAB Tech Lab press releases).

The question is no longer "which ID replaces the cookie". It is which combination of signals you can operate under your own consent and control. A workable 2027 stack has six layers.

Three design rules follow from the legal frame above.

1. Own the consent record. If a regulator asks why an ID was in a bid request, the answer must come from your log, not the vendor's. The Xandr decision makes that explicit.
2. Keep raw identifiers inside the perimeter. A private operator for EUID or UID2 means hashed emails never leave your environment; only tokens do. The same rule applies to the clean room. For EU organizations this also closes a sovereignty gap, described in EU sovereign ad tech.
3. Expect roughly a fifth of browsing to have no identifier at all. Safari and Firefox were 21.07% of worldwide browsing in September 2026 (StatCounter). Contextual and first-party login are the only answers there. Budget for them rather than treating them as fallback.

The wider planning context is in Programmatic advertising strategy 2027 and in DSP, DMP and external data in explainable RTB.

Publishers. Cookies still work in Chrome, so the revenue cliff that 2024 plans assumed did not arrive. The CMA's June 2025 testing summary put the cost of the Sandbox alternative at around 30% of revenue (PPC Land, 18 October 2025), which is the gap that logins, EUID or UID2 tokens and a telco signal now have to close on the cookieless fifth of traffic. The work is authentication rate, not API migration.

Buyers. Retargeting and conversion measurement lost their browser-native replacements. Both now depend on identifiers passed in user.eids and on server-side event collection. Audit which IDs each DSP accepts, which consent signal it checks, and where it stores the match. The Xandr decision shows that "the SSP had consent" is not an answer a DPA accepts.

Retailers, banks and telcos with first-party graphs. The retirement removed the one path that would have let Chrome, not you, hold the audience. A private operator for EUID or UID2 and a clean room for partner matching keep the graph inside your perimeter while still reaching the open web. The commerce-media context is in Commerce media networks directory.

Is Google still getting rid of third-party cookies? No. On 22 April 2025 Google said Chrome would keep its current third-party cookie settings and would not introduce a standalone prompt (Privacy Sandbox blog, 22 April 2025). The CMA released Google's commitments on 17 October 2025 and closed its case (CMA). Incognito still blocks third-party cookies, and users can block them in settings.

What Privacy Sandbox APIs still exist? CHIPS (partitioned cookies, Chrome 114+), FedCM (Chrome 108+) and Private State Tokens continue; the Storage Access API (Chrome 119+) is also supported. Topics, Protected Audience, Attribution Reporting, Private Aggregation, Shared Storage, SelectURL and Related Website Sets were retired on 17 October 2025, deprecated in Chrome 144 (13 January 2026) and set for removal in Chrome 150 (30 June 2026) (Privacy Sandbox status page, updated 14 August 2026; Chromium Dash).

What is the difference between UID2 and EUID? Both are open-source frameworks that turn a hashed email or phone into a rotating token, and both have a public operator run by The Trade Desk plus a private-operator option. UID2's consent model follows US state law such as the CCPA; EUID's is "driven by the General Data Protection Regulation" and the IAB TCF, with a Transparency and Control Portal for opt-out, and it uses a separate namespace (EUID docs). EU and UK publishers use EUID.

Is ID5 better than UID2? They are different tools. UID2 and EUID are deterministic and need an email or phone, so they work on authenticated traffic. ID5 links publisher signals and hashed emails where present with probabilistic methods, so it reaches unauthenticated pages; Sincera counted it on about 100,000 sites in January 2025, a vendor-selected figure (PPC Land, 22 August 2026). Most stacks pass both in user.eids and let the bidder weigh them.

Do universal IDs comply with GDPR? They can, if the controller has a lawful basis for the hashed identifier and the token, passes a valid TCF signal, and can prove it. The CJEU held on 7 March 2024 that a consent string is itself personal data (CJEU C-604/22), and the Norwegian DPA's October 2026 Xandr decision found that a platform cannot rely on another party's consent (EDPB, 16 October 2026). Compliance is a property of your consent records and contracts, not of the ID format.

1. Chromium Blog, "Building a more private web: A path towards making third party cookies obsolete" (14 January 2020). https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html
2. Google, "An updated timeline for Privacy Sandbox milestones" (24 June 2021). https://blog.google/products/chrome/updated-timeline-privacy-sandbox-milestones/
3. Google, "Expanding testing for the Privacy Sandbox for the Web" (27 July 2022). https://blog.google/products/chrome/update-testing-privacy-sandbox-web/
4. Google, "The next step toward phasing out third-party cookies in Chrome" (14 December 2023). https://blog.google/products/chrome/privacy-sandbox-tracking-protection/
5. Privacy Sandbox, "Update on the plan for phase-out of third-party cookies on Chrome" (23 April 2024). https://privacysandbox.google.com/blog/update-on-the-plan-for-phase-out-of-third-party-cookies-on-chrome
6. Privacy Sandbox, "A new path for Privacy Sandbox on the web" (22 July 2024). https://privacysandbox.google.com/blog/privacy-sandbox-update
7. Privacy Sandbox, "Next steps for Privacy Sandbox and tracking protections in Chrome" (22 April 2025). https://privacysandbox.google.com/blog/privacy-sandbox-next-steps
8. Privacy Sandbox, "Update on Plans for Privacy Sandbox Technologies" (17 October 2025). https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies
9. Privacy Sandbox, "Feature status" (last updated 14 August 2026). https://privacysandbox.google.com/overview/status
10. blink-dev, "Intent to Deprecate and Remove: Topics API" (7 November 2025; LGTM 12 November 2025; status update 11 June 2026). https://groups.google.com/a/chromium.org/g/blink-dev/c/_R85yctz4Rs
11. Chromium Dash, milestone schedule M144 (stable 13 January 2026). https://chromiumdash.appspot.com/fetch_milestone_schedule?mstone=144
12. Chromium Dash, milestone schedule M150 (stable 30 June 2026). https://chromiumdash.appspot.com/fetch_milestone_schedule?mstone=150
13. UK Competition and Markets Authority, "Investigation into Google's Privacy Sandbox browser changes" (case page; commitments released 17 October 2025). https://www.gov.uk/cma-cases/investigation-into-googles-privacy-sandbox-browser-changes
14. PPC Land, "Chrome kills most Privacy Sandbox technologies after adoption fails" (18 October 2025). https://ppc.land/chrome-kills-most-privacy-sandbox-technologies-after-adoption-fails/
15. WebKit, "Full Third-Party Cookie Blocking and More" (24 March 2020). https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/
16. Mozilla, "Firefox rolls out Total Cookie Protection by default to all users worldwide" (14 June 2022). https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users/
17. StatCounter, "Browser Market Share Worldwide" (September 2026). https://gs.statcounter.com/browser-market-share
18. Apple Developer, "User Privacy and Data Use" (App Tracking Transparency). https://developer.apple.com/app-store/user-privacy-and-data-use/
19. UID2 documentation, "Public and Private Operators". https://unifiedid.com/docs/ref-info/ref-operators-public-private
20. UID2, homepage with partner announcements (2022 to 2025). https://unifiedid.com/
21. EUID documentation, "EUID Overview" (last updated 12 October 2026). https://euid.eu/docs/intro
22. EUID documentation, "Public and Private Operators". https://euid.eu/docs/ref-info/ref-operators-public-private
23. The Current, "EUID adoption spreads across the programmatic supply chain" (25 November 2024). https://www.thecurrent.com/marketing/euid-adoption-programmatic-supply-chain-ssps-publishers
24. AdExchanger, "Alternative Identity Provider ID5 Nabs $20 Million In Series B Funding" (9 April 2024). https://adexchanger.com/identity/alternative-identity-provider-id5-nabs-20-million-in-series-b-funding
25. PPC Land, "Explaining ID5" (22 August 2026, clarified 5 September 2026). https://ppc.land/explaining-id5/
26. Business Wire, "ID5's 2025 State of Digital Identity Report Finds Usage of Alternatives Growing" (29 September 2025; returned 403 to the fetcher, figures from search index). https://www.businesswire.com/news/home/20250929910958/en/
27. PPC Land, "The Trade Desk integrates Utiq's telco identity signals across EMEA" (1 June 2026; Utiq figures as of 15 November 2025). https://ppc.land/the-trade-desk-integrates-utiqs-telco-identity-signals-across-emea/
28. Mobile Marketing Magazine, "Utiq now reaches over 55 million people across Europe" (2025). https://mobilemarketingmagazine.com/utiq-now-reaches-over-55-million-people-across-europe/
29. Utiq, homepage (consent description). https://utiq.com/
30. CJEU, Case C-604/22, IAB Europe v Gegevensbeschermingsautoriteit (7 March 2024). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0604
31. EDPB, "Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data" (16 October 2026; decision 2 October 2026). https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en
32. EDPB, "EDPB: 'Consent or Pay' models should offer real choice" (17 April 2024; Opinion 08/2024). https://www.edpb.europa.eu/news/news/2024/edpb-consent-or-pay-models-should-offer-real-choice_en
33. European Commission, "Commission finds Apple and Meta in breach of the Digital Markets Act" (23 April 2025). https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085
34. IAB Europe, "TCF v2.2" (launched 16 May 2023; deadline 20 November 2023). https://iabeurope.eu/tcf-2-2/
35. IAB Europe, "Transparency & Consent Framework" (v2.3 launched April 2025; deadline 28 February 2026). https://iabeurope.eu/transparency-consent-framework/
36. IAB Tech Lab, press releases (GPP updates and DDRF v2, 23 October 2025; privacy standards portfolio update, 11 August 2026). https://iabtechlab.com/press-releases/
37. IAB Tech Lab, OpenRTB 2.6 specification (user.eids). https://raw.githubusercontent.com/InteractiveAdvertisingBureau/openrtb2.x/main/2.6.md
38. Chrome for Developers: Chrome 153 release notes (September 8, 2026; checked October 18, 2026)

• 18 October 2026: separated the retirement announcement, historical Topics target and API-specific browser status. Added the later primary release notes; did not infer runtime removal from a calendar date.

• 18 October 2026: aligned the title and heading and applied recorded source-URL corrections where needed. Factual research cutoff remains 17 October 2026.

• 17 October 2026. First edition of the tracker, replacing the 2024 UID2 article. Timeline through the 14 August 2026 status page update. Next review 15 January 2027: confirm Chrome 150 removal status, Android phase-out dates, IP Protection, and new adoption disclosures.