Attribution after third-party cookies and what each method can prove
Google kept third-party cookies in Chrome in July 2024, and measurement is still degraded. Consent gaps, modelled conversions, incrementality tests and surveys each answer a different question.
Contents
Google is no longer removing third-party cookies from Chrome. On 22 July 2024 it said it would offer users a choice instead. That reversal does not restore deterministic measurement: consent gaps, browser defaults and modelling still sit between a click and a sale, and each replacement method answers a different question.
Key takeaways
- On 22 July 2024 Google said it would not deprecate third-party cookies and would introduce a choice prompt in Chrome instead.
- Safari has blocked third-party cookies by default since March 2020 and Firefox since June 2022, so a large share of sessions was never deterministic.
- Google Ads only models unconsented conversions above a stated threshold: 700 ad clicks over seven days per country and domain grouping.
- Randomized tests are the only method that measures causation, and across 25 experiments the median confidence interval on ROI was more than 100 percentage points wide.
What changed in July 2024, and what didn't
The Privacy Sandbox post of 22 July 2024 is short and specific: "Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing."
What did not change is everything outside Chrome. WebKit announced full third-party cookie blocking in Safari on 24 March 2020, along with a seven-day cap on script-writable storage for sites classified as trackers. Mozilla rolled out Total Cookie Protection by default on 14 June 2022, confining each cookie to the site that set it.
Nor does it change consent law. A user who declines analytics storage is still not measured, whatever the browser allows.
The consent gap is a data gap
Consent mode does not recover the declined sessions. It signals the refusal, and the platform then estimates what is missing from the sessions it can still see. That is a model, not a recovery.
The thresholds are published. Google Ads states a requirement of 700 ad clicks over a seven-day period per country and domain grouping before conversion modeling starts. Google Analytics 4 requires at least 1,000 events per day with analytics storage denied for at least seven days, plus 1,000 daily users with consent granted on at least 7 of the previous 28 days.
Below those volumes there is no modelling at all, which is the situation for most mid-market advertisers outside their peak months.
Google Ads requires 700 ad clicks over seven days, per country and domain grouping, before consent mode conversion modeling applies. Google Analytics 4 requires 1,000 events per day with storage denied for seven days. Source: Google Ads Help and Google Analytics Help, consulted October 2024.
What modelled conversions can claim
A modelled conversion is an estimate of an aggregate, produced from the behavior of consenting users. It can support a claim about direction and rough magnitude at account level over a month. It cannot support a claim about one campaign in one week, and it cannot be reconciled line by line with the CRM.
Treat it as you would any model output, with the same discipline that evaluating a language model in production demands: know the training input, know the failure mode, and check it against a held-out source of truth such as booked revenue.
What incrementality tests prove, and what they cost
A geo holdout or a randomized experiment is the only method here that measures causation rather than correlation. It is also the most expensive, and the published evidence explains why.
Lewis and Rao analyzed 25 large field experiments representing $2.8 million USD of digital advertising spend and found the median confidence interval on return on investment was more than 100 percentage points wide, concluding that informative tests "can easily require more than 10 million person-weeks".
Blake, Nosko and Tadelis ran a large-scale experiment at eBay. Brand-keyword ads produced no measurable short-term benefit, because roughly 99.5% of the forgone paid clicks came back through organic results. For non-brand keywords the experimental return was -63%, against a naive regression estimate above 4,100%.
In 15 randomized advertising experiments at Facebook covering 500 million user-experiment observations, observational methods failed to reproduce the experimental result: in half the studies the estimated increase in purchases was off by a factor of three. Source: Gordon, Zettelmeyer, Bhargava and Chapsky, Marketing Science, 2019.
Where self-reported attribution helps
A post-purchase question — "how did you hear about us?" — measures memory and salience, not causation. People under-report search, over-report the last thing they remember, and skip the question when it is optional.
It is still worth collecting, because it surfaces channels no pixel sees: a referral, a podcast, a physical sign. Use it to find candidates for a real test, never as the number in the board pack. That is the rule behind board-level metrics for a brand investment: publish the method next to the number.
FAQ
Is third-party cookie deprecation cancelled?
Google announced on 22 July 2024 that it would not deprecate third-party cookies in Chrome and would offer users an informed choice instead. Safari and Firefox continue to block them by default, so cross-site tracking remains unavailable for a substantial share of traffic.
Why do platform numbers exceed the CRM?
Because platforms count conversions they can attribute, including modelled ones, within their own lookback windows, and two platforms will claim the same sale. The CRM counts money. Reconcile on monthly totals, not per click.
What should a small team measure first?
Server-side or backend revenue by month, channel mix from self-reported answers, and one holdout test per year on the largest line of spend. That is enough to decide budgets, and it is the same operating discipline behind treating digital work as an operations problem.
What to report
Report three numbers with their method: booked revenue, platform conversions marked as modelled where they are, and the last holdout test with its confidence interval. Agree the definitions before the campaign runs, the way a brief that specifies what it must prove prevents an argument at the end. Within six months the Chrome choice prompt will show what share of users opts in, and that number decides how much modelling anyone lives with.
