Don’t worry about cookies, worry about your data

TL;DR: Third-party cookies never actually went away, and everyone in this industry already knows privacy rhetoric was never really about privacy. Here's what matters more: if you advertise on Meta or Google at any real scale, plugging your Shopify, CRM, and GA data into their systems isn't optional in any way that counts. Features like Meta's Conversions API and Google's Enhanced Conversions are technically opt-in, but skip them and your attribution and ad optimization degrade, so almost nobody skips them. Platforms are also increasingly setting these to on by default and putting the burden on you to opt out. There's no real negotiating table here. The leverage that does exist is narrower: what you build outside these platforms, and how carefully you track what each new default is actually doing. Brands aren't equally exposed either. Enterprise brands have enough server-side volume to barely feel the shift. Smaller brands that relied on granular third-party targeting are the ones with a real problem to solve.

The deadline that never came

Google spent years threatening to kill third-party cookies in Chrome, then didn't. Safari and Firefox had blocked them long before that with no industry-wide panic to match. The scare was really about who controls the largest browser on earth, not about cookies themselves.

That's why we don't really talk about cookies anymore. Not because the problem got solved, but because the deadline dissolved and the conversation moved on to what was actually working the whole time: first-party data, broader platform targeting, and creative doing more of the work that granular audiences used to do.

What "opt-in" actually means here

Losing third-party cookies didn't shrink what platforms know. It changed the pipe. Instead of scraping browser behavior, Meta and Google now ask brands to feed backend data (Shopify, Salesforce, GA, CRM exports) directly into features like Conversions API and Enhanced Conversions, often routed through data clean rooms.

Technically, none of this is required. Practically, it is. Skip Conversions API and your Meta attribution and ad delivery degrade against every competitor who didn't skip it. Skip Enhanced Conversions and Google's bidding has less to optimize against. There's no rule forcing you to plug in your backend, there's just a performance gap if you don't, and that gap is the whole point.

It's also getting harder to even decline passively. Google has started rolling features like conversion-based customer lists out as on by default for eligible accounts, with a deadline to opt out rather than a decision to opt in. The pattern across both platforms is the same: the default keeps moving toward more data flowing in, and the burden of stopping it keeps landing on you.

So there isn't a negotiation happening. There's a checkbox that's technically optional and a business case that makes it not optional at all. The honest question isn't "what are we getting in return." It's "do we actually know everything we've turned on, and would we notice if a new default started sending more."

This doesn't hit every brand the same way

Scale changes the math more than a lot of privacy content admits. A brand running enough volume, enterprise ecommerce, large B2B pipelines, has enough server-side data flowing in on its own that cookie loss is felt a lot less. The exposure sits with smaller, leaner brands that used to rely on tightly scoped third-party targeting to find a narrow audience cheaply. That's the segment actually forced to rebuild its targeting approach from scratch.

If you're advising or running a brand at that smaller end, the incentive-based first-party plays matter more, not less: app-exclusive launch discounts, loyalty programs that make an email worth giving up, lead gen forms built to capture a job title and company name instead of just an inbox. Competitions and sweepstakes still produce weak data, because people sign up for the prize, not the relationship.

Where the real strategy shift is happening

Two areas are seeing genuine change, not just a rebrand of old tactics:

Contextual targeting has matured well past its old reputation as a fallback. AI has sharpened it into a genuinely high-quality signal, and the partners building in this space are moving fast.

Zero-party data, information customers volunteer outside a normal transaction, usually through surveys or preference centers, is filling a gap first-party data can't. It's not owned the way a CRM record is, but it tells you what someone actually wants and why they chose you, which a purchase history never will. Paired with first-party data, it's becoming one of the sharper tools for upper-funnel targeting.

What to actually do with this

• Stop budgeting around a cookie deprecation that already passed. Budget around who controls your data pipes instead.
• Audit what you've actually turned on. Conversions API, Enhanced Conversions, clean room integrations, conversion-based customer lists. Know the full list, since platforms are increasingly enabling these by default and asking you to opt out rather than in.
• Accept that declining these features has a real performance cost, and decide deliberately whether you're paying it, rather than defaulting into the setting without noticing.
• If you're a smaller or mid-size brand, treat first-party and zero-party data collection as the priority, not a nice-to-have. You don't have the volume to coast on server-side signal the way enterprise brands do.
• Re-evaluate contextual targeting if the last look was more than a year old. It's not the fallback option it used to be.
• Build a zero-party data channel, a survey, a preference center, something, if you don't already have one feeding your targeting. It's one of the few data sources you fully control.
  
  

The bigger picture

None of this is really a privacy story, and your team already knows that. It's a control story, and the honest version is that brands have less control over the trade than they’d like. You can't opt out of Meta's or Google's data requests and stay competitive. What you can control is what you build outside of them: first-party relationships worth having, zero-party signal nobody else gets, and a clear picture of every default you've quietly accepted. The brands that come out ahead over the next few years won't be the ones who out-negotiated Meta or Google. They'll be the ones who stopped assuming they had more leverage over the big platforms than they actually do, and invested where they still have some.