Second-party vs third-party data after cookies

Third-party cookies are not gone: on 22 April 2025 Google said Chrome would keep leaving the choice to users and add no new prompt, while Safari blocks them by default (WebKit, 24 March 2020) and Firefox rolled out Total Cookie Protection by default (Mozilla, 14 June 2022). What decides your attribution is not which data type survived but which inputs you still control: your own orders and sessions, less what Safari's 7-day storage cap and consent take away. Second-party and third-party data say who supplied a record, and measuring what your own spend caused starts from your orders, not from them.

What is the difference between second-party and third-party data?

These are industry terms, not legal ones. Second-party data is another company's first-party data, passed to you directly under an agreement; Second-party data: what it is and when it helps covers how that works and what the GDPR asks. Third-party data is gathered by a company with no direct relationship to the people in it, and sold on. Third-party cookies are one route to it: Chrome's Help says other sites can use them to personalise content and ads and to learn about actions you take on other sites. That is why two separate questions, which data you buy and which cookies browsers allow, get tangled.

What is the status of third-party cookies, by date?

Dated announcements, from the platforms themselves:

1. 14 January 2020. Google said it planned to phase out support for third-party cookies in Chrome, and intended to do so within two years (Chromium Blog).
2. 24 March 2020. WebKit announced that cookies for cross-site resources are blocked by default across the board in Safari (WebKit blog). Its tracking-prevention page still says ITP blocks third-party cookies by default.
3. 14 June 2022. Mozilla announced it was rolling out Total Cookie Protection, which confines cookies to the site where they were created, by default to more Firefox users (Mozilla).
4. 22 April 2025. Google said it would maintain its current approach of offering users third-party cookie choice in Chrome, with no new standalone prompt. The UK's Competition and Markets Authority recorded the announcement and on 17 October 2025 closed its Privacy Sandbox case (CMA case page).
5. 17 October 2025. Google said it would retire Privacy Sandbox technologies including the Attribution Reporting API and Topics. Its feature-status page, last updated 14 August 2026, lists both to deprecate and remove (Google).
6. Now. Chrome's Help page says users can allow or block third-party cookies, and that they are blocked by default in Incognito mode (Google Chrome Help).

What replaced them, and what does that leave your attribution?

Nothing replaced them one for one. Four things shape what your attribution can see:

• First-party cookies and storage on your own domain, with limits. Safari deletes cookies created in JavaScript and other script-writeable storage after 7 days of no user interaction with the website (WebKit, tracking prevention policy). A Safari visitor who returns after that gap can look new to a script-based analytics tag.
• Consent, and modelling for the gap. GA4's behavioural modelling of users who decline analytics cookies has prerequisites, including at least 1,000 events per day with analytics_storage denied for at least 7 days, and at least 1,000 daily users with it granted on at least 7 of the previous 28 days. Without enough consented traffic, those users' events aren't reported (Google Analytics Help). A store with few consented visitors won't meet that.
• Platform measurement APIs, cut back. The Attribution Reporting API is on Google's retire list above.
• App-side rules. From iOS 14.5, apps need the user's permission through App Tracking Transparency to track them or access their advertising identifier (Apple). A web store meets Safari's rules instead.

Second-party and third-party data aren't on that list. They describe who supplied a record, not how your store measures its own orders.

How do you audit your own attribution inputs?

Run it on your own numbers:

1. List each input to your attribution and mark who sets it: your domain, a platform pixel, or another company's cookie. Anything in the last group depends on a browser choice you don't control.
2. Reconcile GA4 purchases with Shopify orders for the same weeks. The gap is what your analytics didn't see. Consent, blockers and browser limits are among the causes.
3. Compare Safari and Chrome in GA4 over the same weeks: share of new users and purchases per session. A much higher new-user share in Safari is what a 7-day storage cap would produce.
4. Check your consent numbers against the GA4 modelling thresholds above. If you are under them, don't expect modelled data to fill the gap.
5. Before buying second-party or third-party data, ask which decision it changes. If it targets ads, it won't change how you measure your own orders. If a vendor says it improves measurement, ask which holdout test validated that.

What the result means:

• Pass: each input is first-party or consented, and each gap to Shopify has an explanation you can write down.
• Fail: you don't know who owns an input, or an input depends on a third-party cookie or on an API Google has retired.

Sources, 30 September 2026: A path towards making third party cookies obsolete (Chromium Blog, 14 January 2020); Full Third-Party Cookie Blocking and More (WebKit, 24 March 2020); Tracking Prevention in WebKit (WebKit); Total Cookie Protection by default (Mozilla, 14 June 2022, updated 28 August 2024); Next steps for Privacy Sandbox (Google, 22 April 2025); Update on Plans for Privacy Sandbox Technologies (Google, 17 October 2025); Privacy Sandbox feature status (Google, last updated 14 August 2026); Manage cookies in Chrome (Google Chrome Help, 2026); Privacy Sandbox case page (Competition and Markets Authority, last updated 17 October 2025); Behavioral modeling for consent mode (Google Analytics Help, 2026); User privacy and data use (Apple Developer, 2026). These are the platforms' own statements and a regulator's record. No source here measures how much the changes move a given store's numbers.

Related answers

• Second-party data: what it is and when it helps
• DTC measurement under GDPR: what consent does to your data
• Third-party cookie, defined
• Third-party data, defined
• Causal attribution