Consent, identity and cookies: where things stand in 2026

This piece informs three decisions: how to collect and pass on consent, how much to rely on cross-site identifiers, and how to keep measuring when some people say no. It describes the situation as of October 2026; the rules and browsers move, so the dates matter. It is not legal advice.

• Chrome kept third-party cookies. In April 2025 Google said it would keep its current approach of offering users third-party cookie choices in Chrome rather than phase them out or show a new standalone prompt¹. In October 2025 it announced the retirement of most Privacy Sandbox technologies, including Topics, Protected Audience and Attribution Reporting, citing low adoption².
• Safari and Firefox block cross-site tracking by default, since 2020 and 2022 respectively^4, 5.
• In the EU, consent concerns the device. The EDPB's guidelines of October 2024 read the ePrivacy rule as covering tracking pixels and similar techniques, not only cookies⁶. The Commission proposed in November 2025 to move these rules into the GDPR⁷; as of 2026 that proposal was still going through Parliament and Council^8, 9.
• Signals and plumbing. Consent mode and IAB Europe's TCF pass choices to tools^10, 11; server-side tagging and clean rooms change where data is processed, not whether consent is needed^13, 14.

In the EU and the European Economic Area two sets of rules apply together. The ePrivacy Directive's Article 5(3) requires consent before information is stored on, or read from, a person's device, unless it is strictly necessary for a service the person asked for. The GDPR then governs the personal data that results, including the lawful basis for using it (see GDPR and ePrivacy).

The EDPB's Guidelines 2/2023, adopted in October 2024, make clear how wide the device rule reaches. They treat a tracking pixel as within its scope: delivering the pixel counts as storage, at least through caching, and a site that embeds a pixel so that the device sends data to a third-party advertising service is gaining access⁶. The practical consequence: an email open pixel, a conversion pixel and a script that makes the browser report events all need the same analysis as a cookie.

The Commission's Digital Omnibus proposal of 19 November 2025 would move the device rules into the GDPR while keeping consent as the main rule. It would exempt low-risk purposes such as counting visits, require a single-click refusal, oblige sites to respect a choice for at least six months, and let people set their preferences once, for example in the browser⁷. As of 2026 it remains a proposal: the procedure was still before Parliament and Council, and commentators reported that the Council's text had dropped the browser-signal provision^8, 9. Plan for today's rules and watch the procedure file.

Outside Europe the rules differ by market; check each market's own rules before reusing a European set-up, and keep the same discipline everywhere: clear notice, a real choice and a record of it.

Three points matter for planning.

• Chrome's position is a choice, not a guarantee Google kept third-party cookies under user choice¹ and is retiring the Privacy Sandbox APIs meant to replace them; CHIPS (partitioned cookies) and FedCM (federated sign-in) continue, and work on attribution moves to a W3C working group². Protected Audience was deprecated in Chrome 144, and a June 2026 update on the Chromium developers' list proposed its removal in Chrome 150, noting that it was used on 1.1% of page loads³.
• Safari and Firefox users are already cookieless for cross-site tracking Safari blocks cross-site cookies and limits script-written storage to seven days without interaction⁴; Firefox gives each site its own cookie jar⁵.
• Consent rules apply regardless of browser In the EU, a cookie Chrome allows still needs consent if it is not strictly necessary.

The planning answer is the same whichever browser wins: build on first-party data, use contextual targeting where identity is missing, and measure with methods that do not depend on following individuals, such as marketing mix modelling and incrementality tests; see measuring effectiveness.

A consent management platform (CMP) asks, records and passes on choices (see consent management). Its job is not to maximise acceptance; it is to produce a choice that will stand up to a regulator and that every tool honours.

Avoid dark patterns such as a hidden refuse button or repeated prompts after a refusal; the Omnibus proposal would write a single-click refusal and a six-month respite into law⁷.

Consent mode. Google's consent mode lets its tags adjust to the consent state. In the basic implementation, tags wait until the person has answered the banner; in the advanced one, tags load with consent denied by default, adjust as the choice is made, and allow more detailed conversion modelling¹¹. For traffic in the EEA, consent mode carries two further parameters, ad_user_data and ad_personalization, and advertisers who measure EEA traffic with Google tags must pass people's choices to Google under its EU user consent policy¹². Choose the implementation with your data protection lead, since in advanced mode tags load before the person has chosen.

The TCF. In programmatic advertising, IAB Europe's Transparency and Consent Framework carries choices to vendors as a consent string. Version 2.3 made the disclosed-vendors segment mandatory: since 1 March 2026 a string created without it is invalid¹⁰. Check that your CMP and your vendors are on the current version.

Server-side tagging moves the work of tags from the browser to a server the company controls. The browser sends one request per event; the server then builds each vendor's request and can remove personal data before passing anything on; cookies the server sets on the company's own subdomain are first-party¹³. That brings better page speed, more control and fewer third-party scripts.

It does not change the consent question. The browser still sends the event, and under the EDPB's reading a script that makes the device send data falls within the device rule⁶. Server-side tagging is a way to honour consent more precisely, not a way around it. Using it to set long-lived first-party cookies that track people who refused would defeat its purpose.

A data clean room lets two companies, for example an advertiser and a retailer or publisher, match and analyse their data for agreed purposes without handing each other raw records. The IAB Tech Lab's guidance, released as version 1.0 in July 2024, sets out common principles, functions and privacy-enhancing technologies, and the limitations buyers should expect¹⁴. Use one for audience overlap, reach and conversion measurement with retail media and publishers. Using a clean room does not provide consent: the data that goes in must have been collected with a lawful basis that covers this use.

An illustrative business, not a real company: a travel brand selling in Europe and the Gulf, with a website, an app, email and paid media.

• Audit The analytics and ad tags fire on page load, before the banner is answered; the banner has "Accept" on the first layer and "Refuse" two clicks away; email uses an open pixel without any consent question.
• Fixes Tags now wait for consent; refusal is one click on the first layer; email open tracking is treated as device access in the EU; consent is stored in the CRM and passed to tags through consent mode and to programmatic partners through a current TCF string.
• Measurement Because part of the audience refuses, the team stops treating platform-reported conversions as complete, adds a quarterly geo-based incrementality test, and moves budget decisions to a mix model.
• Partners A clean room with one airline partner measures shared customers, using only data whose consent covers that purpose.

• Waiting for the "cookie deadline". There is none in Chrome as of October 2026; the risk is consent rules and browsers that already block cross-site tracking^1, 4, 5.
• Treating server-side tagging as a consent workaround. It moves processing, not the obligation^6, 13.
• Two consent records. The banner says no and the CRM says yes; the tools read whichever they were wired to.
• An out-of-date consent string. Strings without the required segment have been invalid since March 2026¹⁰.
• Measuring only those who said yes, and reading the result as the whole audience.

1. List every tag, pixel and SDK, what it does and whether it needs consent; include email pixels.
2. Check the banner: refuse as easy as accept, purposes in plain words, nothing firing before the choice.
3. Make one consent record the reference and pass it to every tool: consent mode, the TCF string, server-side rules.
4. Check your CMP and vendors are on TCF v2.3, and your EEA tags pass the two consent mode parameters.
5. Decide where server-side tagging helps (speed, control, fewer scripts) and write the rules for what each vendor receives.
6. Add one measurement method that does not depend on cross-site identity; start with the measurement framework.

• Chrome and the Privacy Sandbox: TechRadar on the April 2025 decision¹, Google's October 2025 update² and the Chromium intent to remove Protected Audience³.
• Other browsers: WebKit⁴ and Mozilla⁵.
• The EU rules: the EDPB's guidelines⁶, the Commission's Omnibus proposal⁷, the procedure file⁸ and Taylor Wessing's commentary⁹.
• Signals and plumbing: IAB Europe on TCF v2.3¹⁰, Google on consent mode^11, 12 and server-side tagging¹³, and the IAB Tech Lab on clean rooms¹⁴.
• Next in this track: AI in marketing; before it, first-party data and CDPs.