How to measure marketing without third-party cookies

third-party cookies let an advertiser recognize the same browser across unrelated sites, which is what made cross-site retargeting, frequency capping and click-based attribution work by default for two decades. Browser vendors have been phasing that mechanism out, intelligent tracking prevention already blocks much of it, and privacy regulation adds consent requirements on top. None of this removed the need to measure marketing — it removed one convenient way of doing it. What replaces it is not one tool but a stack of partial answers, each covering part of what cookies used to cover.

Start with what you actually still control

first-party data — data a customer gave you directly, on your own domain, tied to your own account or email — was never dependent on third-party cookies and remains the most reliable signal available. The practical shift is architectural: move identity resolution and conversion tracking onto systems you own (your CRM, your data warehouse, a login or loyalty ID) rather than a browser cookie set by an ad platform. This does not recover reach or discovery — it only strengthens measurement for customers who have already engaged with you once.

server-side tagging moves the collection of conversion events from the browser to a server you control, which is more resilient to ad blockers and browser tracking prevention than a client-side pixel, and lets you decide exactly what data leaves your systems and in what form. It requires real engineering investment — someone has to build and maintain the server-side endpoint — and it doesn't create data that didn't exist; it just collects the data you already have more reliably.

Handle consent properly, because it changes the numbers

Whatever collection method you use, you need a defensible answer to what happens when a visitor declines tracking. consent mode lets ad platforms model the conversions they can't directly observe from consenting users' behavior, filling gaps statistically rather than leaving them blank — useful, but it means your reported numbers include modeled estimates, not only observed events, and you should know which is which before comparing periods. A consent platform like Cookiebot scans a site's own trackers automatically and blocks non-essential scripts until a visitor consents, and integrates with consent-mode signaling so ad platforms adjust accordingly — but the consent rate itself, not just the tooling, determines how much of your audience remains directly measurable.

Conversion APIs replace what the pixel used to send

A server-side conversion API sends conversion events from your servers directly to an ad platform, matched to the platform's own logged-in identifiers rather than a browser cookie. This recovers some of the signal lost to client-side blocking because it doesn't depend on a script executing in the visitor's browser at all. It requires you to decide what customer data you're willing to share with each platform, under what hashing or matching method, which is a privacy and legal decision as much as a technical one — loop in whoever owns data governance before implementation, not after.

Data clean rooms: collaboration without handing over raw data

A data clean room lets two organizations — a brand and a retailer, or a brand and an ad platform — jointly analyze their combined data without either side seeing the other's raw records; only aggregated, permissioned results come out. AWS Clean Rooms runs this within a single cloud (AWS) with an optional differential-privacy add-on that adds calibrated statistical noise to bound what any single query can reveal. LiveRamp Clean Room instead targets cross-cloud collaboration — Snowflake, Databricks, BigQuery — typically paired with LiveRamp's identity graph so matching works across parties that don't share the same customer identifiers natively. Clean rooms solve a genuine problem (measuring against a partner's data without a raw data handoff) but they are infrastructure, not a finished report — someone still has to design the analysis and interpret it.

The two methods that don't need individual tracking at all

marketing mix modeling never depended on cookies to begin with — it works from aggregate spend and outcome data over time, which is exactly why it has become more central to measurement as individual-level tracking has eroded. Meridian, Google's open-source Bayesian MMM library, is a reasonable starting point if you have a data scientist and multiple years of spend history; it produces channel-level contribution estimates without any user-level data at all.

incrementality testing goes further and gives you a causal answer: hold out or vary spend across matched geographies and measure the actual difference in outcomes, with no tracking of individual users required. Haus runs this as a managed service — designing randomized geo holdouts, running the statistics, and translating results into channel-level lift. Because it doesn't rely on cookies, pixels or identity resolution, incrementality testing is the most durable method here against further tracking restrictions, at the cost of needing real ad spend and patience to run a valid test.

A shortlist by situation

• You mostly need defensible consent handling before anything else. Start with a consent platform like Cookiebot and confirm it integrates with your ad platforms' consent signaling.
• You're an AWS-centric organization wanting to measure against a retail or platform partner's data. AWS Clean Rooms.
• You collaborate across multiple clouds or need identity resolution baked in. LiveRamp Clean Room.
• You have spend history and a data scientist, and want channel-level estimates without user tracking. Meridian.
• You want a causal, not modeled, answer and can afford to run a real test. Haus.

Questions to ask before you commit

• Which of our reported conversions are observed events, and which are modeled — and does the dashboard label the difference?
• What customer data would a conversion API or clean room require us to share, and has legal or privacy reviewed it?
• If consent rates fall further, does our measurement approach degrade gracefully, or does it break?
• Has any of our attribution or MMM output ever been checked against an actual incrementality test?

Common mistakes

• Treating consent-modeled conversions as equivalent to observed ones when reporting month-over-month trends.
• Building a server-side or conversion-API pipeline without involving whoever owns data governance and consent.
• Assuming a clean room removes the need for an analyst — it removes the need to hand over raw data, not the need for analysis.
• Abandoning measurement rigor because "cookies are gone," when first-party data, MMM and incrementality testing were never dependent on them.

For the underlying choice of attribution method, see how to choose an attribution model, and for running MMM specifically, see how to run marketing mix modeling. Browse consent and privacy tools and data clean room tools for the full field.