Cookies are small pieces of data that websites leave in your browser so they can recognize you later. When the first formal rulebook for them, RFC 2109, appeared in February 1997, one section opened with a sentence that now reads like a forecast:
"Users must have control over sessions in order to ensure privacy."
Web pages often load content from other companies, ad images for instance. Cookies set by those outside servers are called third-party cookies, and they let a company you never chose to visit recognize you on every site that embeds its content. The RFC restricted them. Browsers could offer users an override, but it had to start switched off.
Netscape and Microsoft, whose browsers dominated, allowed third-party cookies anyway. David Kristol, one of the RFC's authors, later recounted resistance from advertising companies whose targeting already depended on them. Their loss would have been narrow, he noted: they could still show ads, just not follow people from site to site. A known flaw tends to stay in place when the people who would pay to fix it are not the people it harms.
The first browsers to move had no stake in cross-site ad targeting. Safari began limiting new third-party cookies in 2003 and blocked them entirely in 2020. Firefox started blocking known trackers' cookies by default in 2019, and in 2022 began keeping each site's cookies separate, so a tracker present on two sites sees two strangers instead of one person.
Chrome, the browser most people use, belongs to Google, which sells much of the web's advertising. In January 2020 Google announced it would phase out third-party cookies "within two years," warning that abrupt blocking would hurt ad-funded sites and might push trackers toward fingerprinting, which recognizes a device by its configuration and cannot be erased. The deadline slipped three times. Then removal shrank to a user choice, and the choice shrank to settings Chrome already offered. In October 2025 Google announced it would retire most of its replacement tools, citing low adoption.
What fixing the flaw would cost depended on who else fixed it. Studying a Google experiment, the UK's Competition and Markets Authority (CMA) found that blocking these cookies could cut publishers' short-term ad revenue by about 70%. It judged that figure likely overstated the long-run loss, partly because the tested publishers still competed with rivals selling targeted ads. Only Chrome could end the practice for nearly everyone at once, and Google competes with the ad firms that ending it would hurt.
That conflict is why the CMA, in 2022, accepted commitments from Google that removing cookies would not tilt the ad market in its favor. In October 2025 it released Google from them. With cookies staying, it found too little evidence that Google's replacement tools mattered competitively.
All fifteen consultation respondents objected. Some said Google's own data still gave it an edge. One association called the reasoning circular, since the tools looked insignificant partly because the commitments had constrained them. The CMA held that its concerns had depended on Google restricting cookies in the first place.
So the competition safeguard existed only because of a planned privacy fix, and it lapsed when the plan did. The UK's privacy regulator had raised the other worry in July 2024, saying it was disappointed that Chrome would keep third-party cookies. By changing nothing, Google made the competition worry moot in the CMA's eyes, though not in its respondents', and left the privacy worry where it was.
Chrome still accepts third-party cookies unless you change a setting, so the protection the 1997 rulebook wanted switched on by default remains something you have to go looking for.
