How to do remarketing without third-party cookies

Few digital marketing subjects have piled up as much outdated information as this one. Between 2020 and 2024, the whole industry prepared for the end of third-party cookies in Chrome. Then came the delays, and finally the reversal.

The result is a marketing team split between the people who think remarketing without third-party cookies is already mandatory and the people who think nothing changed.

Both readings are wrong. The third-party cookie did not die in Chrome, that is true. But it was already dead in other browsers before the discussion began, and Google dismantled much of the alternative it had proposed.

A browser decision and a business decision are separate things. The first has changed several times and may change again; moving to first-party data does not depend on it.

Are third-party cookies over in Chrome or not?

They are not over. Chrome still accepts third-party cookies by default, and the user decides whether to block them in the browser's privacy and security settings. The deprecation promised at the start of the decade went through successive delays and was abandoned, with no new date put in its place.

Caption: remarketing without third-party cookies does not come from a Chrome decision, it comes from the data the institution already controls

What makes this confusing is that the promise was firm and public. Chrome did test the block: on 4 January 2024, Google turned on Tracking Protection for 1% of global users, restricting third-party cookie access by default for that group.

The test happened, but it never became the general rule. In April 2024 the timeline slipped to 2025, in July Google swapped deprecation for an informed choice proposal, and in April 2025 it dropped that proposal too.

For anyone running media, the relevant question was never whether Chrome would block it, but how much of an education institution's audience already browses without a third-party cookie. That number was already large in 2023.

What did Google decide about third-party cookies in April 2025?

On 22 April 2025, Google published that it had decided to maintain its current approach of offering users choice about third-party cookies in Chrome and that it would not be rolling out a new standalone prompt for it. The reason given was the divergence of perspectives on changes that would affect the availability of those cookies.

The official wording is in the post Next steps for Privacy Sandbox and tracking protections in Chrome, on the Privacy Sandbox blog. That is the source worth citing in a meeting, because it closes the argument about dates.

Understanding the full sequence helps, because each step changed what media teams were supposed to do:

Table: the sequence of official Google announcements that shapes the scenario for remarketing without third-party cookies in Chrome

The timeline is uncomfortable for anyone who likes a stable plan: in under two years, the same company announced a block, postponed it, swapped it for user choice, gave up and then dismantled the technical alternative.

Was Privacy Sandbox retired after that decision?

Much of it was. On 17 October 2025, Google announced the retirement of ten Privacy Sandbox technologies, citing low adoption levels. Topics, Protected Audience, the Attribution Reporting API, Private Aggregation (with Shared Storage) and IP Protection are among the discontinued ones.

That retirement is the piece many people have not taken in yet, and it changes the picture for anyone who was waiting for a cookie replacement inside the browser. The announcement is in the post Update on Plans for Privacy Sandbox Technologies.

What is left standing is the infrastructure layer, not the advertising one. The Privacy Sandbox status page, updated on 14 August 2026, keeps CHIPS, FedCM, Private State Tokens, Storage Access and storage and network partitioning.

The consequence is direct: there is no browser API today designed to replace a remarketing audience built on third-party cookies. What is left is the data the institution itself collects and manages.

Why did first-party data win even with the third-party cookie alive?

Because Chrome was never the only browser. Safari blocks all third-party cookies by default through Intelligent Tracking Prevention. Firefox confines cookies per site with Total Cookie Protection, on by default for all desktop users since June 2022. In neither of them does Google's decision change anything.

In Firefox, Total Cookie Protection confines each cookie to the site that created it, which breaks cross-domain reading even without blocking the cookie.

None of this means paid media management stopped working in 2022. It means coverage of an audience built on a third-party pixel is partial and uneven, and the gap shows up in the size of the list before it shows up in the report.

Video: how to read campaign data when remarketing without third-party cookies changes audience coverage, on the mkt4edu channel

There is also a reason that has nothing to do with browsers. First-party data is the only audience asset the institution controls, the only one that survives a platform change and the only one that can be reconciled against actual enrolment. A third-party cookie is rented; a contact base is owned.

That is why measuring marketing attribution with what the institution actually owns tends to be steadier than depending on a signal each browser treats differently.

Which first-party data does an institution already have and not use in remarketing?

Almost always more than the team imagines. An education institution with an online admissions process accumulates application forms, material download history, email opens, WhatsApp conversations, CRM funnel stages and fee payment status. That set supports a remarketing audience without depending on a third-party pixel.

The problem is rarely the absence of data. It is data scattered across systems that do not talk to each other, with consent recorded in one place and the campaign running in another.

Start with an inventory of what is already in the CRM and can become a media segment:

• Applicants who did not pay the fee: a small audience, high intent, quick to respond to a reminder.
• Prospects for a specific programme: segmentation by the area of interest declared on the form, not inferred from browsing.
• Undergraduates eligible for postgraduate study: an owned base with an active relationship and a complete history.
• Leads from earlier cycles who did not convert: reactivation by semester, respecting the retention period.
• Enrolled students who did not re-enrol: a retention audience, often ignored by media.

Video: the CRM as the source of the remarketing without third-party cookies audience at an education institution, on the mkt4edu channel

None of those segments needs a third-party cookie. All of them need organization, and that is where lead segmentation and qualification inside HubSpot makes the difference: the media list inherits the same logic as the nurturing list.

The next layer is prioritization. With lead scoring applied to educational marketing, the institution stops treating every applicant as equal and puts budget where the chance of enrolment is higher. Good educational marketing strategies rest on that cut, not on raw volume.

One caveat about size: an owned audience is usually smaller. In Google Ads, the minimum is 100 active visitors or users in the last 30 days for Search, Display and YouTube, and customer lists uploaded or updated after 1 February 2024 require 100 matched users, according to the audience lists documentation.

Remarketing and the LGPD: which legal basis applies to first-party data?

It depends on the data and the purpose, and the two most used grounds are consent and legitimate interest. The LGPD lists consent in art. 7, I, and legitimate interest in art. 7, IX. Art. 10, I, expressly recognizes supporting and promoting the controller's activities as a possible legitimate interest purpose.

That legal provision does not turn legitimate interest into a shortcut. Art. 10, § 1 limits processing to the data strictly necessary for the intended purpose, and § 2 requires transparency measures.

Brazil's data protection authority published a guidance note on that ground, with a three-phase test: purpose, necessity and balancing with safeguards. The document includes an example that applies to the sector, with a private higher education institution offering discounts to its own academic community, and it points to opt-out as a safeguard.

The same guide is strict on another point: in its example of advertising directed at children and adolescents, the authority concludes that the data subject has no legitimate expectation of processing for advertising purposes. For anyone talking to an under-age candidate, that distinction matters.

To steer the conversation with legal, it helps to organize audiences by data type and channel:

Table: a suggested split of audiences and legal bases in remarketing without third-party cookies, to steer the internal discussion

That table is a starting point for a conversation, not an opinion. The choice of legal basis depends on context, on the privacy policy in force and on how consent was collected, and it has to be settled with the institution's DPO or legal team before it becomes a campaign setting.

Anyone who wants to go deeper into governance design will find the overview of LGPD, GDPR and CCPA compliance applied to the CRM and the more operational read in privacy and compliance in prospecting automation.

What should you ask legal before the remarketing campaign goes live?

Ask for specific decisions, not blanket approval. Legal cannot approve “remarketing” as a concept, but it can answer whether a given audience, with a given data source, can be used in a given channel. Framing the question that way shortens the response time and the risk of rework.

The points that tend to stall a campaign after it is already live are few and well known:

• Legal basis per audience: which ground supports each segment, with the legitimate interest test documented wherever it is used.
• Privacy policy wording: Google requires the policy to disclose the sharing of customer data with third parties performing services on the advertiser's behalf.
• Retention period: how many months an unconverted lead stays eligible for remarketing.
• Objection and deletion flow: how a data subject's request leaves the CRM and also the lists already sent to the platforms.
• Under-age data: whether it is included, with which safeguard, and what happens when age is not declared.
• Contract with the media platform: who is the controller, who is the processor and what the contract says about secondary use.

The disclosure requirement in the privacy policy is not our reading. It is in the Google Ads customer data policies, which also restrict uploads to information collected in a first-party context.

Recording those decisions in a living document keeps every campaign from reopening the same discussion. A well-configured CRM for educational marketing helps, because consent sits on the contact record and follows the lead through the funnel.

How do you build the consent and cookie banner checklist?

Start with what the banner actually has to deliver: a real, granular and reversible choice, with tag firing conditioned on the visitor's decision. A banner that informs without allowing refusal does not produce valid consent, and a banner that loads everything before the click makes the choice decorative.

The central technical point is order: the media tag only reads or writes a first-party cookie after the visitor has decided, and that decision has to be propagated to the connected platforms.

The checklist that tends to hold the campaign up after it goes live has six items:

• Blocking before consent: no remarketing tag fires on the page's first render.
• Granularity by purpose: separate necessary, performance and advertising cookies, with refusal possible on each one.
• Auditable record: store the date, time, text version and the choice made, tied to the contact wherever there is identification.
• Signal propagation: pass the consent status to the media platforms through consent mode or an equivalent feature.
• Simple revocation: a permanent link to reopen preferences, without having to email support.
• Half-yearly review: recheck active tags, declared purposes and retention periods every admissions cycle.

None of those items is exotic, and all of them tend to fail quietly. The most common case is the tag that keeps firing after a refusal because the tag manager was changed without a review.

It is worth tying consent to the contact itself, not just to the browser. When it lives in HubSpot CRM, the information survives a device change and a cookie wipe, which is exactly what the old model lacks.

Frequently asked questions about remarketing without third-party cookies

What should you rebuild first in remarketing without cookies?

Rebuild first-party data first, the only base the institution actually controls. The third-party cookie survived in the browser with the largest market share, but it is still blocked in Safari and confined in Firefox, and Google dismantled precisely the APIs it had promised as replacements.

The diagnosis does not call for alarm. Nobody needs to switch off a pixel tomorrow. What makes sense is to stop treating a third-party audience as a permanent asset and to build the audience that comes from the form, the CRM and the real relationship with the candidate.

Nor is there room to play it down. Anyone who spent the last few years waiting for a technical replacement inside the browser was left without a plan B, and that is a concrete consequence of the October 2025 announcement.

The legal side is the one that least tolerates improvisation. Legal basis, the legitimate interest test, the retention period and under-age data need sign-off from legal or the DPO before they become a campaign setting. This article organizes the conversation; it does not replace the opinion.

If your institution wants to move away from the pixel and build remarketing audiences on first-party data with auditable consent, the path runs through organizing the CRM first. That is the scope of mkt4edu's HubSpot CRM implementation and operation work.

The next admissions cycle starts with the least glamorous part. Getting data privacy inside the CRM right before building audiences is what lets the list grow without redoing the setup when legal asks for the legal basis.