By Marc Alexander

Chrome 153, stable since 8 September 2026, lists the Attribution Reporting API, Protected Audience, Shared Storage and Related Website Sets as deprecated and being removed. That's the end of the Privacy Sandbox's advertising APIs, which Google announced it was retiring in October 2025.

Third-party cookies are staying. For a UK site's measurement the practical effect is close to nothing, and that's worth saying plainly, because the headlines suggest otherwise.

What happened.

In April 2025 Google decided to keep its current approach to third-party cookies in Chrome: the user chooses in the browser's settings, and there would be no new standalone prompt.

In October 2025 it announced that most of the Sandbox's advertising technologies were being retired, naming Topics, Protected Audience and Attribution Reporting among others, including IP Protection, and citing low adoption and ecosystem feedback.

Chrome 153 is where the removals land in the release notes. What continues, according to Google's status page, is the plumbing that was never about advertising: partitioned cookies (CHIPS), federated sign-in (FedCM), the Storage Access API, Private State Tokens, bounce tracking mitigations and the reduced User-Agent string.

What it changes for your measurement.

Almost nothing. GA4 and Google Ads conversion tracking on an ordinary site never used these APIs. They run on first-party cookies set on your own domain, with Consent Mode deciding what's collected. The Attribution Reporting API was an opt-in for ad tech platforms, not something your tag depended on.

Third-party cookies are where the fear came from, and they're exactly where they were. Safari and Firefox block them. Chrome allows them by default, blocks them in Incognito, and lets the user switch them off. If your remarketing worked last year, this change doesn't touch it.

What still bites.

The things that actually erode measurement on a UK site are unchanged and unrelated to the Sandbox. Safari caps the life of cookies set by JavaScript at seven days, which is why returning visitors look new. Chrome's bounce tracking mitigations continue. The reduced User-Agent string gives you less about devices than it used to.

And consent. PECR applies to the storage on the device, whatever Chrome does, so the banner, the defaults and the Consent Mode signals matter exactly as much as before. The direct traffic and unassigned problems you have today come from those, not from an API being removed.

What not to do.

  • Don't buy "cookieless" tooling because of this. The sales pitch was built on a deprecation that was cancelled in 2024 and finally buried this year.
  • Don't loosen the banner. Chrome keeping third-party cookies says nothing about what you're allowed to store. The ICO's position hasn't moved.
  • Don't expect audiences or attribution to change. Google Ads remarketing in Chrome runs on the same cookies it did yesterday. Modelled conversions under Consent Mode carry on.

What's worth doing instead.

Spend the attention on the thing that does move numbers: a consent setup that sends the right signals, proven with the test guide.

Then, where the Safari share and the budget justify it, server-side tagging or the Google tag gateway to extend cookie life on your own domain. Those were the right answers before the Sandbox, and they're the right answers after it.

Sources.

Checked on 31 October 2026.