Post-Cookie World: Data After Google's Capitulation

---

January 2020: Google announced it'd kill third-party cookies in Chrome by 2022. Bold gesture. Press ran headlines about the end of surveillance-era advertising. Ad industry panicked. Privacy advocates clapped. Five years on, cookies sit right where they always sat. Google didn't just fumble the promise. It spun 180 degrees and told advertisers they could use device fingerprinting, the very tracking method it once branded corrosive to user choice. Not a strategy misfire. A full capitulation before a digital advertising market worth $307.5 billion.

Privacy Sandbox deserves a proper telling. Not as a technology story. As a money story.

In brief: Google spent 5 years failing to kill cookies, then legalized fingerprinting. Client Hints: 93.8% tracker calls. RTB broadcasts each American's data 747 times a day.

Timeline of Capitulation: 2019-2025

Good intentions kicked it off, or at least stellar PR. In August 2019 Google published the Privacy Sandbox concept: a toolkit that'd swap third-party cookies for private alternatives. Pitch: ads keep working, individual tracking stops.

January 2020 brought the pledge to kill third-party cookies by 2022. Chrome, commanding 65%+ browser share, could've buried cookies in a single release. A tectonic shift, ripe for the taking.

2021: first delay. Deadline slid to 2023. Rationale: not enough runway to test alternatives. Ad industry exhaled.

2022: second delay. Now 2024. Topics API, the thing that replaced FLoC, was barely entering trials. Britain's CMA, the antitrust watchdog, demanded assurances that Google wouldn't grab an unfair edge by torching the cookies the rest of the ad world depends on.

2023: third delay. Google started a 1% rollout of cookie deprecation in Chrome yet pushed the full cutover out again.

July 2024: the pivot. Google announced it wouldn't kill cookies after all. Instead users would get a choice. Some fresh prompt in Chrome would let each person decide whether they wanted cookies. Sounds reasonable on the surface. Beneath it: 95%+ of users never touch default settings. Google knows this cold. Research backs it up.

April 2025: final white flag. Google announced it wouldn't even show users the prompt. Third-party cookies stay on by default. Setting is buried deep in Chrome's menus, where a negligible sliver of the audience ever ventures. Five years of pledges collapsed into one anodyne line: we have updated cookie settings in Chrome.

Meanwhile, in December 2024, quietly and without trumpets, Google rewrote its ad policy. Starting February 16, 2025, advertisers working through Google can use device fingerprinting. Same technique Google in 2019 called subversive to user choice and wrong.

Bottom line: cookies didn't die. Fingerprinting got blessed. Users wound up with both forms of tracking instead of one.

Privacy Sandbox: Three Goals, One Result

When Google kicked off Privacy Sandbox in 2019 the project named three official aims: fight cross-site tracking, replace third-party cookies, and shield against fingerprinting. Three noble flags. On every single one: failure.

Cookie replacement never happened. We just walked through the timeline. Cross-site tracking fight flipped into a legalization of fingerprinting. Yet the third goal warrants its own spotlight, because the tool built to reach it became the problem.

Topics API took over from FLoC in 2022. Premise: instead of tailing a specific user, the browser sorts their interests by which sites they visit and tells advertisers only broad categories. Ads keep running, yet they get topics, not an identity. Sounds benign. In the wild, Topics API spawned a fresh fingerprinting channel.

Per CookieYes, after just three observations of the Topics API a user can be pinpointed with 60% probability through the blend of assigned topics. Three site visits. Three bundles of ostensibly depersonalized interest categories. Enough for the combination to turn unique and bind the browser to a living, breathing human. Google built an API marketed as tracking defense that widened the attack surface. Frankly, you couldn't script a more ironic outcome.

In Google's Q1 2025 ecosystem feedback report the picture was telling. Ad industry grumbled that Topics API didn't feed them enough data for sharp targeting. Privacy advocates flagged the fingerprinting upside of topic combinations. Regulators wanted safety receipts. Every side was sore, each for its own reasons. Google picked the answer that satisfied the people who sign checks: keep cookies and bless fingerprinting. Three Privacy Sandbox goals folded into one outcome: $264 billion in ad revenue outweighed three lines in a mission statement.

$307 Billion: Why Ideals Lose to Money

Parsing Google's capitulation demands a look at the ledger, not the codebase. In 2024 Google pulled in $264.59 billion from advertising. Roughly 76% of Alphabet's total take of $350 billion. Advertising isn't Google's side hustle. Advertising is Google.

Per Proton, each American user kicks off about $460 a year in ad revenue for Google. Meta stacks another $217.26 per user in the US and Canada, with 99%+ of its revenue flowing from ads. Together, just those two outfits extract $700 a year from every American. Amazon chips in $47 billion in ad revenue for 2023. Microsoft adds $12 billion from search ads. Even Apple, the company that built its whole brand on privacy, raked in an estimated $8 billion from advertising. FTC has also flagged that ISPs like AT&T, Comcast, and Verizon harvest and sell user data.

Trend line climbs. Google bumped per-user revenue from $393 in 2022 to $460 in 2024, up 17%. Meta shows the same trajectory. Meta's aggregate ad revenue swelled 22% year over year. Geographic spread is staggering: a European user brings Meta around $70 per year, while the global average sits at $42.34. Tenfold gap between an American and someone in the developing world. Meta floated an option for EU users to pay EUR 9.99 a month for no ads, yet under the fine print it keeps collecting data even from those who cough up the fee. So much for paying your way out.

Against that backdrop, killing cookies would mean kneecapping its own extraction machinery. Cookies aren't some quaint vestige of Web 1.0. They're the pipeline carrying $264 billion. Dynamiting that pipeline to look good in a press release was never a serious proposition, about as likely as an oil company torching its own wells to win a green award.

Programmatic ad market runs on Real-Time Bidding. Every time you hit a page with ads, an auction fires in a fraction of a second. By Iccl estimates, the average American's data gets broadcast 747 times a day, roughly 490 billion bid requests across the US and Europe combined. In each auction the user's data, device identifier, location, browsing history, interests, sprays out to thousands of participating companies. Everybody gets the data, regardless of who won the auction. A fire sale where the goods get photocopied and handed to every bidder.

EFF published a thorough breakdown in January 2025: RTB is not an advertising system that uses data; it's a mass surveillance system monetized through advertising. Cardinal distinction.

In December 2024 the FTC went after data broker Mobilewalla, which had amassed data on more than a billion people. 60% of that haul came straight from RTB auctions, with no ad ever placed. Mobilewalla sold the data to track union organizers and Black Lives Matter protesters, slotting people into bins like pregnant women, Spanish-speaking churchgoers, Lgbtq community. First FTC case on bidstream data abuse. Unlikely to be the last.

EFF in the same investigation named other cases. Near Intelligence harvested data from RTB auctions and sold it to the US Department of Defense. Rayzone, an Israeli cyber-surveillance firm, posed as an advertiser to tap bidstream data and resold it to governments. Patternz, another RTB-based surveillance tool, works, in its creator's own words, through virtually any app that shows ads. Google's own ad auctions spent several months funneling data to a company registered in Russia and under US Treasury sanctions. For $1,000 worth of ad data you can shadow a specific person's movements. Not a thought experiment. Confirmed research from the University of Washington in 2017, still valid today.

When $307 billion a year is on the line, privacy ideals are a line in a press release, not a business strategy. About as load-bearing as a paper napkin in a hurricane.

Client Hints: Private Replacement That Became a New Tracking Tool

While Google was pledging to kill cookies it quietly built a substitute. Not for cookies, for the User-Agent string, another wellspring of user data. Concept was sleek: instead of every site automatically slurping full details about your browser, OS, and device, sites would explicitly ask for that data through the User-Agent Client Hints API. Transparency. Control. Laudable optics.

Researchers from KU Leuven checked what actually happened. Results, published at Wpes'23, chronicle the debacle:

59.2% of the top 100K sites harbor scripts requesting high-entropy Client Hints. Of those requests, 93.8% come from advertising and tracking scripts. And 91.6% of those scripts ship the harvested data to external servers.

Researchers Asuman Senol from KU Leuven and Gunes Acar from Radboud University found that the vast majority of tracking scripts using Client Hints belong to Google. Mechanism designed as a private alternative morphed instantly into yet another pipe for hoovering the same data.

Client Hints didn't shrink the fingerprinting surface. They stretched it. Now trackers can spot which sites hand out hints and which don't. Pattern of hint adoption itself became a fresh identification signal. Instead of one leak channel, two: old User-Agent string and the new Client Hints API. WHOX catches this divergence through check C01, which compares User-Agent against Sec-CH-UA. Google brewed a problem, proposed a fix, and managed to make the problem worse. Almost impressive if it weren't so venal.

Worth spelling out the sheer scope: 59.2% of the hundred thousand busiest sites on Earth means billions of pageviews a day. On every page, ad scripts request data that Chrome dutifully hands over: device model, OS version, CPU architecture, mobility state. All through an API built under the privacy banner. Like a hospital selling patient records from its wellness clinic.

ICO: Irresponsible

Britain's data regulator ICO answered Google's policy shift in December 2024 with a statement that merits unpacking:

We consider this change to be irresponsible. Fingerprinting is not a fair means of tracking users online as it is likely to reduce people's choice and control.

ICO laid out why fingerprinting is worse than cookies on every yardstick:

1. You can't consent. Cookies have banners. Fingerprinting has no counterpart. User doesn't know it's happening.
2. You can't delete it. Clearing browser data wipes cookies. A fingerprint isn't stored in the browser. It's recomputed from device traits each time.
3. You can't block it. Browsers can block cookies. Blocking fingerprinting means altering the device's own characteristics, which is either impossible or breeds fresh identifiable oddities.
4. It's invisible. User gets no notification.

ICO threw Google's own 2019 words back in its face: the very behavior Google had called subversive to user choice and wrong. Six years later, Google legalized exactly what it had condemned.

ICO also noted that fingerprinting may serve to replace the functions of third-party cookies. Precise wording. Not could someday. Can right now. Every business that before February 2025 held off on fingerprinting because of Google's policy ban received the green light overnight.

ICO published draft guidance on fingerprinting and warned businesses that compliance with data protection law when using fingerprinting is a high bar. Operative verb, though, is warned. Not banned. Not fined. Warned. Coverage from a major UK outlet ran, yet no concrete investigations or sanctions materialized.

Regulatory Gap: Law Exists, Enforcement Does Not

On paper, fingerprinting is already regulated. GDPR and the ePrivacy Directive treat fingerprinting as equivalent to cookies: any access to information on a user's device or storage of such information demands consent. Article 29 Working Party, predecessor to the Edpb, settled this back in 2014. Device fingerprinting falls under Article 5.3 of the ePrivacy Directive.

Hitch isn't the law. Hitch is that law can't grip an invisible technology.

Cookie banners, for all the aggravation they cause, do one concrete job: they make tracking visible. User sees a prompt, can hit reject, can peek at the cookie list in the browser. With fingerprinting, none of those gears mesh. How do you give informed consent to a process you don't know about? How do you revoke consent when there's nothing to erase? A Kafkaesque labyrinth with no minotaur and no exit.

Web Almanac 2025 from HTTP Archive, published in January 2026, lays bare the scale: 75% of desktop pages carry at least one tracker. Google APIs show up on 61% of all sites. Google Analytics on 44%. DoubleClick on 32%. Facebook on 22%. First-party cookie _ga from Google Analytics was found on 46% of all pages.

Not isolated bad actors. Just the internet's plumbing. A regulator bent on enforcing fingerprinting compliance faces a task akin to regulating weather: fingerprinting is invisible, ubiquitous, and technically indistinguishable from normal browser work. Canvas rendering, font enumeration, screen-characteristic queries: millions of scripts run these same calls every day. A tracking script computing a fingerprint wields the same APIs as a legitimate web app checking WebGL support. Tools like WHOX make the surveillance visible, yet a regulator, unlike an auditor, can't inspect every script on every site.

In five years of GDPR, fines for cookie breaches run into the hundreds of millions: Meta paid EUR 390 million in 2023, TikTok EUR 345 million, Amazon EUR 746 million. Cases tied specifically to fingerprinting you can count on one hand. Not because fingerprinting is rare. Because proving it in court takes technical chops most regulators don't possess. Victim doesn't know what happened. Evidence lives only on the collector's servers.

2026 Settlement: Opt-Out as Political Theater

In January 2026 a court approved a class-action settlement, reached in May 2025, over the transmission of user data through Real-Time Bidding. Centerpiece: a new RTB Control mechanism that'd let users cap the volume of data broadcast in ad auctions. EFF called it a potential step forward. Keyword: potential.

Under the settlement terms, RTB Control will strip pseudonymous identifiers, mobile ad IDs, IP addresses, and the User-Agent string from bid requests. Cross-platform cookie matching will also be barred. On paper, serious stuff.

In practice the mechanism comes loaded with two built-in limiters that zero out its punch.

First: RTB Control is opt-out, not opt-in. By default your data keeps spraying to thousands of companies in each of the roughly 490 billion daily auctions. Flipping the shield on means finding the toggle, grasping what it does, and switching it yourself. Same research on default-setting inertia applies: the overwhelming majority will never locate this switch. Google, the outfit that designs these settings, knows this better than anyone alive.

Second: RTB Control is only open to users logged into a Google account. No account, no protection. Chrome without a login, no protection. Safari, Firefox, any other browser, no protection. Mechanism shields only those who voluntarily identified themselves to Google and voluntarily dug up a hidden toggle. A lock on a door whose key is handed exclusively to people already standing inside.

EFF went beyond commentary and called for a flat-out ban on online advertising built on behavioral tracking. Not regulation. Not opt-out. A ban. EFF's stance: RTB's architecture is unreformable because the very principle of blasting personal data to thousands of firms in every auction is the disease, not a symptom. Hundreds of billions of bid requests a day. Thousands of recipient companies in each one. A single user's opt-out in that torrent is a thimble bailing out the Titanic.

2026 settlement will be remembered not as a privacy win. As a precedent where a court acknowledged the problem, floated a fix, and rendered that fix unreachable for the vast majority of people harmed. Exactly which signals leak from a browser into each of those auctions, canvas hash, JA4 TLS fingerprint, GPU model, behavioral patterns, you can see through fingerprint-audit tools like WHOX.

What Consent Means When Tracking Is Invisible

European data-protection framework rests on a foundation of informed consent. GDPR demands that personal-data processing be transparent, have a legal footing, and allow refusal. With fingerprinting, each pillar crumbles against technical reality.

Transparency. Fingerprinting leaves no residue on the user's end. No file to hunt down. No setting to flip. Site hashes your device traits, canvas rendering, audio context, installed fonts, GPU parameters, and ships the result to its server. You get no ping. Browser shows no badge. DevTools throws no special flag.

Legal basis. Sites that fingerprint almost always tuck it behind the phrase legitimate interest in their privacy policy. Sidesteps the need for explicit consent. User could, in theory, push back, yet first they'd need to know fingerprinting is happening, then locate the right clause in a 40-page privacy policy, then file a formal objection. A kafkaesque obstacle course nobody's finishing.

Right to erasure. GDPR enshrines the right to be forgotten. How does that apply to a fingerprint? Even if a company scrubs your profile, the next visit recomputes the print from the same device traits. Deletion is pointless when the identifier isn't a stored file but a mathematical function of your hardware.

Right to object. You can't protest a process you don't know exists.

Consent model designed for cookies doesn't scale to fingerprinting. Requiring a receipt for every glance: technically lawful, practically unworkable. Cookie banners, hideous as they are, at least planted a precedent of visibility. Fingerprinting erases even that floor-level transparency. User snaps back to the state that existed before GDPR: total surveillance, total ignorance. A palimpsest where the privacy layer has been scraped clean, leaving only the surveillance text beneath.

Draft ePrivacy Regulation, supposed to succeed the ePrivacy Directive and plug these holes, has been mired in the EU legislative process since 2017. Nine years of negotiation. Zero output. Technology outpaces regulation the way a cheetah outpaces a committee of tortoises.

Data After Capitulation: New Reality

After Google's 2024-2025 moves the ad industry inhabits a world where both tracking mechanisms work in parallel. Cookies keep humming. Fingerprinting has the blessing of the platform holding 65% of the browser market. Not one swapped for the other. Addition, pure and simple.

netzpolitik.org's Databroker Files investigation, published in November 2025 alongside BR, L'Echo, Le Monde, and BNR, showed what that addition looks like at scale. Journalists got their hands on 13 billion location records from data brokers. Not through a breach. As free samples.

From this trove they reconstructed movements of European Commission staff: roughly 2,000 pings from 264 devices inside the Berlaymont building. European Parliament: 5,800 pings from 756 devices. Nato headquarters: 9,600 pings from 543 devices. From the limited freebie sample alone, journalists identified home addresses of five EU employees, including a senior Commission official and a diplomat.

Data flows from smartphone apps, ostensibly for advertising purposes only. Per Ailance, published in January 2025, over 40,000 apps funnel location data to third parties. One dataset from the investigation held 380 million location records spanning 137 countries, all linked to those apps. Candy Crush. Tinder. Grindr. MyFitnessPal. Prayer apps. Pregnancy trackers. Developers themselves often have no clue that embedded ad SDKs bleed geolocation into the bidstream. HybridCoE, the EU-Nato Centre of Excellence for Countering Hybrid Threats, said outright: it seems logical that China and Russia would use advertising data for such purposes. Chilling sentence from an institution that doesn't traffic in hyperbole.

A Catholic organization in the United States bought geolocation data from Grindr to out gay priests. For $1,000 in ad data you can trail a specific person's movements and pin down their religion or sexual orientation.

Free samples from data brokers pack enough data to compromise Nato headquarters. Location data is accurate to meters and lays bare every shop, clinic, and establishment a person walks into. Not a bug. Just the business model working exactly as designed.

McAfee in October 2025 described the stitching mechanism behind it all: Frankenstein Data. Data brokers grab scraps from different sources, apps, sites, public records, purchase logs, and suture them into a single profile through probabilistic matching. Binding glue: device IDs, email-address hashes, IP addresses, and browser fingerprints. Same fingerprints WHOX surfaces for the user: canvas hash, audio CRC32, font inventory, GPU parameters.

A joint investigation by CalMatters and The Markup uncovered that 35 data brokers deliberately hid their opt-out pages from search engines, making data deletion virtually impossible. Can't refuse if you can't find the refusal form.

What Your Browser Sees When You Don't

Stats about 490 billion auctions and $700 per user sound abstract. Abstraction melts the moment you audit your own device. Fingerprint-audit tools collect the same signals ad trackers use: canvas hash, WebGL renderer, audio fingerprint, JA4 TLS signature, GPU timing. Difference is they show you the data instead of selling it.

Result is sobering. A typical Chrome user is uniquely identifiable by the mashup of GPU, fonts, and audio subsystem alone. Switching VPNs, clearing cookies, going incognito, none of that shifts a single one of these signals. Lashed to hardware, not software. At the network layer the JA4 fingerprint from the TLS Client Hello and the HTTP/2 SETTINGS frame reach the server before JavaScript even wakes up. Ad industry stitches visits into a single profile even after you swap browsers, because hardware signals stay constant for months and years.

What Comes Next: Fingerprinting as Infrastructure

Google's call didn't birth the problem. Merely legitimized a practice already in full swing. Device fingerprinting fueled the ad industry long before February 2025. Shift is that it used to occupy a grey zone. Now it's an approved business practice of the planet's largest ad platform.

Google's policy simply stripped the last barrier, a reputational one. Ad scripts were already scooping this data. Now they don't have to pretend otherwise.

ICO called it irresponsible. Edpb treats fingerprinting as equivalent to cookies under the law. Between treats and punishes, though, lies a chasm wide enough to sail a fleet through. Five years of GDPR: cookie fines in the hundreds of millions of euros. Fines specifically for fingerprinting: effectively nil. Proving fingerprinting in court takes technical chops most regulators don't possess. Victim doesn't know what happened. Evidence lives only on the collector's servers.

New technologies make it thornier still. WebGPU, an API for GPU-level computation, cracks open hardware GPU characteristics from an ordinary browser. Researchers at ACM WiSec'25 showed 70% device identification accuracy across a pool of 500, using atomic GPU operations alone. QUIC, the protocol under HTTP/3 carrying 30%+ of web traffic, spawns new fingerprinting vectors through its transport parameters. AutoML models hit 99.79% accuracy classifying QUIC traffic. eBPF lets you pull a TCP fingerprint at the OS kernel level, before JavaScript loads, from the very first SYN packet. Every fresh protocol and API is a fresh identification surface.

In parallel the fingerprinting industry is picking up a new class of weapons. Fingerprint, formerly FingerprintJS, in June 2025 shipped a product for on-device fingerprinting that computes the print right on the device with minimal network calls. Commercial identification accuracy: 99.5%, against 40-60% for open-source libraries. Gap between what researchers see and what corporations wield widens every year. Academic papers study open-source code. Commercial products run on proprietary server-side models trained on billions of sessions. WHOX sits between these worlds: it surfaces the same signals commercial systems harvest, working in the interest of the person being checked, not the checker.

Surveillance industry isn't winding down. Picking up speed. In 2019 Google promised a world without cookies. In 2025 it delivered a world with cookies and fingerprinting running in tandem. Every new API and protocol widens the identification surface. Every regulatory cycle trails the technological one by years.

Your free browser generates $700 a year for the advertising industry. Only remaining shield isn't legal and isn't technical. It's informational: knowing what exactly gets harvested from your device. WHOX shows these signals. Knowledge alone isn't a remedy, though. A remedy, for now, doesn't exist.

Google didn't betray its users. Google just stopped pretending.

---

FAQ

What happened to Privacy Sandbox and third-party cookies? Google pledged to kill cookies starting in 2020, delayed four times, and in April 2025 walked away for good. Cookies stay on by default. At the same time, in December 2024, Google legalized device fingerprinting for advertisers, the technology it called wrong in 2019. Result: users got both forms of tracking instead of one.

Why did Google reverse course on killing cookies? Money. In 2024 Google earned $264.59 billion in advertising, roughly 76% of Alphabet's total revenue. UK's CMA demanded guarantees that Google wouldn't gain an unfair edge. Ad industry complained Topics API was insufficient. Cookies are the pipeline carrying $264 billion. Destroying them would mean undermining Google's own infrastructure.

What are Client Hints and why are they a problem? Client Hints API was billed as a private replacement for the User-Agent string. In practice: 59.2% of top-100K sites request high-entropy Client Hints, of which 93.8% come from ad and tracking scripts, and 91.6% send the data to external servers, per KU Leuven at Wpes'23. Vast majority of tracking scripts belong to Google. Instead of one leak channel, now two. ePrivacy Regulation that was supposed to close these gaps has been stalled in the EU since 2017.

What is Topics API and does it work? Topics API replaced FLoC in 2022. Idea: browser figures out user interests and shares only broad categories with advertisers. Snag: after just three observations, a user can be identified with 60% probability through topic combinations, per CookieYes. Google built an API for tracking protection that actually widened the attack surface.

What comes next for web privacy? New technologies make things worse. WebGPU achieves 70% re-ID from hardware GPU characteristics. QUIC creates fingerprinting through transport parameters with 99.79% F1-score. eBPF fingerprints TCP at the OS kernel level. FingerprintJS reaches 99.5% commercial accuracy. Behavioral biometrics market will grow from $2.72B in 2025 to $11.38B by 2031. Only defense left is informational: knowing what's being collected from your device.

---

Read Next

• $700 a Year: The Price Tag on Your Digital Shadow
• The Invisible Census: A Population Registry Built Without Consent
• The Randomization Lie: Every Canvas Defense Has Been Defeated
• What Actually Works: An Honest Guide to Fingerprinting Protection

---

WHOX - We tell real signals from manufactured ones. Check your fingerprint at whox.com and find out what signals leak from your browser and how unique you are.

All sources verified as of February 2026. KU Leuven study: Senol & Acar, Wpes'23. ICO statement: December 19, 2024. Google Privacy Sandbox: April 22, 2025. EFF RTB: January 23, 2025. Databroker Files: netzpolitik.org, November 2025. Web Almanac 2025: HTTP Archive, January 2026.