Publisher revenue per impression fell a median of 30% when Google’s own Protected Audience API stood in for third-party cookies, according to the UK Competition and Markets Authority’s June 2025 report on real-world advertising tests run between January and June 2024. That gap between third-party cookies and their replacement is the direct reason Google retired 10 of the 13 named Privacy Sandbox technologies in October 2025, citing “low levels of adoption.” Third-party cookies remain on by default in Chrome in 2026.
What is Google’s Privacy Sandbox, and why did most of it get retired?
Privacy Sandbox was Google’s multi-year project to replace third-party cookies with a set of browser-native APIs for ad targeting, measurement, and fraud prevention, first announced in August 2019. On October 17, 2025, Google’s VP of Privacy Sandbox, Anthony Chavez, announced the company would retire 10 of these technologies “after evaluating ecosystem feedback about their expected value and in light of their low levels of adoption.”
The retired list covers the APIs the industry actually needed to work for cookies to go away: Attribution Reporting API, IP Protection, On-Device Personalization, Private Aggregation (including Shared Storage), Protected Audience, Protected App Signals, Related Website Sets, SelectURL, SDK Runtime, and Topics. Only three of the original 13 named technologies survive: CHIPS, FedCM, and Private State Tokens. Google’s own announcement drew the adoption contrast directly, noting CHIPS and FedCM “have seen broad adoption, including support from other browsers,” which is precisely what the 10 retired APIs never achieved.
Figure 1: Of the 13 Privacy Sandbox technologies Google named in its October 2025 announcement, 10 were retired and 3 were kept. Source: Google Privacy Sandbox blog, “Update on plans for Privacy Sandbox technologies,” October 17, 2025.
The split above is not close. Three out of every four Privacy Sandbox technologies Google built for this project did not survive to 2026. Adoption, not a policy reversal alone, was the stated reason.
How much revenue did Privacy Sandbox actually cost publishers?
Publisher revenue per impression fell by a median of 30% across 10 independent sell-side testers who ran real A/B tests replacing third-party cookies with Google’s Protected Audience API, according to the CMA’s June 2025 summary of the joint testing program. Results ranged from a 20% reduction to a 50% reduction depending on the business. Google’s own figures, a 27% drop for its Google Ad Manager platform and a 15% drop for AdSense, fell at or below the low end of that range, meaning independent testers generally saw worse outcomes than Google reported for itself.
This was not a small pilot. The CMA and Google jointly built a testing framework covering around 10% of Chrome traffic, and the June 2025 report drew on submissions from 25 businesses, including Google, 9 buy-side third parties, and 13 sell-side third parties (10 ad techs and 4 publishers).
Figure 2: Publisher revenue per impression decline, third-party cookies vs. Protected Audience API. Source: UK Competition and Markets Authority, “Testing of Google’s Privacy Sandbox proposals: CMA summary,” June 13, 2025, paragraphs 4.53 and 4.22(c).
For a site that depends on programmatic display advertising, this is the number that matters more than any policy headline: even with Google’s replacement APIs turned on, publishers lost meaningful revenue on every affected impression. Sites that also run a Cookie Policy Generator to document their consent and tracking practices were tracking a technology stack that, in the CMA’s own testing period, still under-delivered against the cookies it was meant to replace.
Did Google’s Privacy Sandbox APIs recover the lost ad value?
Not fully. The CMA found that the Protected Audience API mitigated some of the revenue loss from removing third-party cookies but did not close more than half of the degradation in aggregate outcomes such as overall publisher revenue. One academic testing partnership (Kobayashi, Johnson and Gu) calculated a recovery rate of only around 3% of lost per-impression value; Google’s own GAM and AdSense figures implied a recovery rate closer to 11%. Either way, most of the value lost when third-party cookies disappeared stayed lost.
Topics API performed even worse in the CMA’s evidence. Three independent testers reported that Topics was present on only a minority of bid requests during the testing window, which the CMA said was “likely to inhibit its utility at the time of testing.” Two testers that measured Topics used alone saw revenue per impression fall by more than half in one case and by around 25% in the other, when Topics replaced simple contextual targeting.
Figure 3: Where each core Privacy Sandbox API landed on uptake versus measured value recovery during CMA testing. Source: UK Competition and Markets Authority summary report, June 2025, paragraphs 4.43 to 4.56 (author-plotted from the reported findings, not a CMA-published chart).
Why did Google reverse course on cookie deprecation?
Google’s plan to remove third-party cookies from Chrome had already been softening for over a year before the October 2025 retirements. On July 22, 2024, Google announced it would not deprecate third-party cookies outright but instead build a new, standalone prompt letting users choose whether to allow them. On April 22, 2025, Google went further and confirmed it would maintain its existing approach to third-party cookies and would not roll out that standalone prompt either, leaving third-party cookies on by default in Chrome.
The UK CMA, which had extracted legally binding commitments from Google in 2022 tied to the original cookie-deprecation plan, closed its investigation on October 17, 2025, releasing Google from those commitments after concluding it had “reasonable grounds for believing that its competition concerns no longer arise.” That is the same date Google announced the API retirements, tying the regulatory story and the adoption story to a single day.
Figure 4: Timeline of Privacy Sandbox’s rollout and retreat. Source: Google Privacy Sandbox blog and UK CMA case page, compiled 2025-2026.
The CMA’s own commentary on ecosystem engagement backs up Google’s “low adoption” framing from the other side of the table: the regulator noted that “only a limited section of the ad tech and ad inventory ecosystem engaged with the testing” at all, even with a live, government-brokered framework available to participate in.
How did Privacy Sandbox affect ad measurement, not just revenue?
Beyond revenue, the Attribution Reporting API degraded conversion measurement accuracy in Google’s own tests. For two of three Google ad products tested, over two-thirds of click-through conversion campaigns had an absolute percentage error above 20%, a rate Google itself considers very high. For campaigns most dependent on third-party cookies, the vast majority of measurements had error rates above 60%. On Display & Video 360 specifically, conversions per dollar fell 32% when measured through the Attribution Reporting API instead of third-party cookies.
| Metric | Google’s status quo (with TPCs) | With Privacy Sandbox APIs only |
|---|---|---|
| DV360 conversions per dollar | Baseline | -32% |
| Google Ads conversions per dollar | Baseline | -3% |
| GAM publisher revenue per impression | Baseline | -27% |
| Median third-party publisher revenue per impression | Baseline | -30% |
Source: UK Competition and Markets Authority, “Testing of Google’s Privacy Sandbox proposals: CMA summary,” June 13, 2025, sections 4.22-4.53.
The Bottom Line
The number that explains everything else in this post is 30%. That is how much publisher revenue per impression fell, at the median, when a live cookie replacement Google spent six years building was tested against the technology it was supposed to retire. Google’s own October 2025 explanation for retiring 10 of the 13 Privacy Sandbox technologies, “low levels of adoption,” reads less like a surprise and more like the predictable result of ad tech companies choosing not to build on top of tools that underperformed the status quo in independent testing. Third-party cookies stay on by default in Chrome heading into 2026, which means site owners still need accurate, current cookie disclosures rather than a policy written for a deprecation that never happened.
Frequently Asked Questions
What is Google’s Privacy Sandbox and is it still active? Privacy Sandbox is Google’s set of browser APIs meant to replace third-party cookies for ad targeting. As of October 17, 2025, Google retired 10 of the 13 named technologies, citing low levels of adoption, and confirmed third-party cookies remain on by default in Chrome.
Did Google remove third-party cookies from Chrome? No. Google announced on April 22, 2025 that it would maintain its current approach to third-party cookies rather than deprecate them or roll out a standalone choice prompt. Chrome still allows third-party cookies by default in 2026.
How much did Privacy Sandbox actually cost publishers in testing? In the UK CMA’s June 2025 report, ten third-party sell-side testers saw publisher revenue per impression fall a median of 30% when third-party cookies were replaced with Google’s Protected Audience API, with results ranging from a 20% to a 50% reduction.
Which Privacy Sandbox technologies did Google keep? Google kept only 3 of the 13 named technologies: CHIPS, FedCM, and Private State Tokens. Google’s own October 2025 announcement said CHIPS and FedCM had seen broad adoption, including support from other browsers, unlike the 10 it retired.
For the browser side of this same story, including how many browsers still allow third-party cookies by default, see our third-party cookie phase-out numbers for 2026. Advertiser reliance on the cookies Privacy Sandbox was meant to replace is covered in how many advertisers still use third-party cookies. A dedicated look at browser-by-browser cookie-blocking market share is still in progress on our end; we will link it here once it publishes rather than guess at a URL.
Sources and References
- Google Privacy Sandbox. (2025). “Update on plans for Privacy Sandbox technologies.” October 17, 2025.
- UK Competition and Markets Authority. (2025). “Testing of Google’s Privacy Sandbox proposals: CMA summary.” June 13, 2025. Testing conducted January-June 2024 across 25 businesses.
- UK Competition and Markets Authority. Case page: “Investigation into Google’s Privacy Sandbox browser changes.” Commitments released October 17, 2025.
- Google Privacy Sandbox. (2024). “Chrome’s plan for third-party cookies.” July 22, 2024.
- Wikipedia. “Privacy Sandbox,” timeline cross-referenced against Reuters, Financial Times, and CMA primary sources, accessed 2026.
Note: All figures verified as of September 2026. The CMA’s testing data reflects a snapshot from Q1-Q2 2024, and Google has stated the surviving Privacy Sandbox tools may improve with further investment, so these figures should be revisited if Google publishes updated testing results.
