Why Tracking Broke

For a decade, marketing measurement relied on a simple trick: drop a third-party cookie from an ad platform's domain, then read it across millions of sites. This let advertisers stitch a user's behavior into a single cross-site profile.

Client-side JavaScript fired pixels directly from the browser to Google, Meta, and others. It was easy to deploy and powerful, but it leaked everything to third parties with little user control.

In 2017 Apple shipped Intelligent Tracking Prevention (ITP) in Safari. It used on-device machine learning to classify domains as trackers and then blocked or partitioned their cookies.

Later ITP versions capped client-side (document.cookie / JavaScript-set) cookies to a 7-day lifetime, and just 24 hours when the user arrived via a known tracker's link. Long-lived attribution windows quietly collapsed.

Firefox enabled Enhanced Tracking Protection (ETP) by default, blocking known third-party tracking cookies using the Disconnect list. Brave shipped aggressive blocking out of the box.

Across these browsers, third-party cookies were effectively dead years before Chrome announced any change. Measurement teams saw rising discrepancies between ad-platform reported conversions and backend reality.

Chrome holds the majority of global browser share, so its plans matter most. Google repeatedly delayed full third-party cookie deprecation, then in 2024 pivoted to a user-choice prompt instead of a forced removal.

Regardless of the exact timeline, the strategic signal is clear: do not architect measurement around third-party cookies. They are a deprecating asset.

When cookies expire early or get blocked, returning users look like new users. Conversions can no longer be tied back to the original ad click, so platforms under-report.

At the same time, modeled and estimated conversions inflate other numbers. The result is two sources of truth that no longer agree, eroding trust in every dashboard.

Beyond cookies, browsers now partition storage by top-level site. A tracker's localStorage on site A is isolated from the same tracker on site B.

This kills the shared-identifier trick that survived cookie blocking. Even fingerprinting is being actively suppressed, with Safari and Firefox adding noise and Chrome's Privacy Sandbox proposing aggregated APIs instead.

On mobile, Apple's App Tracking Transparency (ATT) forced apps to ask permission before accessing the IDFA advertising identifier. Most users declined.

This devastated mobile app install attribution and audience targeting, pushing the industry toward aggregated, privacy-preserving frameworks like SKAdNetwork and toward server-side, consented data.

A large share of users run ad blockers or privacy DNS that block requests to known analytics and ad domains. A client-side pixel firing to google-analytics.com or facebook.com is trivially filtered.

This means even consented, legitimate measurement is lost simply because the request never leaves the browser. Routing through your own domain becomes a reliability fix, not just a privacy one.

GDPR, ePrivacy, and similar laws require a lawful basis and, for most tracking, prior consent. Enforcement actions against Google Analytics in several EU countries questioned transferring data to US servers.

So the breakage is double: technical blocking by browsers, plus legal requirements that demand consent, data minimization, and control. You cannot solve one without the other.

One thing browsers still trust: cookies and storage set by the site the user is actually visiting (the first party). HTTP-only, server-set first-party cookies escape the harshest ITP caps.

This is the foundation of the modern stack. Move identity and event collection into your own domain and server, then forward consented data to platforms. That is server-side tracking.

The takeaway is not a single workaround but an architecture change. Stop relying on the browser to be your data pipeline to third parties.

Instead: collect first-party, gather explicit consent, send signals from your server, and accept that some measurement will be modeled rather than deterministic. The next lessons build exactly this stack.

Test your understanding of why tracking broke.

Tracking broke from two directions: browsers (ITP, ETP, storage partitioning, ATT) blocked and shortened third-party identifiers, and ad blockers stopped client-side pixels from firing at all. Regulation added a consent requirement on top.

The durable response is first-party, consented, server-side data collection. Third-party cookies are a deprecating asset, so the rest of this course builds the modern privacy-resilient stack.