Third-party cookies and Consent Mode v2: why your campaigns are losing conversions

The CRM records the same sales as a year ago, but the platforms report fewer conversions. Cost per conversion goes up and bidding learns from less data, even though nobody has touched the settings. The cause is almost always outside your ad account.

In this article we explain what has changed with cookies, consent and Consent Mode v2, how to estimate how much you are losing and what you can do about it.

First-party and third-party cookies

A cookie is a small file the browser stores to remember something, such as your cart or which ad you came from. What matters is who creates it.

• First-party cookie: created by the domain you are visiting. If you are on yourstore.com, a cookie from yourstore.com is first-party.
• Third-party cookie: created by another domain from that page, usually an ad network, and it allows the same browser to be recognized across different websites.

For years, advertising measurement relied on third-party cookies to connect the ad with the purchase. That is the mechanism that has been gradually restricted.

What browsers do

Safari and Firefox

Safari, with its Intelligent Tracking Prevention (ITP) system, and Firefox, with its tracking protection, already block third-party cookies by default. Safari goes further: it shortens the lifespan of some first-party cookies to a few days when they are set with JavaScript, which is how most measurement tags set them. If a Safari user clicks today and buys two weeks from now, that cookie may no longer exist.

Chrome

Google announced it would phase out third-party cookies in Chrome, but in 2024 it said it would not do so as planned, and in 2025 that it would keep its current approach. Chrome, for now, keeps them. That doesn’t change what happens on Safari or the consent obligations in Europe.

iOS and App Tracking Transparency

In 2021, Apple introduced App Tracking Transparency (ATT) on iOS. Since then, an app has to ask for explicit permission to track the user across other companies’ apps and websites, and many users say no.

Meta was among the hardest-hit platforms, because its measurement depended on connecting what happened on Facebook and Instagram with what happened afterwards on your website or app. It stopped receiving some of those signals, started modeling more conversions and shortened its default attribution windows.

Consent in Europe

Under the GDPR and the ePrivacy rules, in Europe consent is required to store cookies that aren’t strictly necessary, such as advertising and analytics cookies. Hence the banners and the consent management platforms (CMPs).

The practical rule is simple: if the user rejects, measurement and advertising tags must not store cookies. Without a cookie, the platform can’t link that click with that purchase, and the conversion goes unobserved. The legal details depend on each case and are worth reviewing with your legal advisor or DPO.

What Google Consent Mode v2 is

Consent Mode passes what the user has decided in the banner on to Google’s tags. Version 2 uses four parameters:

• ad_storage: whether cookies can be stored for advertising purposes.
• analytics_storage: whether analytics cookies can be stored.
• ad_user_data: whether user data can be sent to Google for advertising purposes.
• ad_personalization: whether that data can be used for personalized advertising, such as remarketing.

Since March 2024, Google requires these signals for traffic from the European Economic Area if you want to keep using audiences, remarketing and measurement features in Google Ads.

Basic and advanced implementation

In the basic implementation, Google’s tags don’t load until the user accepts. If they reject, Google receives nothing from that visit.

In the advanced implementation, the tags always load, with consent denied by default. If the user rejects, no cookies are stored, but cookieless pings are sent, which Google uses to model the conversions it can’t observe, provided there is enough volume.

How much you are losing: how to estimate it

There is no universal percentage: it depends on your industry, your banner, your Safari or iOS traffic and your sales cycle. What helps is calculating your own:

1. Look at the consent rate in your CMP. The share of visitors who accept advertising cookies is, roughly, the ceiling of what the platforms can observe.
2. Compare the platforms with your CRM. Month by month, put each platform’s conversions next to the sales your business records for that channel. If the gap grows without changes to the campaigns, you are losing signal.
3. Separate observed and modeled. If a large share of conversions is modeled, bidding is learning from estimates.
4. Check by browser and device. If Safari and iOS convert much less than Chrome in the platforms but not in your CRM, the problem is measurement, not performance.

What you can do

There is no single solution, but these measures add up:

1. A properly configured CMP and Consent Mode v2. A banner that respects the user’s choice and passes the four signals on to Google.
2. First-party data. The email or phone number the user gives you when buying, with their consent, is worth more than a cookie.
3. Server-side measurement. With server-side tracking, events go through a server on your own domain and use first-party cookies, which hold up better against Safari’s restrictions and blockers.
4. Sending via API. Google’s enhanced conversions and the Meta Conversions API send events with hashed contact data, which improves matching with their users.
5. Conversions from your CRM. Uploading offline conversions gives the platforms back the sales that happen outside the website.
6. Measuring against your source of truth. If you compare media against your business’s sales, a platform that loses signal doesn’t look worse than it is.
7. Aggregated methods. Marketing mix modeling works with total spend and sales, without individual data, so it doesn’t depend on cookies.

An important warning: server-side doesn’t replace consent. It changes the route the data travels, not what you can do with it. If the user rejects, the server has to respect it just like the browser.

How Babuin does it

Babuin, the MonkeyFlux platform, includes a measurement server on a subdomain of yours, with first-party cookies and always with consent first. The events from your website and your app are deduplicated, cleaned of bot traffic and sent through Conversions API, Enhanced Conversions, Events API or Measurement Protocol, enriched with the margin or lead quality from your CRM.

With those results, MonkeyBot bids within each medium and DBA allocates the budget across channels every day based on your source of truth, not on the conversions each platform manages to see.

Frequently asked questions