Google Retires Most of the Privacy Sandbox

What Changed

The Privacy Sandbox was the set of technologies Google had built since 2019 to support advertising without third-party cookies. In its October 2025 update, Google said the retirements followed feedback about their expected value and "their low levels of adoption".¹

The retired technologies include the Topics API (on Chrome and Android), Protected Audience (on Chrome and Android), the Attribution Reporting API (on Chrome and Android), Private Aggregation and Shared Storage, IP Protection, Related Website Sets, Protected App Signals, On-Device Personalization and the Android SDK Runtime.¹

Google said it would keep CHIPS and FedCM, which have been adopted more widely, including by other browsers, and Private State Tokens for fighting fraud. It said lessons from the Attribution Reporting API would feed into work on an interoperable attribution standard at the W3C.¹

The same day, the UK Competition and Markets Authority released Google from the commitments it had accepted in 2022, which had governed how the Privacy Sandbox and the removal of third-party cookies would be handled.²

Why It Mattered

The Privacy Sandbox was meant to replace third-party cookies. Once Google decided in 2024 to keep cookies in Chrome, advertisers and ad tech companies had little reason to rebuild around new APIs that were less precise and worked only in one browser.

Its retirement closes the chapter that began in January 2020. Chrome kept third-party cookies, and most of the proposed replacements are gone. On Android, the plan to move advertising away from the Advertising ID lost its main building blocks.

What survives is the idea of measuring conversions in aggregate. The W3C work Google mentioned is a draft standard called Attribution Level 1, with editors from Google, Mozilla and Meta. It describes a browser API that reports aggregate conversion statistics and applies differential privacy, adding statistical noise so no individual can be picked out.³ Mozilla had tried a version of the idea itself. Firefox 128, released in July 2024, included an experimental Privacy-Preserving Attribution setting that was switched on by default, and the privacy group noyb complained to Austria's data protection authority that Mozilla had enabled it without asking users.⁴ Mozilla says the experiment was never activated and has since removed it from Firefox.⁵

If browsers adopt the W3C draft, advertisers would get one form of privacy-preserving conversion measurement across browsers, instead of a different one in each.