Retargeting Without Third-Party Cookies: 2026 Strategies

For years, retargeting was synonymous with third-party cookies: a pixel set a cookie, and ad platforms served ads to returning visitors. That model is crumbling. While Google abandoned the full deprecation of third-party cookies in Chrome in 2024 and shifted to a user-choice model in 2026, the outcome is the same: relying on 3P cookies means losing reach. In Western Europe, the average consent rate is just 75.1% (Didomi), the actual opt-in rate is 55.7% (Didomi), and in Germany fewer than 25% of users accept tracking cookies (CookieYes). At the same time, the vast majority of website visitors do not convert on their first visit — the average cart abandonment rate is around 70% (Baymard). This guide shows how to build retargeting in 2026 using first-party data, server-side audiences, and Customer Match — consent-based and measurable.

Cookie Deprecation 2026: The New Reality

The story of cookie deprecation is a story of delays. In July 2024, Google announced it would not remove third-party cookies from Chrome after all, but instead give users a choice. On October 17, 2025, Google announced it would retire a large set of Privacy Sandbox technologies and focus on a smaller set of standards (Segwise). In early 2025, only around 32% of programmatic buyers actually used the Sandbox APIs in campaigns (Segwise) — a sign that the industry is already looking for other solutions.

For shop operators, this means: waiting for the official end of 3P cookies is not a strategy. The erosion is already happening — through Safari ITP, Firefox ETP, ad blockers, and above all through missing consent. When only one in four German users agrees to tracking (CookieYes), the cookie-based retargeting list shrinks accordingly. The answer is not a single replacement, but a bundle of consent-based first-party signals, server-side processing, and contextual delivery. The point is not to track less, but to make clean and complete use of the signals a user gives voluntarily.

This development fundamentally changes media-planning priorities. Anyone who has based their retargeting almost entirely on cookie-based remarketing lists sees the addressable audience shrink as more browsers and users restrict tracking. Instead of filling this gap with rented third-party data — whose importance is rapidly declining according to publisher surveys anyway — the strategic focus shifts to data the online store owns and controls. This step is less a technical stopgap than a fundamental realignment: away from rented identities, toward a proprietary, consent-based data foundation that gains value over time rather than decaying.

First-Party Audiences as the New Foundation

A first-party audience is built from data a shop collects directly and with consent from its users: email addresses from the newsletter, customer accounts, purchase history, cart events, and on-site behavior. Unlike the 3P cookie set via foreign domains, this data foundation belongs to the shop itself — and is therefore independent of browser restrictions. The decisive lever is conversion quality: companies that fully link their first-party data sources achieve up to 2.9x higher incremental revenue from a single ad placement and 1.5x better cost efficiency than companies with only limited data integration (Google/BCG).

The build starts with data collection. The more identifiable signals a shop gathers with consent, the larger and more accurate the audience becomes. An optimized customer account and registration flow is therefore not purely a UX topic, but directly revenue-relevant for retargeting. Complete and correctly formatted first-party data noticeably lifts the match rate: with Google Customer Match, most advertisers see match rates between 29% and 62% (Google Ads Help), and higher with clean data maintenance. The key is asking for consent and data at the right points in the customer journey — at checkout, during newsletter sign-up, or in the customer account.

Server-Side Audiences: Data Under Your Control

Client-side tracking via the browser is fragile: ad blockers, ITP, and missing consent cut off a large share of signals. Server-side tracking moves data processing to a dedicated server container that passes the consent-based first-party data hashed to the ad platforms. This makes transmission more robust and gives the shop control over which data leaves the building. Currently, 52% of advertisers use server-side tracking, and another 28% plan to implement it in 2026 (searchlab).

The economic effect is measurable. Meta's Conversions API transmits conversion events server-side and thus recovers part of the signals lost client-side to ad blockers and ITP. Even so, advertisers still lose up to 20% of their data with a server-side connection (MarvelPixel) — a sign that server-side is no autopilot, but requires clean implementation. We describe the technical implementation in detail in our article on Google Ads server-side tracking for online stores.

{
  "event_name": "purchase",
  "event_time": 1718000000,
  "action_source": "website",
  "user_data": {
    "em": "<sha256-hashed-email>",
    "ph": "<sha256-hashed-phone>"
  },
  "custom_data": {
    "currency": "EUR",
    "value": 149.90
  },
  "consent": { "ad_user_data": "granted" }
}

Important: the hashing logic (usually SHA-256) and the transfer of consent status must happen server-side before data leaves your own infrastructure. This keeps it auditable that only consent-based signals are passed on — a key building block for legal certainty. The server container acts as a controlled gateway: it decides which fields, in what form, and to which platform data is transmitted, instead of leaving that decision to the browser and dozens of embedded scripts.

For audience building, server-side means more than better conversion capture. The server-side container can enrich events before they go to the platform — for example, with a purchase value, a product category, or a customer-value indicator. This enables more precise audiences, such as for high-value repeat buyers or for users who viewed a specific assortment. This logic stays fully under the shop's control and does not depend on whether a third-party script is allowed to run in the browser.

Customer Match: Turning Existing Data Into Audiences

Customer Match (in Google Ads) and comparable methods on other platforms allow hashed customer lists to be uploaded directly or synced via API. The platform matches the hashed emails and phone numbers against logged-in users and builds an audience from them — entirely without a 3P cookie. This is precisely where the strength of cookieless retargeting lies: with Google Customer Match, most advertisers reach match rates between 29% and 62% (Google Ads Help), and applying Customer Match signals delivered a conversion uplift of 5.3% in Google's analysis (Google Ads Help).

Customer Match is suitable not only for retargeting, but also for cross- and upselling as well as building lookalike or similar audiences. From a high-quality existing-customer list, new, statistically similar users can be reached — a growth lever based entirely on consent-based first-party data. The connection is typically handled via our Google Ads integration, which automatically synchronizes customer lists and conversion signals, eliminating manual uploads.

A practical note on maintenance: Customer Match lists should be updated regularly, as email addresses become outdated and customers opt out. Automated synchronization from the shop or CRM system keeps the lists current and ensures that opted-out users are correctly removed — which is relevant both for the match rate and for privacy-compliant processing. Outdated lists not only lower the match rate, they also cause waste because ads are served to people who have long since converted or opted out. Clean data maintenance is therefore a direct efficiency lever for the ad budget.

Enhanced Conversions and Consent Mode

Retargeting is only as good as the measurement behind it. Enhanced Conversions supplement existing conversion tracking by passing hashed first-party customer data to the ad platform in a privacy-safe way. The effect: combined with Conversion Modeling, Enhanced Conversions deliver, for early adopters, a median uplift of around 5% in measured conversions on Search (Google Ads Help). In one documented case, the share of conversions captured via first-party cookies rose to 89% (Google Ads Help).

For this to work, the consent status must be cleanly signaled to the platforms. Consent Mode passes on whether a user has agreed to advertising and analytics cookies, and enables Conversion Modeling for the cases without consent. This keeps measurement reliable without undermining privacy. A solid multi-touch attribution builds on exactly these consent-based signals to correctly evaluate the contribution of each channel — and prevents retargeting, the last visible touchpoint, from being overrated.

In practice, this means an interplay of several components: Consent Mode delivers the consent signal, Enhanced Conversions enrich captured conversions with hashed first-party data, and the server-side connection ensures this data arrives even when client-side scripts are blocked. Only in this combination does the full effect unfold — individual building blocks deliver only part of the possible uplift. For shops working with data-driven bidding strategies, a complete and correct signal base is therefore the prerequisite so that automation does not learn on distorted or incomplete data.

Contextual Targeting as a Strong Complement

Not every user leaves an identifiable first-party signal. This is where contextual targeting comes in: instead of following a person via their behavior, the ad is aligned with the content of the page currently being viewed. Someone reading a guide about running shoes sees relevant running-shoe ads — without any cookie being needed. The contextual advertising market is growing accordingly: from around USD 233.89 billion in 2025 to USD 258.32 billion in 2026, at an annual growth rate of 10.4% (Research and Markets).

Contextual targeting is privacy-friendly because it works without personal data, and it complements first-party retargeting ideally: while Customer Match reactivates known users, contextual advertising reaches new, topic-affine audiences. For shops with a clear assortment focus, the combination is especially effective — it covers both reactivation and new-customer acquisition without relying on eroding cookie signals.

Modern contextual methods go far beyond simple keyword matching. Semantic analysis captures not just individual keywords but the thematic context of a page, which significantly increases hit quality. For advertisers, this yields a double advantage: high relevance for the user in the moment of their current interest, and full independence from the cookie question. The growth of the market — driven partly by the loss of reliable cookie signals — underlines that contextual advertising is not a transitional phenomenon, but a lasting building block in the media mix.

• First-party retargeting - Reactivates known users via Customer Match and consent-based audiences, highest conversion quality
• Contextual targeting - Reaches topic-affine users without personal data, ideal for reach and new customers
• Dynamic retargeting - Serves specifically viewed products, highly effective for cart abandoners (average abandonment rate around 70%, Baymard)
• Lookalike audiences - Extend a high-quality existing-customer list to statistically similar users
• Email and CRM retargeting - Uses your own data foundation directly for personalized outreach across multiple channels

Measuring Retargeting Performance Correctly

The impact of cookieless retargeting can be proven with clear metrics. First, the match rate: it shows how many of the uploaded customer records could be matched to a platform's logged-in users. For most advertisers it lies between 29% and 62% (Google Ads Help). A low match rate points to outdated or incomplete data and is the first lever for optimization. The second KPI is the conversion rate of the retargeting audience compared to the cold audience — it shows whether reactivation actually drives revenue.

The numbers support the business case: around 70% of carts are abandoned (Baymard), which illustrates the reactivation potential. Retargeting addresses exactly this by re-engaging known prospects in a targeted way, instead of paying again for expensive cold reach. Accordingly, 70% of marketers plan a dedicated retargeting budget (cropink).

Build Cookieless Retargeting Now

The data is clear: cookie-based retargeting is losing reach, while consent-based first-party approaches are gaining quality. A 29-62% match rate and a 5.3% conversion uplift from Customer Match signals (Google Ads Help), up to 2.9x higher incremental revenue from fully linked first-party data (Google/BCG), and a median conversion uplift of around 5% on Search through Enhanced Conversions (Google Ads Help) show that the switch is worthwhile not only defensively, but offensively.

The path there follows a clear sequence: first, expand consent-based data collection — via optimized customer accounts and newsletters. Second, establish a server-side setup that passes data hashed and consent-compliant to the platforms. Third, activate Customer Match and Enhanced Conversions. Fourth, add contextual targeting for reach. And fifth, measure and adjust continuously. Anyone working in parallel on organic visibility via Google sources further reduces dependence on paid reach.

As an e-commerce agency specializing in tracking and ad integration, we support you with the technical implementation — from server-side infrastructure and Customer Match synchronization to consent-compliant measurement. This is how you build retargeting that stays reliable even without third-party cookies and grows continuously stronger with your data foundation.

Frequently Asked Questions About Cookieless Retargeting