On January 4, 2024, Google quietly rewired the browser for roughly 30 million Chrome users. The company’s long-telegraphed “Tracking Protection” feature — the practical mechanism for its third-party cookie deprecation plan — went live for 1% of Chrome’s global user base. No countdown timer, no press conference. Just a small notification prompt and a setting that, for a meaningful slice of the open web’s audience, changed how the advertising ecosystem sees them.
The industry has had four years to prepare. The question now is whether it actually did.
What “1% Rollout” Actually Means in Practice
One percent of Chrome users is not a rounding error. Chrome commands roughly 65% of global browser market share. One percent of that user base is somewhere between 25 million and 35 million people depending on whose monthly active estimates you use. These are real audiences, real inventory, real campaigns affected — and the rollout is live right now.
Google’s Tracking Protection feature works by restricting third-party cookie access by default. Affected users see a small “eye” icon in their Chrome address bar and a notification explaining the change. They can opt back in if they choose — but the default state is cookieless, which matters enormously for how DSPs and buy-side platforms process bid requests against those users.
Publishers serving into this cohort are already reporting bid request changes. The IAB Tech Lab’s specifications for handling cookieless bid requests have existed for years, but implementation has been uneven. Early signals from supply partners suggest that a meaningful percentage of bid requests for the 1% cohort are arriving at DSPs without valid identity signals — and that DSP responses to those requests vary widely.
What the CPM Data Is Showing
The most watched metric in the first two weeks has been CPM impact for inventory in the Tracking Protection cohort versus matched control inventory. The numbers are not pretty, and they’re not surprising.
Publishers with strong authenticated audience programs — newsletter operators, subscription media, logged-in platforms — are reporting relatively modest CPM degradation in the single digits. Publishers relying primarily on open exchange, audience extension, and third-party data overlays are seeing something more significant.
Estimates from supply-side platforms tracking the bifurcation are pointing toward 20-40% CPM depression on cookieless inventory compared to cookie-enabled impressions from identical demographic and contextual segments. That spread reflects both targeting degradation (DSPs simply cannot bid with the same precision) and auction dynamics (fewer valid bidders per impression drives floor prices down).
For buyers, the picture is different but equally uncomfortable. Campaign managers checking performance dashboards are seeing the 1% cohort show up as a frequency control blind spot and attribution gap simultaneously. Retargeting audiences simply don’t include these users. Conversion signals from these users don’t match back cleanly. From a campaign management standpoint, the 1% might as well be invisible.
The Preparedness Mismatch Is Larger Than Expected
Google’s Privacy Sandbox timeline has been public for years. The company first announced the deprecation plan in January 2020. There have been multiple delays, multiple industry consultations, and — as of this writing — a formal commitment to deprecate cookies for all Chrome users in the second half of 2024.
And yet, the first substantive data from the 1% rollout suggests that a significant portion of the buy-side was not functionally prepared.
The gap shows up in several places. First, many DSPs have not fully integrated Privacy Sandbox APIs — the Protected Audience API (formerly FLEDGE), Topics API, and Attribution Reporting API — in ways that would allow them to serve cookieless audiences effectively. Second, advertiser first-party data programs that would theoretically allow re-engagement with cookieless users (through hashed email matching, PAIR, or clean room activations) remain nascent at most mid-market advertisers. Third, the clean room infrastructure that large buyers have been building — Habu, InfoSum, LiveRamp Data Collaboration — is not yet operating at the scale or speed needed to back-fill what cookies provided.
The mismatch is producing a visible bifurcation on the buy side: large holding company agencies with dedicated identity resolution programs are navigating the 1% reasonably well. Independent agencies and in-house teams without those programs are largely ignoring the cohort or absorbing the performance degradation without a clear action plan.
What DSPs Are (and Aren’t) Doing
The major DSPs have made varying levels of public commitment to Privacy Sandbox integration. Google’s own DV360 has the deepest integration, by design. The Trade Desk has been more measured, continuing to invest in its Unified ID 2.0 alternative while maintaining that the Privacy Sandbox APIs do not provide adequate advertiser control or measurement fidelity.
What’s becoming clear in the first weeks of live rollout is that the diversity of DSP approaches creates a fragmented buy-side experience. A campaign running across multiple DSPs will have inconsistent coverage of the 1% cohort depending on which platforms are bidding on which impressions with what identity signals. That inconsistency makes it nearly impossible to get a clean read on actual reach against the Tracking Protection population.
Publishers working with multiple SSPs are seeing this play out in fill rate differences. SSPs that have invested in cookieless infrastructure are filling more impressions in the 1% cohort than those that haven’t. The result is that revenue is flowing toward supply partners with better technical preparation — a trend that will accelerate as the percentage increases.
The Signal You Should Actually Be Tracking
The operational question for buyers right now is not “how bad is the CPM impact on 1% of users.” It’s “what is my functional reach against cookieless users in general” — because Safari’s Intelligent Tracking Prevention and Firefox’s Enhanced Tracking Protection have been deprecating third-party cookies for years. Depending on your media mix and audience composition, you may already have 30-40% of your target audience in a cookieless state.
The 1% Chrome rollout matters not because it’s large but because it’s measured. This is the first opportunity the industry has had to benchmark cookieless performance against a cookie-enabled control group in Chrome — the browser that previously provided full cookie fidelity. The data coming out of January and February will be more instructive than anything from the past four years of preparedness rhetoric.
Publishers should be running that analysis now. Buyers should be demanding it from their supply partners.
FAQ
Q: Does the 1% Tracking Protection rollout affect all Chrome users globally or just certain regions? Google’s initial rollout is global for 1% of Chrome users. Users in the UK, EU, and other regions with active regulatory oversight may have different experiences depending on how Google handles consent requirements in those jurisdictions.
Q: If a user is in the 1% Tracking Protection cohort, can they opt back into cookies? Yes. Users who receive the Tracking Protection notification can click through to re-enable third-party cookies in Chrome settings. Google has stated that this opt-back-in will remain available through the full deprecation period, though the default state for new users will eventually be cookieless.
Q: Are Privacy Sandbox APIs like Protected Audience and Topics live for the 1% cohort? The Privacy Sandbox APIs are available in Chrome and have been testable since mid-2023. For the 1% Tracking Protection cohort, these APIs are the intended replacement mechanism for cookie-based targeting. However, actual adoption by DSPs and buyers remains limited, meaning the APIs are technically live but commercially underutilized.
Q: What should publishers do right now to protect revenue from the 1% cohort? Publishers should audit what percentage of their current revenue comes from cookieless inventory (Safari, Firefox) and compare CPM performance. Accelerating logged-in user programs, implementing IAB Tech Lab’s seller-defined audiences spec, and ensuring their SSP partners have cookieless bid enrichment active are the highest-priority near-term actions.