For years, retargeting was synonymous with third-party cookies: a pixel set a cookie, and ad platforms served ads to returning visitors. That model is crumbling. While Google abandoned the full deprecation of third-party cookies in Chrome in 2024 and shifted to a user-choice model in 2026, the outcome is the same: relying on 3P cookies means losing reach. In Western Europe, the average consent rate is just 75.1% (Didomi), the actual opt-in rate is 55.7% (Didomi), and in Germany fewer than 25% of users accept tracking cookies (CookieYes). At the same time, 98% of website visitors do not convert on their first visit (Spiralytics). This guide shows how to build retargeting in 2026 using first-party data, server-side audiences, and Customer Match — consent-based and measurable.
Cookie Deprecation 2026: The New Reality
The story of cookie deprecation is a story of delays. In July 2024, Google announced it would not remove third-party cookies from Chrome after all, but instead give users a choice. On October 17, 2025, Google announced it would retire a large set of Privacy Sandbox technologies and focus on a smaller set of standards (Segwise). In early 2025, only around 32% of programmatic buyers actually used the Sandbox APIs in campaigns (Segwise) — a sign that the industry is already looking for other solutions.
For shop operators, this means: waiting for the official end of 3P cookies is not a strategy. The erosion is already happening — through Safari ITP, Firefox ETP, ad blockers, and above all through missing consent. When only one in four German users agrees to tracking (CookieYes), the cookie-based retargeting list shrinks accordingly. The answer is not a single replacement, but a bundle of consent-based first-party signals, server-side processing, and contextual delivery. The point is not to track less, but to make clean and complete use of the signals a user gives voluntarily.
Since 2026, Chrome actively asks users for their privacy preference instead of blocking 3P cookies across the board (CookieYes). This shifts responsibility to the user — with the foreseeable effect that many users disable tracking. 71% of publishers already ranked first-party data as a key source of positive advertising results in early 2025, up from 64% in 2024 (Adtelligent). 85% expect the role of first-party data to grow further in 2026 (Adtelligent).
This development fundamentally changes media-planning priorities. Anyone who has based their retargeting almost entirely on cookie-based remarketing lists sees the addressable audience shrink as more browsers and users restrict tracking. Instead of filling this gap with rented third-party data — whose importance is rapidly declining according to publisher surveys anyway — the strategic focus shifts to data the online store owns and controls. This step is less a technical stopgap than a fundamental realignment: away from rented identities, toward a proprietary, consent-based data foundation that gains value over time rather than decaying.
First-Party Audiences as the New Foundation
A first-party audience is built from data a shop collects directly and with consent from its users: email addresses from the newsletter, customer accounts, purchase history, cart events, and on-site behavior. Unlike the 3P cookie set via foreign domains, this data foundation belongs to the shop itself — and is therefore independent of browser restrictions. The decisive lever is conversion quality: advertisers with a mature first-party data strategy achieve 25-35% better ROAS and 1.5x stronger revenue growth than competitors relying on third-party data (Avaus).
The build starts with data collection. The more identifiable signals a shop gathers with consent, the larger and more accurate the audience becomes. An optimized customer account and registration flow is therefore not purely a UX topic, but directly revenue-relevant for retargeting. Real-world examples demonstrate the impact: through first-party data, custom audience match rates rose from 25% to over 80% (CustomerLabs). The key is asking for consent and data at the right points in the customer journey — at checkout, during newsletter sign-up, or in the customer account.
Identifiable Signals
Email, phone number, and customer ID are the currency of cookieless retargeting. They can be passed hashed to platforms and reach match rates of 60-80% (CustomerLabs).
Consent as the Basis
Every signal is processed only with documented consent. This protects against backlash and aligns with the GDPR requirements for tracking.
Growing Asset
Unlike rented 3P data, a first-party audience grows with every purchase and sign-up. 85% of publishers expect increasing importance in 2026 (Adtelligent).
Server-Side Audiences: Data Under Your Control
Client-side tracking via the browser is fragile: ad blockers, ITP, and missing consent cut off a large share of signals. Server-side tracking moves data processing to a dedicated server container that passes the consent-based first-party data hashed to the ad platforms. This makes transmission more robust and gives the shop control over which data leaves the building. Currently, 52% of advertisers use server-side tracking, and another 28% plan to implement it in 2026 (searchlab).
The economic effect is measurable. Meta's Conversions API recovers 15-30% of lost conversion data (EasyInsights). Even so, advertisers still lose up to 20% of their data with a server-side connection (MarvelPixel) — a sign that server-side is no autopilot, but requires clean implementation. We describe the technical implementation in detail in our article on Google Ads server-side tracking for online stores.
{
"event_name": "purchase",
"event_time": 1718000000,
"action_source": "website",
"user_data": {
"em": "<sha256-hashed-email>",
"ph": "<sha256-hashed-phone>"
},
"custom_data": {
"currency": "EUR",
"value": 149.90
},
"consent": { "ad_user_data": "granted" }
}Important: the hashing logic (usually SHA-256) and the transfer of consent status must happen server-side before data leaves your own infrastructure. This keeps it auditable that only consent-based signals are passed on — a key building block for legal certainty. The server container acts as a controlled gateway: it decides which fields, in what form, and to which platform data is transmitted, instead of leaving that decision to the browser and dozens of embedded scripts.
For audience building, server-side means more than better conversion capture. The server-side container can enrich events before they go to the platform — for example, with a purchase value, a product category, or a customer-value indicator. This enables more precise audiences, such as for high-value repeat buyers or for users who viewed a specific assortment. This logic stays fully under the shop's control and does not depend on whether a third-party script is allowed to run in the browser.
Customer Match: Turning Existing Data Into Audiences
Customer Match (in Google Ads) and comparable methods on other platforms allow hashed customer lists to be uploaded directly or synced via API. The platform matches the hashed emails and phone numbers against logged-in users and builds an audience from them — entirely without a 3P cookie. This is precisely where the strength of cookieless retargeting lies: Google Customer Match reaches match rates of 60-80% and conversion rates twice as high as classic retargeting audiences (CustomerLabs).
Customer Match is suitable not only for retargeting, but also for cross- and upselling as well as building lookalike or similar audiences. From a high-quality existing-customer list, new, statistically similar users can be reached — a growth lever based entirely on consent-based first-party data. The connection is typically handled via our Google Ads integration, which automatically synchronizes customer lists and conversion signals, eliminating manual uploads.
| Criterion | 3P-Cookie Retargeting | Customer Match (recommended) |
|---|---|---|
| Data basis | Third-party-set cookie | Own, consent-based list |
| Browser dependency | High (ITP, ad blockers) | Low (login-based) |
| Match rate | Declining | 60-80% (CustomerLabs) |
| Conversion rate | Standard | 2x vs. standard (CustomerLabs) |
| Cross-device | Limited | Possible via login |
| Lookalike potential | Limited | High (similar audiences) |
A practical note on maintenance: Customer Match lists should be updated regularly, as email addresses become outdated and customers opt out. Automated synchronization from the shop or CRM system keeps the lists current and ensures that opted-out users are correctly removed — which is relevant both for the match rate and for privacy-compliant processing. Outdated lists not only lower the match rate, they also cause waste because ads are served to people who have long since converted or opted out. Clean data maintenance is therefore a direct efficiency lever for the ad budget.
Enhanced Conversions and Consent Mode
Retargeting is only as good as the measurement behind it. Enhanced Conversions supplement existing conversion tracking by passing hashed first-party customer data to the ad platform in a privacy-safe way. The effect: combined with Conversion Modeling, Enhanced Conversions typically deliver an uplift of around 10% in measured conversions (Google Ads Help). In one documented case, the share of conversions captured via first-party cookies rose to 89% (Google Ads Help).
For this to work, the consent status must be cleanly signaled to the platforms. Consent Mode passes on whether a user has agreed to advertising and analytics cookies, and enables Conversion Modeling for the cases without consent. This keeps measurement reliable without undermining privacy. A solid multi-touch attribution builds on exactly these consent-based signals to correctly evaluate the contribution of each channel — and prevents retargeting, the last visible touchpoint, from being overrated.
Without reliable conversion signals, ad platforms optimize blindly. With Enhanced Conversions, Consent Mode, and a server-side connection, the algorithms regain reliable data — and automated bidding can play to its strengths. The typical uplift of around 10% (Google Ads Help) translates directly into more efficient budget.
In practice, this means an interplay of several components: Consent Mode delivers the consent signal, Enhanced Conversions enrich captured conversions with hashed first-party data, and the server-side connection ensures this data arrives even when client-side scripts are blocked. Only in this combination does the full effect unfold — individual building blocks deliver only part of the possible uplift. For shops working with data-driven bidding strategies, a complete and correct signal base is therefore the prerequisite so that automation does not learn on distorted or incomplete data.
Contextual Targeting as a Strong Complement
Not every user leaves an identifiable first-party signal. This is where contextual targeting comes in: instead of following a person via their behavior, the ad is aligned with the content of the page currently being viewed. Someone reading a guide about running shoes sees relevant running-shoe ads — without any cookie being needed. The contextual advertising market is growing accordingly: from around USD 233.89 billion in 2025 to USD 258.32 billion in 2026, at an annual growth rate of 10.4% (Research and Markets).
Contextual targeting is privacy-friendly because it works without personal data, and it complements first-party retargeting ideally: while Customer Match reactivates known users, contextual advertising reaches new, topic-affine audiences. For shops with a clear assortment focus, the combination is especially effective — it covers both reactivation and new-customer acquisition without relying on eroding cookie signals.
Modern contextual methods go far beyond simple keyword matching. Semantic analysis captures not just individual keywords but the thematic context of a page, which significantly increases hit quality. For advertisers, this yields a double advantage: high relevance for the user in the moment of their current interest, and full independence from the cookie question. The growth of the market — driven partly by the loss of reliable cookie signals — underlines that contextual advertising is not a transitional phenomenon, but a lasting building block in the media mix.
- First-party retargeting - Reactivates known users via Customer Match and consent-based audiences, highest conversion quality
- Contextual targeting - Reaches topic-affine users without personal data, ideal for reach and new customers
- Dynamic retargeting - Serves specifically viewed products, highly effective for cart abandoners (abandonment rate around 70%, Spiralytics)
- Lookalike audiences - Extend a high-quality existing-customer list to statistically similar users
- Email and CRM retargeting - Uses your own data foundation directly for personalized outreach across multiple channels
Measuring Retargeting Performance Correctly
The impact of cookieless retargeting can be proven with clear metrics. First, the match rate: it shows how many of the uploaded customer records could be matched to a platform's logged-in users. Values of 60-80% are considered good (CustomerLabs). A low match rate points to outdated or incomplete data and is the first lever for optimization. The second KPI is the conversion rate of the retargeting audience compared to the cold audience — it shows whether reactivation actually drives revenue.
The numbers support the business case: retargeting can reduce the cart abandonment rate by 26% (Spiralytics), retargeted users are 70% more likely to convert (Spiralytics), and across all devices retargeting increases the conversion rate by up to 43% (Spiralytics). AI-driven, time-staggered retargeting workflows now reactivate on average 34% of lost customers (Spiralytics). No wonder 70% of marketers plan a dedicated retargeting budget (cropink).
Before you increase the retargeting budget, check the foundation: are conversions captured server-side and consent-based? Is Consent Mode correct? Are customer lists current and correctly hashed? A clean server-side setup with Google Ads is the prerequisite for every euro invested to rest on reliable data — otherwise the algorithms optimize on gaps.
Build Cookieless Retargeting Now
The data is clear: cookie-based retargeting is losing reach, while consent-based first-party approaches are gaining quality. 60-80% match rate and double the conversion rate with Customer Match (CustomerLabs), 25-35% better ROAS through mature first-party strategies (Avaus), and an approximately 10% conversion uplift through Enhanced Conversions (Google Ads Help) show that the switch is worthwhile not only defensively, but offensively.
The path there follows a clear sequence: first, expand consent-based data collection — via optimized customer accounts and newsletters. Second, establish a server-side setup that passes data hashed and consent-compliant to the platforms. Third, activate Customer Match and Enhanced Conversions. Fourth, add contextual targeting for reach. And fifth, measure and adjust continuously. Anyone working in parallel on organic visibility via Google sources further reduces dependence on paid reach.
As an e-commerce agency specializing in tracking and ad integration, we support you with the technical implementation — from server-side infrastructure and Customer Match synchronization to consent-compliant measurement. This is how you build retargeting that stays reliable even without third-party cookies and grows continuously stronger with your data foundation.
This article is based on data from: Didomi (consent and opt-in rates Europe), CookieYes (acceptance rates Germany), Segwise (Privacy Sandbox status and adoption), Adtelligent (first-party data importance among publishers), Avaus (first-party data ROAS benchmarks), CustomerLabs (Customer Match and match rate data), EasyInsights (Conversions API recovery), MarvelPixel (remaining data loss), searchlab (server-side tracking adoption), Google Ads Help (Enhanced Conversions uplift), Research and Markets (contextual advertising market), Spiralytics (retargeting and cart statistics), cropink (retargeting budget allocation). The figures cited can vary depending on industry, platform, and implementation.
Frequently Asked Questions About Cookieless Retargeting
Yes, but no longer via the classic cookie route. Consent-based retargeting via first-party data and Customer Match works independently of 3P cookies. Google Customer Match typically reaches match rates of 60-80% and roughly double the conversion rates of classic retargeting audiences (CustomerLabs).
Third-party cookies are set via foreign domains and are heavily affected by browser restrictions and missing consent. First-party data is collected by the shop directly and with consent from its users — such as email, customer account, or purchase history. This data foundation belongs to the shop itself and is more robust. Advertisers with a mature first-party strategy typically achieve 25-35% better ROAS (Avaus).
Consent-based retargeting requires documented consent before personal data is processed. Data is usually passed hashed (SHA-256), and Consent Mode signals the consent status to the platforms. A clean server-side implementation according to GDPR requirements is central to this. A legally binding assessment of the individual case should always be made with qualified advice.
Match rates with Google Customer Match are usually between 60% and 80% (CustomerLabs). The exact level depends on data quality: current, complete, and correctly hashed customer data achieves higher match rates. Through the use of first-party data, match rates were increased in practice from 25% to over 80% (CustomerLabs).
Server-side tracking is not mandatory, but typically much more robust, because it bypasses ad blockers and browser restrictions and makes the consent-based data transfer controllable. Meta's Conversions API typically recovers 15-30% of lost conversion data (EasyInsights). Currently, 52% of advertisers use server-side tracking, and another 28% plan it for 2026 (searchlab).
Contextual targeting aligns ads with the content of the page being viewed, without using personal data. It reaches topic-affine users who have not left a first-party signal, and thus complements the reactivation of known users via Customer Match. The contextual advertising market is growing from around USD 233.89 billion in 2025 to USD 258.32 billion in 2026 (Research and Markets), underlining the growing importance of this privacy-friendly approach.