pixellint

Blog · CHIPS

CHIPS survived the Privacy Sandbox cull. Unpartitioned iframe cookies did not.

· 10 min read

CHIPS survived the Privacy Sandbox cull. Unpartitioned iframe cookies did not. Cookies Having Independent Partitioned State stay supported after Topics and Attribution Reporting were retired. A third-party pixel in an iframe that still sets SameSite=None without Partitioned is a cookie the top-level site cannot share.

The first integration most stacks will ship is to do nothing. Chrome kept third-party cookies. The iframe pixel still sends Set-Cookie: id=...; Secure; SameSite=None. In a profile that allows third-party cookies, that cookie still looks live. In Incognito, in a user who blocked 3PC, and in every engine that never allowed them, that cookie is the one CHIPS was built to replace, and it was not replaced. Partitioned is an opt-in attribute. Without it there is no partitioned jar.

CHIPS is not a replacement for a conversion API. A partitioned cookie is keyed to the top-level site. The same embed on two publishers holds two cookies. Cross-site retargeting was the unpartitioned behavior. CHIPS keeps a chat widget, a payment frame, or a per-publisher ad preference alive on one site. It does not join those sites. If the pixel needed the same id on retailer A and retailer B, CHIPS is how that id splits, not how it is restored.

Partitioned means a jar per top-level site

Chrome documents the header. Set-Cookie: __Host-name=value; Secure; Path=/; SameSite=None; Partitioned. JavaScript can set the same string on document.cookie. Partitioned cookies must be Secure. Chrome recommends the __Host- prefix so the cookie is bound to the hostname, not the registrable domain. SameSite=None is still required if you want the cookie sent in a third-party context on browsers that do not understand Partitioned and still allow third-party cookies.

Without partitioning, a third-party service sets a cookie when embedded on site A and reads it when embedded on site B. With CHIPS, the cookie is double-keyed on host and partition. The partition key is the site of the top-level URL at the start of the request that set the cookie. When the user visits another shop that embeds the same chat, that jar is empty.

Chrome limits the partitioned jar: at most 180 cookies per partition, and they cannot exceed 10 KB per embedded site. A pixel that stuffed a graph of ids into one third-party cookie will not get a bigger partitioned cookie. It gets a smaller, site-scoped one, or it gets nothing if it never set Partitioned.

An iframe pixel without Partitioned is the miss

A nested pixel is often an iframe on the advertiser origin, pointing at a vendor host. The vendor responds with Set-Cookie; SameSite=None; Secure and no Partitioned. When third-party cookies are allowed, the cookie is available on every site that embeds that vendor. When they are blocked, site B cannot read what site A wrote, and site A cannot write unless the cookie is partitioned. Chrome's CHIPS demo makes this visible in DevTools: the unpartitioned cookie is blocked in a cross-site iframe; the Partitioned cookie appears with a partition key of the top-level site.

Use cases Chrome lists are chat embeds, maps, payments, CDN load balancing, sandbox domains, and ads that need state scoped per publisher (capturing ad preferences for that website). Per publisher is the tell. A conversion pixel that needs the same click id on a publisher page and on a retailer thank-you page is asking for the unpartitioned jar. CHIPS will give it two ids. The conversion API is how those ids get joined, if they get joined, with a hashed email or a click id you copied through the landing URL.

Firefox partitions third-party cookies by default in ETP Strict and private browsing, without an opt-in attribute. Safari blocked third-party cookies after heuristic partitioning confused developers. Chrome's model is opt-in. If your Set-Cookie still omits Partitioned, you are on the unpartitioned path, which dies when 3PC are blocked.

That header is a legal third-party cookie if the browser allows third-party cookies. In a CHIPS world with 3PC blocked, the embed cannot set it and cannot read a sibling it set on another site. Adding Partitioned, Secure, SameSite=None, and preferably __Host- creates a jar the top-level site owns for that embed. It does not create a jar shared with the next top-level site.

Inspect it in DevTools Application, Cookies. A partitioned cookie shows a partition key of the top-level site. An unpartitioned cookie shows an empty partition key and is blocked in the cross-site iframe when 3PC are off. Network, Cookies, on the iframe request is the other view: blocked cookies versus the Partitioned one that is sent only when the top-level site matches.

Names that do not translate

CHIPS is not CAPI

A conversion API posts an event from a server you control, with a click id and hashed match keys, to a vendor host. CHIPS lets an iframe keep a session cookie on one publisher. Confusing them is how a team ships Partitioned on the pixel and declares server-side tracking done. The partitioned cookie never leaves that top-level site. The CAPI event can, if you collected the identifiers on your origin and posted them.

Embedded ads that need state scoped per publisher are in Chrome's use-case list. That is preference and frequency on that site, not a person id for the DSP. Unpartitioned iframe cookies were the quiet join. They survive only where third-party cookies are still allowed.

Do not wait for Related Website Sets to glue brand domains together. Chrome listed them in the retirement. Status for CHIPS is Continue to support. Mark the cookies that should live inside one site, and stop pretending the ones that must live across sites are still a Set-Cookie problem.

CHIPS and FedCM, which improve cookie privacy and security and streamline identity flows respectively, have seen broad adoption, including support from other browsers. We'll continue to support those APIs and evaluate opportunities for future enhancements.

Update on Plans for Privacy Sandbox Technologies, 17 October 2025

What to do

Inventory every Set-Cookie from a third-party pixel or iframe. If the cookie must work when third-party cookies are blocked, add Secure; SameSite=None; Partitioned, and prefer __Host-. Accept that the id is now per top-level site. If the cookie must work across sites, it is not a CHIPS cookie. Collect the click id and match keys on your origin and send them server-side.

Do not plan on Related Website Sets. Do not treat an unpartitioned SameSite=None cookie as the hybrid setup. Test the iframe in a profile that blocks third-party cookies. DevTools should show the partition key. If the cookie is blocked, Partitioned is missing or the request is not the embed you thought.

The contract for cookie types is the first-party versus third-party cookies page. This post is the market fact: CHIPS stayed, unpartitioned iframe cookies did not get a new API, and CHIPS is not CAPI. Pixellint is not affiliated with Google. Passing a linter means the artifact matches a published cookie or pixel shape. It does not mean the partitioned cookie joined two sites, and it does not detect fraud.

Checklist

Sources

Contract pages

The dated argument is above. These pages are the field lists.

Read cookie types Docs