Blog · Privacy Sandbox

Google retired Attribution Reporting. Chrome cookies stayed. The replacement stack is gone.

October 17, 2025 · 10 min read

On October 17, 2025 Google retired Attribution Reporting. Chrome cookies stayed. The replacement stack is gone. Teams that built ARA-only measurement have no Chrome API left.

Anthony Chavez, VP Privacy Sandbox, posted the list. After ecosystem feedback and low adoption, Google decided to retire Attribution Reporting API on Chrome and Android, IP Protection, On-Device Personalization, Private Aggregation including Shared Storage, Protected Audience on Chrome and Android, Protected App Signals, Related Website Sets including requestStorageAccessFor and Related Website Partition, SelectURL, SDK Runtime, and Topics on Chrome and Android. Chrome and Android processes will phase them out. Updates go on the developer site.

That is not third-party cookies disappearing. Chrome had already said it would keep the current approach to third-party cookie choice. The October post starts from that fact. The ads replacement APIs are what got cut. If your 2024 plan was wait for 3PCD, then measure with Attribution Reporting, you now have the cookies you were told to abandon and no Attribution Reporting API to replace them.

What was retired, in the words of the post

The retired set is the ads and measurement sandbox people actually staffed teams for. Topics was the interest signal. Protected Audience was the on-device auction. Attribution Reporting was the conversion API that was supposed to survive cookieless Chrome. Private Aggregation and Shared Storage were the aggregate reporting layer, including Select URL. Related Website Sets was the multi-domain cookie story. On Android, Protected App Signals, SDK Runtime, and On-Device Personalization sat next to the same Topics and Protected Audience names.

IP Protection is on the same retire list. That one was a network privacy feature, not a conversion pixel. It still dies with the rest. Do not write a postmortem that says only the ads APIs went away if your architecture ticket also depended on IP Protection.

Google said it will keep engaging on a proposed interoperable Attribution standard through the web standards process, including the Private Advertising Technology Working Group at the W3C. That is a standards conversation. It is not an API you can register a source on in Chrome today. Feedback from companies who built on Attribution Reporting will inform that work. Your production ARA endpoints are not that working group.

What continues: CHIPS, bounce tracking, FedCM, UA-CH

The same post names the APIs that stay. CHIPS and FedCM have seen broad adoption, including support from other browsers. Google will continue to support those APIs and look at enhancements. Private State Tokens stay, with more fraud and abuse work to explore. Publisher controls and poor web-experience features are a future conversation, not a shipped replacement for Topics.

The Privacy Sandbox status page, last updated August 14, 2026, matches the October decision. Chrome continue to support: bounce tracking mitigations, CHIPS, FedCM, frame-ancestors, Private State Tokens, storage and network state partitioning, Storage Access including the Storage Access Header, User-Agent Client Hints, and User-Agent reduction. Chrome deprecate and remove: Aggregation Service, Attribution Reporting, Fenced Frames, Private Aggregation, Protected Audience, Related Website Sets, Shared Storage including Select URL, and Topics. IP Protection, Partitioned Popins, and Related Website Partition are listed as discontinue. Several other experiments are do not launch.

Android's deprecate-and-remove row is Attribution Reporting, On-Device Personalization, Protected App Signals, Protected Audience, SDK Runtime, and Topics. If you staffed an Android Privacy Sandbox measurement program on ARA, that row is the same news as Chrome. The status page says documentation for phased-out technologies will stay for reference. Reference is not a shipping API.

ARA-only was a single-browser bet

Attribution Reporting was never a pixel. You registered a source on the click or impression, often in a response header. You registered a trigger on the conversion page. The browser joined them under privacy limits and sent a delayed, noised report to the ad tech origin. There was no gclid on a thank-you GIF that made ARA work. Event-level reports were coarse. Aggregate reports were the useful ones for value, and they were noised. Finance-style day-0 ROAS was never going to come from ARA alone.

Safari and Firefox never shipped Google's Attribution Reporting API as the Chrome replacement story. Third-party cookies were already gone there. The portable layer was always first-party click ids, hashed PII on a conversions API, enhanced conversions, and Consent Mode. ARA was extra, Chrome-shaped extra. A stack that deleted those hops because a Sandbox demo worked in one Chrome profile now has extra that Google is removing.

Protected Audience and Topics were the other staffing magnets. Remarketing without third-party cookies was supposed to be an on-device auction. Interest was supposed to be a Topics snapshot. Both are on the retire list for Chrome and Android. If your only remarketing plan was Protected Audience, the remaining remarketing hop is whatever still works with cookies the user still allows, plus your own first-party lists. There is no Chrome Protected Audience to wait for.

Related Website Sets including requestStorageAccessFor was how some multi-domain brands expected to share cookies across owned sites. That is retired too. CHIPS still partitions third-party cookies by top-level site. Storage Access continues. Those are not a drop-in for Related Website Sets. Bounce tracking mitigations also continue: Chrome can still delete state on bounce tracker sites when the user blocks third-party cookies. Cookies staying did not revive the bounce pixel.

The header that is no longer a measurement plan

An Attribution Reporting source registration. Google retired this API on October 17, 2025.

Attribution-Reporting-Register-Source: {
  "source_event_id": "123456789",
  "destination": "https://shop.example.com",
  "expiry": "2592000"
}

That header was the Chrome-shaped conversion hop. It is on the deprecate-and-remove list with Topics and Protected Audience. A 200 on googleadservices.com/pagead/conversion/ was never proof that ARA registered a trigger. It is now the hop you still have. Enhanced conversions, gclid, first-party order logs, and vendor CAPIs did not retire with Privacy Sandbox. They were always the cross-browser layer.

Do not read the October post as Chrome keeping third-party cookies forever in every profile. Incognito still blocks them. User settings still exist. Safari and Firefox still block them. The news is that the API Google offered as the ads replacement is going away for low adoption, while CHIPS, FedCM, UA-CH, and bounce tracking mitigations remain. Measurement that only existed inside Attribution Reporting has nowhere to go in Chrome.

Names that do not translate

Attribution Reporting is retired on Chrome and Android. It is not a delayed pixel you can keep calling.
Topics, Protected Audience, Private Aggregation, Shared Storage, SelectURL, and Related Website Sets are on the same retire list.
CHIPS, FedCM, UA-CH, bounce tracking mitigations, Storage Access, and Private State Tokens continue.
IP Protection, On-Device Personalization, Protected App Signals, and SDK Runtime are retired, not paused.
A W3C interoperable Attribution discussion is not a Chrome API you can register today.
Chrome third-party cookie choice staying is not Safari or Firefox restoring those cookies.
Fenced Frames sit on the status page as deprecate and remove. Do not build a new auction UI on them.

Cookies, CAPIs, and the hole ARA leaves

If you kept the conversion image, the Google tag, and a server purchase with hashed email, October 17 is a planning memo. If you stopped sending those because ARA was going to be the only join, you now have no Chrome API and no backup. Rebuild the portable hops. gclid still rides on landing URLs. Enhanced conversions still want hashed first-party data with Consent Mode. Vendor CAPIs still want their own clocks and event names.

Identity work that moved to FedCM is in a different bucket. FedCM continues. Do not retire your FedCM tickets because Topics died. Do not keep a Topics classifier in production because CHIPS continues. The status table is per feature. Copy the continue versus deprecate rows, not a vibe.

Android app measurement that lived on Privacy Sandbox ARA has the same hole. Play attribution and your MMP did not become Attribution Reporting. If the MMP integration was paused pending Android ARA, turn it back on. Google will follow Chrome and Android deprecation processes. There is no published date in the October post for the last Chrome release that answers the header. Plan as if new production dependence is already a mistake.

After evaluating ecosystem feedback about their expected value and in light of their low levels of adoption, we've decided to retire the following Privacy Sandbox technologies: Attribution Reporting API (Chrome and Android), IP Protection, On-Device Personalization, Private Aggregation (including Shared Storage), Protected Audience (Chrome and Android), Protected App Signals, Related Website Sets (including requestStorageAccessFor and Related Website Partition), SelectURL, SDK Runtime and Topics (Chrome and Android).

Anthony Chavez, Update on Plans for Privacy Sandbox Technologies, October 17, 2025

What to do

Stop treating Attribution-Reporting-Register-Source as a roadmap item. Keep first-party click ids, enhanced conversions, and the CAPI you already run in Safari. If a vendor integration exists only as an ARA destination origin, it needs a pixel or a conversions API, or it does not measure Chrome.

Read the status page when you write the architecture note. Continue versus deprecate and remove is the vocabulary. Do not tell a PM that Privacy Sandbox as a whole is dead. CHIPS and FedCM are still in the continue column. Do not tell them ARA is in a deprecation trial you can ride. The October post retired it.

The contract pages are the Privacy Sandbox overview and the Attribution Reporting doc, which now read as history. This post is the market fact: on October 17, 2025 Google retired the ads replacement APIs, and Chrome cookies were not the thing that flipped. Pixellint is not affiliated with Google. Passing a linter means the artifact matches the published envelope. It does not validate Attribution-Reporting headers, and it does not prove a conversion in Ads Manager.

Checklist

Read the October 17, 2025 Chavez post. Treat the retire list as the product decision.
Do not plan new production on Attribution Reporting, Topics, or Protected Audience.
Keep CHIPS, FedCM, UA-CH, and bounce tracking mitigations in the continue column.
Restore pixel plus CAPI and enhanced conversions if you paused them for ARA.
Do not confuse Chrome cookie choice with Safari or Firefox cookie policy.
Watch the status page for phase-out mechanics. The October post did not give a last Chrome version.

Sources

Contract pages

The dated argument is above. These pages are the field lists.

Read Privacy Sandbox Docs