Every major change to ad tracking since 2012, from Apple, Google, browsers and regulators: what changed, what it did to measurement, and the sources worth reading.
Last updated October 23, 2026
In focus:How Apple Changed TrackingHow Google Changed Tracking
Apple has spent fourteen years narrowing what advertisers and analytics vendors can learn about iPhone users. Each step went further than the last: first a resettable advertising identifier, then cookie limits in Safari, then a permission prompt, and now the blocking of named ad tech domains in iOS 27.
Google took a different road. Android followed Apple on the advertising ID, but Chrome spent four years promising to end third-party cookies before keeping them, then retired most of the Privacy Sandbox built to replace them. Regulators shaped both paths.
Each entry has a short summary. The biggest changes have a full story, with what changed, why it mattered, what it means for marketers today and the sources worth reading.
Showing 49 of 49 entries, oldest first
Permanent device ID gone; resettable ad ID arrives
Apple replaced the permanent device ID (UDID) with the Identifier for Advertisers, which users could reset. A Limit Ad Tracking switch shipped alongside it, but it only signalled a preference. Apps could still read the identifier.
Android's answer to the IDFA, with an opt-out of interest-based ads
Google introduced the Advertising ID through Google Play services: a resettable identifier with a setting to opt out of interest-based ads. Like Apple's early Limit Ad Tracking switch, the opt-out was a signal apps were expected to respect, not a technical block. From August 2014, Google Play policy required apps to use the Advertising ID for advertising instead of permanent identifiers such as the IMEI.
Web trackers blocked for users who install a blocker
Apple let App Store apps supply block lists to Safari, covering ads, tracking scripts and cookies. Blockers were off by default, and Adobe's early analysis found no significant drop in measured Safari traffic. It was still the first time iPhone users could block web trackers.
No identifier at all for opted-out users
With Limit Ad Tracking switched on, the IDFA now returned all zeros. That removed attribution and frequency capping for those users, not only ad targeting. It was the first technical opt-out rather than a request.
Cross-site cookies from classified trackers partitioned or purged
Safari 11 began classifying domains that could track users across sites, on the device, then partitioning or purging their cookies. It was on by default for everyone. Six advertising trade groups objected in an open letter, and Apple did not back down.
Tracking EU residents needs a lawful basis, usually consent
The General Data Protection Regulation made personal data, including cookie IDs and device identifiers, subject to strict rules for anyone processing data on people in the EU. For most ad tracking the practical lawful basis became consent, which is why cookie banners and consent management platforms spread across the web.
Script-set first-party cookies expire after seven days
Cookies written by scripts, including first-party analytics cookies, now expired after seven days. A visitor who returned on day eight looked like a new user. ITP 2.2 cut that to one day for some ad-click traffic two months later.
Known third-party tracking cookies blocked by default
Mozilla turned on Enhanced Tracking Protection by default for new Firefox users, blocking third-party cookies from a list of known trackers, and extended it to existing users later that year. With Safari's ITP already in place, two major browsers now limited cross-site tracking out of the box.
Apps can no longer read the IMEI or serial number
From Android 10, apps need a privileged system permission to read non-resettable identifiers such as the IMEI and serial number, which ordinary apps cannot get. That closed off the permanent identifiers some SDKs still used as a fallback to the resettable Advertising ID.
Californians can opt out of the sale of their personal data
The California Consumer Privacy Act gave residents the right to know what personal data businesses hold about them and to opt out of its sale. Sharing data for ad targeting was widely treated as a sale, which brought "Do Not Sell" links and opt-out signals into US ad tech.
Google commits to removing third-party cookies within two years
Google said Chrome would phase out support for third-party cookies within two years, replacing them with privacy-preserving alternatives it called the Privacy Sandbox. With Chrome holding most of the browser market, this would have ended third-party cookies almost everywhere. It never happened: Google delayed the plan three times and dropped it in 2024.
All third-party cookies blocked by default
Safari became the first mainstream browser to block third-party cookies fully and by default. The same release extended the seven-day expiry to all script-writable storage. From iOS 14 that autumn, these protections applied to every browser and in-app web view on iPhone.
Opt-in tracking announced for iOS 14, then pushed to 2021
At WWDC20 Apple announced that apps would need permission to track users across other companies' apps and websites, starting with iOS 14 that autumn. In September it delayed enforcement to early 2021 to give developers time to prepare. The prompt arrived with iOS 14.5 in April 2021.
Sending Europeans' data to US tools such as Google Analytics became a legal risk
The EU's highest court ruled that US surveillance law didn't protect Europeans' data well enough and struck down the Privacy Shield, the framework thousands of US companies used to receive it. Regulators then found standard Google Analytics setups unlawful, until a new EU-US Data Privacy Framework restored transfers in 2023.
Apps must disclose the data they collect and use for tracking
Every new app and app update had to publish a privacy "nutrition label" on its App Store page, listing the data it collects and whether that data is used to track users. The labels are self-reported, but they put tracking in front of users before they install an app.
No email-based or other cross-site IDs in Google's ad products once cookies go
Google said that once third-party cookies were phased out, it wouldn't build alternative identifiers to track people as they browse across the web, or use them in its ad products. Its web ads would rely on the Privacy Sandbox instead, alongside advertisers' first-party data.
Cross-app tracking and the IDFA need opt-in consent
From April 26, 2021, every app had to show a system prompt before tracking users across other companies' apps and websites. Without consent, the IDFA returns zeros. Apple pointed advertisers to SKAdNetwork, its own attribution framework, which reports installs in aggregate and after a delay. Meta later told investors the change would cost it about $10 billion in 2022 revenue.
Third-party cookies get a reprieve until late 2023
Google pushed the end of third-party cookies in Chrome back by almost two years, to a three-month phase-out from mid to late 2023, saying the industry needed more time to test the Privacy Sandbox replacements. It was the first of three delays.
Email opens and IP addresses hidden
Mail Privacy Protection stops senders from learning whether or when an email was opened, and hides the reader's IP address. iCloud Private Relay, for paying iCloud+ subscribers, hides IP addresses in Safari. Hide My Email hands out random forwarding addresses, which weakens email as a matching key.
Interest-based ads to come from browser-assigned topics
Google dropped FLoC, its first proposal for interest-based advertising without third-party cookies, after criticism that it created a new fingerprinting surface. Its replacement, Topics, had the browser assign a few broad interest topics from recent browsing and share them with sites.
Chrome cookie changes put under competition oversight
The UK Competition and Markets Authority accepted legally binding commitments from Google on how it would develop and remove third-party cookies in Chrome, including not favouring its own ad products. Every later change to the Chrome timeline happened under this oversight.
Plan to limit sharing data with third parties, including the Advertising ID
Google announced a multi-year plan to bring the Privacy Sandbox to Android, with new advertising APIs designed to limit sharing user data with third parties and to work without cross-app identifiers, including the Advertising ID. Unlike Apple, Google promised to support existing ad features for at least two years while the alternatives were built.
Opted-out users return a string of zeros, as on iOS since 2016
When a user deletes their Advertising ID, apps now receive a string of zeros instead of the identifier. The change reached Android 12 from late 2021 and all devices with Google Play from April 1, 2022. Apps targeting Android 13 must also declare a permission to read the ID at all.
Every site's cookies kept in a separate jar
Mozilla turned on Total Cookie Protection for all Firefox users worldwide, giving each website its own cookie jar. Third-party cookies still work within a site but can no longer follow a user from one site to another.
Phase-out moved to the second half of 2024
Google delayed again, saying it would begin phasing out third-party cookies in the second half of 2024 and expand testing of the Privacy Sandbox APIs first.
Some aggregate signal returned: three postbacks over 35 days
Advertisers could now receive up to three postbacks per install, covering up to 35 days. How much detail each one carries depends on "crowd anonymity": small campaigns get coarse low, medium or high values, and large ones get more. It gave back some signal while staying aggregated and delayed.
Pixels on health sites became a legal risk, and Washington made health data opt-in
US health regulators warned that tracking pixels on hospital and clinic websites could breach federal health privacy law, and a court later narrowed that warning for public pages. The FTC acted against a health app that shared users' data with advertisers, and Washington state now requires consent for collecting and sharing consumer health data.
Every Google Analytics user moved to a new data model, and old data was deleted a year later
Universal Analytics stopped processing data on July 1, 2023, and Google Analytics 4 became the only version for most sites. GA4 counts everything as an event, defines users and sessions differently, doesn't store IP addresses and withholds some small numbers, so reports before and after the switch don't line up.
Cookie-free targeting and measurement APIs on by default for most Chrome users
Google said the Privacy Sandbox's targeting and measurement APIs, including Topics, Protected Audience and Attribution Reporting, were generally available in Chrome, switched on by default for most users after a rollout that began in July 2023. They were meant to replace what third-party cookies did for advertising.
Click IDs stripped in Messages, Mail and Private Browsing
iOS 17 strips known tracking parameters, such as ad click IDs, from links shared in Messages and Mail and from links opened in Safari Private Browsing. Normal Safari tabs are untouched unless the user opts in. Apple does not publish the parameter list, and campaign-level UTM tags are generally reported as kept.
Tracking that identifies, locates or profiles people must stay off until they turn it on
Quebec's Law 25 requires businesses to tell people before using technology that can identify, locate or profile them, and to explain how to activate it. Quebec's privacy regulator reads this as requiring advertising cookies to be off by default, with express consent for each purpose.
Third-party cookies restricted for 1% of Chrome users
Google began testing Tracking Protection, restricting third-party cookies by default for 1% of Chrome users worldwide. It was billed as the first step to phasing them out for everyone in the second half of 2024, subject to the UK regulator's concerns.
Platforms can't target minors with profiling ads, or anyone using sensitive data
The EU's Digital Services Act began applying to all online platforms with users in the EU. It bans ads based on profiling for minors and ads targeted using sensitive data such as religion or sexual orientation, and requires platforms to show users why they see an ad and who paid for it.
Apple's attribution framework extended beyond the App Store
AdAttributionKit launched with iOS 17.4, the release that opened EU iPhones to alternative app marketplaces, and it measures installs from those stores as well as the App Store. At WWDC24 Apple folded SKAdNetwork and its web equivalent, Private Click Measurement, under the new name. Re-engagement measurement followed in iOS 18.
EEA ad measurement and personalization need consent signals
Ahead of the EU's Digital Markets Act, Google required advertisers measuring or personalizing ads for users in the European Economic Area to pass consent signals through Consent Mode v2, including the new ad_user_data and ad_personalization parameters. Without them, conversion measurement and remarketing for those users are limited.
Phase-out moved from late 2024 to 2025
Google said it would not finish removing third-party cookies in late 2024, citing divergent feedback from the industry and regulators and the UK competition regulator's need to review test results. It planned to start in early 2025; three months later it dropped the plan.
Fingerprinting APIs and tracking domains must be declared
Announced at WWDC 2023 and enforced from May 1, 2024. Apps and third-party SDKs must declare the data they collect, the tracking domains they contact, and an approved reason for using any API that could support fingerprinting. iOS blocks connections to declared tracking domains when the user has not granted permission.
Cookie phase-out dropped in favour of a proposed user choice
After four years and three delays, Google said it would no longer phase out third-party cookies. Instead it proposed letting people make an informed choice across their browsing that they could change at any time. For advertisers, Chrome remained the one major browser where third-party cookies work by default.
Targeted ads using children's data need a parent's separate opt-in
The FTC finalized the first major update to its children's privacy rule since 2013. Sharing children's personal information with third parties for targeted advertising now needs separate, specific opt-in consent from a parent, and operators must limit how long they keep children's data. Most companies had to comply by April 22, 2026.
Advertisers on Google's platforms no longer barred from fingerprinting devices
Google's ad platform policies stopped prohibiting fingerprinting, which recognizes a device from details of its software and hardware rather than a cookie. Google said privacy-enhancing technologies and ads on connected TVs and consoles justified the change; the UK's data protection regulator called it irresponsible.
First competition ruling against how the prompt was implemented
France's competition authority found that Apple abused a dominant position through the way it implemented the prompt between April 2021 and July 2023. It said the goal was legitimate but the implementation was neither necessary nor proportionate, and that Apple treated its own apps more lightly than other publishers. This is a ruling, not an iOS change, but it shapes how every later step is read.
Google keeps its ad exchange but must open its auctions to rivals
A US federal court found that Google illegally monopolized publisher ad servers and ad exchanges for open-web display ads. The EU fined Google €2.95 billion over the same conduct. In 2026 the US judge declined to break Google up and ordered rules on how its auctions work instead.
Third-party cookies stay on by default, with no new prompt
Google said it would not roll out a standalone prompt asking Chrome users about third-party cookies. People keep the existing setting in Chrome, and third-party cookies stay on by default.
Facebook and Instagram users in the EU can choose free, less personalized ads
The European Commission fined Meta €200 million because its choice between personalized ads and a paid subscription didn't offer a free option that uses less personal data, as the Digital Markets Act requires. Meta's "less personalized ads" option, revised in January 2026, now reaches part of every EU audience.
Chrome's cookie and tracking policy stays Google's call
After finding that Google held an illegal monopoly in search, a US judge declined to make it sell Chrome. He barred exclusive default deals and ordered some search data shared with rivals instead. Both sides have appealed, and the government still seeks a sale.
Known fingerprinting scripts blinded in every Safari tab
Advanced fingerprinting protection, previously limited to Private Browsing, became the default in every Safari tab. Scripts that Apple classifies as fingerprinters can no longer read device characteristics such as screen size, set long-lived storage, or read query parameters. Apple has not documented removing click IDs from URLs in normal tabs.
Topics, Protected Audience and Attribution Reporting retired
Google retired most Privacy Sandbox technologies on Chrome and Android, including the Topics API, Protected Audience, the Attribution Reporting API, IP Protection and the SDK Runtime. The same day, the UK Competition and Markets Authority released Google from its 2022 commitments. Six years after the plan to replace third-party cookies, Chrome kept the cookies and dropped most of the replacements.
Basic analytics no longer needs opt-in consent in the UK; advertising cookies still do
The UK's Data (Use and Access) Act added exceptions to the consent rule for cookies and similar technologies, covering analytics used only to improve a service and settings that remember a user's preferences. Advertising still needs consent, and the maximum fine for breaking the rules rose to UK GDPR levels.
Requests to listed ad tech domains refused
iOS 27, released on September 14, 2026, makes Safari and every other iPhone browser refuse requests to a list of ad tech and identity domains. Apple has since removed The Trade Desk's ad delivery domain in the iOS 27.2 beta, but identity vendors remain blocked, and reports say a remotely updated list could cover hundreds of companies.
Read as a whole, the timeline is the story of two companies answering the same question in opposite ways. Apple decided tracking should stop and used its operating system to stop it. Google said the same, spent six years building replacements, and kept the cookies. The practical picture for each is on the Apple in focus and Google in focus pages; this is the shape of the whole.
Apple moved from a preference signal in 2012 to a technical opt-out in 2016, default restrictions from 2017, a permission prompt in 2021 and a block list in 2026. Each step moved the decision further from advertisers. Google announced the end of third-party cookies in 2020, delayed it three times, kept them and retired most of what it built to replace them. Only on Android did it follow Apple closely, zeroing the Advertising ID for users who delete it.
Third-party cookies gave way to first-party cookies and CNAME cloaking, then link decoration, fingerprinting and shared identity domains, and Apple restricted each in turn. Any technique built to restore user-level tracking should be assumed to have a limited life in Safari. In Chrome the opposite happened: Google lifted its own ban on fingerprinting in its ad platforms in 2025.
The replacements share a design: delayed, grouped, partly noised reports instead of user-level data. Apple's SKAdNetwork and AdAttributionKit, Google's Attribution Reporting, and the W3C's draft attribution standard all work this way, as does the modelling behind Consent Mode in Europe. Measuring well now depends on first-party data, modelling and incrementality testing, not identifiers.
The UK's competition regulator oversaw every step of Chrome's cookie plan, and its testing found publishers would lose revenue even with Google's replacements. France fined Apple over how it implemented App Tracking Transparency, and Italy and Germany followed. Privacy law pushed the same way: GDPR and its consent rules apply whatever a browser allows, and an EU court ruling put US analytics tools in doubt for three years. The EU's Digital Markets Act made Meta offer less personalized ads, and courts in the US and the EU found Google abused its control of ad tech. Rules for particular audiences went further still: the EU banned profiling ads to minors, the US tightened consent for children's data, and US regulators targeted pixels on health sites. The rules don't all point one way: Quebec made tracking opt-in, while the UK let basic analytics run without consent.
Oxford researchers found that App Tracking Transparency stopped apps collecting the IDFA, but the number of tracking libraries in apps stayed roughly the same, as the ATT article describes. And the gap between platforms keeps widening: iPhone users are among the hardest to track on the web, while Chrome on desktop and Android remains the easiest.
Earlier rules restricted techniques, so any company could comply by changing its methods. The iOS 27 block list restricts named companies, with criteria Apple hasn't published, and The Trade Desk's bug report includes a session where its bids were blocked while Google's went through. That asymmetry is what competition authorities will examine.
Bconic combines attribution, incrementality and marketing mix modelling, so you can see what your marketing drives on every platform, whatever changes next.
