First-party vs third-party data statistics at a glance
| Category | Statistic | Source |
|---|---|---|
| Browsers | 18.8% of worldwide page views are on Safari or Firefox, which block or partition third-party cookies by default (Aug 2026) | Statcounter, 2026 (computed) |
| Browsers | Chrome holds 69.39% of worldwide browser share and still allows third-party cookies by default | Statcounter, Aug 2026 |
| Chrome | Google pledged in January 2020 to make third-party cookies obsolete within two years | Chromium Blog, Jan 2020 |
| Chrome | Google dropped deprecation for a user-choice approach on 22 July 2024, then ruled out a standalone prompt on 22 April 2025 | Google Privacy Sandbox, 2025 |
| Chrome | Google retired 10 Privacy Sandbox technologies on 17 October 2025, citing low levels of adoption | Google Privacy Sandbox, Oct 2025 |
| Mobile | 40% of iOS users who see the ATT prompt opt in; about 30% on a broader base | AppsFlyer, Nov 2025 |
| Mobile | Meta estimated the iOS privacy changes as a $10 billion headwind for 2022 | Meta Q4 2021 earnings call, Feb 2022 |
| Marketers | 71% of brands, agencies and publishers are growing first-party datasets, up from 41% two years earlier | IAB State of Data, Mar 2024 |
| Marketers | Only one in four marketers are satisfied with how they use data for personalisation | Salesforce State of Marketing, 2026 |
| ROI | Brands running all four advanced first-party data activations saw 2.9x higher revenue uplift | BCG with Google, May 2020 |
| Consumers | 75% of consumers won't buy from organisations they don't trust with their data | Cisco Consumer Privacy Survey, 2024 |
| Regulation | 3,275 GDPR fines totalling €7.16 billion recorded as of 24 September 2026 | CMS Enforcement Tracker, Sep 2026 |
| Regulation | European regulators issued about €1.2 billion in GDPR fines in 2025, roughly €3.3 million a day | DLA Piper, Jan 2026 (computed) |
What is the difference between first-party, second-party, third-party and zero-party data?
The four data types differ by who collected the data and whether the person knew who they were giving it to. Here is one liftable sentence for each:
- First-party data is information a company collects directly from its own customers and visitors, on its own website, app, CRM or point of sale.
- Second-party data is another company's first-party data, shared directly with you under an agreement, such as a retailer sharing audience segments with a brand partner.
- Third-party data is information gathered by an organisation with no direct relationship to the person, usually through cookies, device IDs or brokers, then aggregated and sold.
- Zero-party data is information a customer deliberately and proactively gives a brand, such as preferences, purchase intentions or quiz answers.
The practical line that matters in 2026 is consent and collection context. Browsers and operating systems target third-party collection because the person never dealt with the collector. First-party and zero-party data sit inside a relationship the customer chose, which is why regulators and platforms treat them differently. Second-party data inherits whatever consent the original collector obtained, and that's where most audits find problems.
The definitions matter for statistics because reports blur them. The IAB, for example, asks about "first-party datasets" without separating what customers volunteered from what a site observed. Before you put two reports on the same chart, check which definition each one used. A figure about first-party data adoption can mean a newsletter list in one survey and a full customer data platform in another.
I've watched teams relabel bought audiences as "second-party" to make them feel safer. The label doesn't change the consent. If you can't show where the person agreed and to whom, treat the data as third-party, because that's how a regulator will read it.
What happened to third-party cookies in Chrome?
Google Chrome still supports third-party cookies as of September 2026: Google announced a phase-out in January 2020, delayed it three times, replaced it with a user-choice proposal in July 2024 and retired 10 Privacy Sandbox technologies, including Topics and Protected Audience, in October 2025. Every date below comes from Google's own posts or the UK Competition and Markets Authority (CMA).
| Date | What Google or the regulator said | Source |
|---|---|---|
| 14 Jan 2020 | Chrome plans to make third-party cookies obsolete; "Our intention is to do this within two years." | Chromium Blog, 2020 |
| 24 Jun 2021 | Phase-out moved to a three-month window from mid-2023 to late 2023. | Google, June 2021 |
| 27 Jul 2022 | Phase-out moved again, to begin in the second half of 2024. | Google, July 2022 |
| 14 Dec 2023 | Chrome announces it will restrict third-party cookies for 1% of users, starting 4 January 2024. | Google, Dec 2023 |
| 23 Apr 2024 | Google says it will not complete deprecation during the second half of Q4 2024 and, if it reaches agreement with the CMA, envisions starting early 2025. | Privacy Sandbox, Apr 2024 |
| 22 Jul 2024 | Google proposes a Chrome experience that lets people make an informed choice, instead of deprecating third-party cookies. | Privacy Sandbox, July 2024 |
| 22 Apr 2025 | Google keeps its current third-party cookie choice in Chrome settings and will not roll out a new standalone prompt. | Privacy Sandbox, Apr 2025 |
| 17 Oct 2025 | Google retires 10 named Privacy Sandbox technologies, including Topics, Protected Audience and the Attribution Reporting API, citing low levels of adoption. CHIPS, FedCM and Private State Tokens stay. | Privacy Sandbox, Oct 2025 |
| 17 Oct 2025 | The CMA issues its decision to release Google's Privacy Sandbox commitments, finding its competition concerns no longer arise. | UK CMA case page, Oct 2025 |
Google set three firm deadlines (within two years of January 2020, late 2023 and the second half of 2024), added a conditional early-2025 target in April 2024, and met none of them. From the first pledge on 14 January 2020 to the retirement of 10 Privacy Sandbox technologies on 17 October 2025 is 2,103 days. The 1% test that began on 4 January 2024 is the only step in which Chrome restricted third-party cookies by default for real users.
The regulatory thread explains part of the delay. Google's April 2025 post dates its formal engagement with the CMA to 2022, which meant the UK regulator reviewed each step, and the CMA only released Google's commitments on 17 October 2025, after Google confirmed it would neither deprecate cookies nor show a standalone prompt. That April 2025 post also cited divergent perspectives across the industry on changes affecting third-party cookies. What survives, CHIPS and FedCM, are narrow tools for partitioned cookies and sign-in, not a replacement for cross-site ad targeting.
The lesson isn't that Google changed its mind. It's that the plan was hostage to advertisers and one regulator for five years, and anyone who rebuilt their stack on a Chrome deadline paid for it. I'd plan on the assumption that Chrome's cookie policy can change again, and build measurement that works either way.
That's the desktop story. The next question is how much traffic already lives outside Chrome's rules.
How much web browsing already blocks third-party cookies?
Safari and Firefox together carried 18.8% of worldwide browser market share in August 2026, a Statcounter measure of page views rather than people, and both block or partition third-party cookies by default. Roughly one in five web page views is already cookieless for cross-site tracking.
| Statistic | Source |
|---|---|
| Chrome held 69.39% of worldwide browser market share in August 2026, across all platforms. | Statcounter, Aug 2026 |
| Safari held 15.83% of worldwide browser market share in August 2026. | Statcounter, Aug 2026 |
| Firefox held 2.98% and Edge 5.36% in August 2026. | Statcounter, Aug 2026 |
| WebKit, the engine behind Safari, announced on 24 March 2020 that cookies for cross-site resources are blocked by default across the board. | WebKit, March 2020 |
| Mozilla rolled out Total Cookie Protection by default to all Firefox users worldwide in June 2022, confining each site's cookies to that site. | Mozilla, June 2022 |
| Safari plus Firefox equal 18.81% of worldwide page views; Chrome's 69.39% is 3.7 times that share. | Statcounter, 2026 (computed) |
The 18.8% figure is a floor for your own site, not a ceiling. Statcounter's share is a worldwide average of page views across all devices, not a count of users, and Safari's share runs far higher on mobile and in markets where iPhones dominate, such as the US, UK and Nordics. Check your own analytics: a B2C brand with heavy iPhone traffic can easily see a third or more of sessions arrive from Safari. Edge isn't counted here because its default tracking prevention blocks known trackers, not every third-party cookie; Samsung Internet (2.01%) is left out for the same caution.
Timing matters too. Safari has blocked cross-site cookies by default since March 2020 and Firefox has partitioned them for every user since June 2022, so the 18.8% isn't new. It has been eroding retargeting and view-through reports for four to six years. What changed in 2024 is that Chrome's reversal removed the deadline that forced teams to deal with it. The Safari gap is still there; it just stopped making headlines.
Everyone argues about Chrome. The number I'd put on a slide is your own Safari share, because that's the traffic where third-party retargeting and view-through attribution already fail today. If it's above 30%, your multi-touch reports are quietly missing a third of the journey.
If you're rebuilding measurement for that gap, the marketing attribution statistics page covers how models and budgets have shifted. Mobile apps followed a different path, and a harsher one.
How are marketers shifting from third-party to first-party data?
The IAB's 2024 State of Data survey found 71% of brands, agencies and publishers growing their first-party datasets, nearly double the 41% of two years earlier, and the IAB's March 2025 edition found a quarter to a third of agencies and brands filling lost signal with synthetic data.
| Statistic | Source |
|---|---|
| 95% of advertising and data decision-makers at brands, agencies and publishers expect continued signal loss and/or privacy legislation in 2024 and beyond, in a survey of 500+ experts. | IAB State of Data, March 2024 |
| 71% of brands, agencies and publishers are currently growing or planning to grow their first-party datasets, up from 41% two years earlier. | IAB, March 2024 |
| One quarter to one third of agencies and brands use generative AI to build audience segments with synthetic data, filling gaps where data signals are no longer available (base: 352 agencies and brands). | IAB State of Data 2025, March 2025 |
| More than half of 529 agency, brand and publisher respondents name data privacy and protection protocols as the most valuable AI industry standard. | IAB State of Data 2025, March 2025 |
| 83% of marketers recognise the shift toward personalised, two-way messaging, but only one in four are satisfied with how they use data to power it, from nearly 4,500 marketers. | Salesforce State of Marketing, 10th edition, 2026 |
| 72% of companies use a customer data platform (CDP) for personalisation and 48% use a data warehouse, from 521 business leaders in 12 countries surveyed April to May 2024. | Twilio Segment State of Personalization, June 2024 |
The IAB 2024 figures are older than 24 months, so cite them as dated. Read next to the 2025 edition, they show a sequence: first the industry grew first-party datasets, then it started generating synthetic audiences where real signal ran out. The 2026 Salesforce number is the uncomfortable follow-up. Years of CDP purchases later, three in four marketers still aren't happy with how they use the data they own.
The Twilio Segment figures, from June 2024 and so also dated, give the tooling view: 72% of companies in that survey use a CDP for personalisation and 48% use a data warehouse. Tool adoption at that level makes the satisfaction gap hard to blame on missing software.
Collecting first-party data was never the hard part. Joining it up is. A CDP licence doesn't fix a CRM full of duplicate contacts and a website that forgets people between sessions, and that's where most of the "first-party strategy" budget quietly stalls.
Whether owned data pays back is the question buyers ask next, and the most quoted answer is also the most misquoted.
Does first-party data deliver higher revenue than third-party data?
The best-known evidence, a BCG study with Google, found that brands using all four advanced first-party data activations achieved 2.9 times the revenue uplift of brands using none, across 160+ Asia Pacific brands surveyed in 2019.
| Statistic | Source |
|---|---|
| Brands deploying all four advanced first-party data activations achieved 2.9x higher revenue uplift than brands deploying none; brands with at least one activation achieved 1.5x. Both multiples measure revenue, not cost. | BCG with Google, Responsible Marketing with First-Party Data, May 2020 |
| Digitally mature brands personalising with first-party data averaged 11% annual incremental revenue uplift and 18% cost efficiency, which BCG sized at more than $200 billion across Asia Pacific. The study covered 160+ brands in 10 industries and 10 markets. | BCG with Google, May 2020 |
| Only about 30% of companies create a unified customer view across channels, and 1% to 2% deliver a full cross-channel customer experience, from interviews with 23 companies and seven agencies in North America. | BCG, March 2021 |
Here's the myth check. Roundups routinely quote this study as "2.9x revenue uplift and 1.5x cost savings". The PDF says something different: 1.5x and 2.9x are both revenue multiples, for brands running at least one and all four activations respectively, and they're relative to brands running none. The cost figure is 18% efficiency, a separate number. All three studies here are also older than 24 months and rest on surveys and interviews, not controlled experiments.
I'd use the BCG numbers to argue for sequencing, not for a business case. The gap between one activation and four is where the value sits, and BCG's own 2021 finding that only 1% to 2% of companies run a full cross-channel experience tells you how few ever get there. Build the first activation well before you buy the platform for the fourth.
For the related problem of revenue you can't trace at all, see the dark funnel statistics. The other side of the value equation is whether customers want to hand the data over.
How do consumers feel about companies using their data?
Pew Research Center found in 2023 that 67% of US adults understand little to nothing about what companies do with their personal data, and Cisco's 2024 survey found 75% of consumers won't buy from organisations they don't trust with their data.
| Statistic | Source |
|---|---|
| 67% of US adults say they understand little to nothing about what companies are doing with their personal data; 73% feel they have little or no control over it. Sample: 5,101 US adults, fielded 15 to 21 May 2023. | Pew Research Center, October 2023 |
| 75% of consumers say they will not purchase from organisations they don't trust with their data, from 2,600+ consumers in 12 countries. | Cisco Consumer Privacy Survey, 2024 |
| 53% of consumers are aware of their country's privacy laws, the first time a majority said so since Cisco began the survey in 2019. | Cisco, 2024 |
| 81% of consumers who know their country's privacy laws feel their data is protected, against 44% of those who don't. | Cisco newsroom, October 2024 |
| 49% of consumers aged 25 to 34 have switched companies over data policies, against 18% of those aged 75 and over. | Cisco newsroom, October 2024 |
| 70% of consumers believe privacy laws have a positive impact. | Cisco newsroom, October 2024 |
| 59% of consumers say strong privacy laws make them more comfortable sharing information in AI applications. | Cisco newsroom, October 2024 |
| 67% of consumers reviewed or updated their privacy settings in the past 12 months. | Cisco newsroom, October 2024 |
The Pew numbers are three years old and US-only, so mark them DATED when you cite them; Pew hasn't repeated the survey since. Put Pew and Cisco side by side and you get a paradox marketers live with daily: people say trust decides where they buy, yet two in three Americans say they understand little about what companies do with their data. Consent collected from people who don't understand it is legally thin and commercially fragile.
Cisco's 53% awareness figure cuts both ways. More consumers now know they have rights, which raises the cost of a sloppy consent flow. Cisco's October 2024 survey also found that 81% of consumers who know their privacy laws feel their data is protected, against 44% of those who don't, so a brand that explains what it collects and why gets a fairer hearing than one hiding behind a banner. Younger buyers act on it: 49% of 25 to 34 year olds have switched companies over data policies.
A customer who doesn't understand what you collect isn't giving you permission; they're giving you a liability that stays quiet until a regulator or a journalist reads the policy for them. Zero-party data works because the customer knows exactly what they handed over and why.
Regulators have started pricing that liability, and the numbers are large enough to show up in board papers.
How much have regulators fined companies under GDPR?
The CMS Enforcement Tracker recorded 3,275 GDPR fines totalling €7,159,322,834 across 32 countries as of 24 September 2026. DLA Piper's January 2026 survey counted €7.1 billion to 10 January 2026, with about €1.2 billion issued in 2025 alone.
| Statistic | Source |
|---|---|
| 3,275 GDPR fines totalling €7.16 billion across 32 countries, counted as of 24 September 2026. Spain leads by number of cases with 1,079. | CMS Enforcement Tracker, September 2026 |
| The largest single GDPR fine remains €1.2 billion, imposed on Meta Platforms Ireland on 12 May 2023. | CMS Enforcement Tracker, September 2026 |
| Total GDPR fines from 25 May 2018 to 10 January 2026 reached €7.1 billion; supervisory authorities issued about €1.2 billion in 2025, broadly matching 2024. | DLA Piper GDPR Fines and Data Breach Survey, January 2026 |
| Personal data breach notifications averaged 443 per day between 28 January 2025 and 27 January 2026, up 22% from 363. | DLA Piper, January 2026 |
| Ireland's data protection authority has imposed €4.04 billion in aggregate GDPR fines since May 2018. | DLA Piper, January 2026 |
The two totals differ slightly because the CMS tracker counts publicly reported fines up to its daily update, while DLA Piper surveys supervisory authorities up to a fixed cutoff. Always cite a GDPR total with the date of the count. Ireland alone accounts for €4.04 billion of DLA Piper's €7.1 billion, because the largest tech platforms have their EU headquarters there. Spain, by contrast, issues the most fines, most of them small.
The breach figure deserves as much attention as the fines. DLA Piper counted 443 notifications a day, the first time the daily average has passed 400 since 2018. Many of those notifications involve first-party customer records, which is the risk side of the first-party data push that vendor decks tend to leave out.
Headline fines hit platforms, but the Spanish case count is the one mid-sized companies should read. Regulators there fine ordinary businesses for cookie banners and marketing consent every week. If your third-party data can't show a consent trail, the risk isn't theoretical and it isn't only Meta's problem.
The arithmetic behind the four computed numbers on this page follows.
How we calculated the original numbers
Four figures on this page don't appear in any source. Here's the arithmetic, so you can check it or swap in your own inputs.
- 18.8% of worldwide page views happen on browsers that block or partition third-party cookies by default. Statcounter measures share of page views, not people, so summing two browsers' shares gives a share of page views. Its August 2026 worldwide share gives Safari 15.83% and Firefox 2.98%. 15.83 + 2.98 = 18.81%. Chrome's 69.39% divided by 18.81 is 3.7, so Chrome traffic that still allows third-party cookies outweighs default-blocking traffic by 3.7 to 1. Edge (5.36%) and smaller browsers such as Brave are excluded, which makes this a conservative figure.
- 57% to 60% of the trackable iOS base lost to ATT. AppsFlyer reports that Limit Ad Tracking rates on iOS 14 and earlier ranged between 25% and 30%, so 70% to 75% of iOS users were trackable by default. AppsFlyer's broad post-ATT opt-in rate is about 30%. 1 − 30/70 = 57%; 1 − 30/75 = 60%. All inputs come from the same AppsFlyer article, and both the baseline and the 30% use the same denominator, all iOS users in AppsFlyer's measured apps, including those who never see the prompt. AppsFlyer discloses no sample size or period for either figure. The result sits close to 100% minus the 40% prompt opt-in rate, which is a useful sanity check.
- 2,103 days from pledge to retirement. Google announced its plan to make third-party cookies obsolete on 14 January 2020 and, on 17 October 2025, retired 10 named Privacy Sandbox technologies while keeping CHIPS, FedCM and Private State Tokens. The gap is 2,103 days, about five years and nine months. The gap to the 22 July 2024 reversal is 1,651 days. Over that period Google published three firm deadlines (early 2022, late 2023, second half of 2024) plus a conditional early-2025 target, and met none.
- €3.3 million a day in GDPR fines. DLA Piper counts about €1.2 billion in fines issued in 2025. €1.2 billion divided by 365 days is €3.29 million a day.
What the 2026 numbers say
The cookie didn't die, it got fragmented. Chrome kept third-party cookies, Safari and Firefox kept blocking them, and iOS apps lost more than half their trackable users to ATT. Any strategy built on one universal rule will be wrong for a large slice of your traffic. Segment your measurement by browser and platform before you decide what to rebuild.
First-party data is a joining problem, not a collection problem. IAB's 71% shows intent. Salesforce's 2026 one-in-four satisfaction rate and BCG's 1% to 2% full cross-channel figure show how far execution lags. The revenue uplift in the BCG study came from running several activations together, and very few companies do.
Consent is now priced. €7.16 billion in fines, €3.3 million a day in 2025 and 443 breach notifications a day make weak consent a financial risk. Zero-party and first-party data carry that risk better because the customer knows who holds it. For more benchmarks on measurement and data, browse the full statistics hub.
FAQ
Are third-party cookies still used in Chrome in 2026?
Yes. Chrome still allows third-party cookies by default as of September 2026, according to Google's Privacy Sandbox posts. Google replaced its deprecation plan with a user-choice approach on 22 July 2024, ruled out a standalone prompt on 22 April 2025 and retired 10 Privacy Sandbox technologies on 17 October 2025. Users can still block third-party cookies in Chrome settings.
What percentage of browsing blocks third-party cookies by default?
18.8% of worldwide page views in August 2026, computed from Statcounter's browser market share: Safari at 15.83% plus Firefox at 2.98%. Both block or partition third-party cookies by default. The share is higher on mobile and in iPhone-heavy markets.
What is the ATT opt-in rate on iOS?
40% of users who see the App Tracking Transparency prompt opt in, according to AppsFlyer (November 2025), and about 30% when system-level restrictions are included. Rates vary by vendor and method, and prompt timing moves them from 36% to 45%, so compare figures only within one vendor's methodology.
Does first-party data increase revenue?
Brands running all four advanced first-party data activations saw 2.9 times the revenue uplift of brands running none, in BCG and Google's study of 160+ Asia Pacific brands (published May 2020). Brands with at least one activation saw 1.5 times. Both are revenue multiples, often misquoted as cost savings.
How much have GDPR fines totalled so far?
€7.16 billion across 3,275 fines as of 24 September 2026, according to the CMS Enforcement Tracker. DLA Piper counted €7.1 billion up to 10 January 2026, including about €1.2 billion issued in 2025. The largest single fine is €1.2 billion against Meta in May 2023.
What is the difference between first-party and third-party data?
First-party data is collected directly by a company from its own customers; third-party data is collected by someone with no direct relationship and then sold. The difference matters because 18.8% of page views (Statcounter, 2026, computed) and most iOS apps already block third-party collection by default, while first-party collection keeps working.
Sources
- Chromium Blog, Building a more private web: A path towards making third party cookies obsolete (January 2020)
- Google, An updated timeline for Privacy Sandbox milestones (June 2021)
- Google, Expanding testing for the Privacy Sandbox for the web (July 2022)
- Google, The next step toward phasing out third-party cookies in Chrome (December 2023)
- Google Privacy Sandbox, Update on the plan for phase-out of third-party cookies on Chrome (April 2024)
- Google Privacy Sandbox, A new path for Privacy Sandbox on the web (July 2024)
- Google Privacy Sandbox, Next steps for Privacy Sandbox and tracking protections in Chrome (April 2025)
- Google Privacy Sandbox, Update on plans for Privacy Sandbox technologies (October 2025)
- UK Competition and Markets Authority, Investigation into Google's Privacy Sandbox browser changes (October 2025)
- Statcounter, Browser Market Share Worldwide (August 2026)
- WebKit, Full Third-Party Cookie Blocking and More (March 2020)
- Mozilla, Firefox rolls out Total Cookie Protection by default to all users worldwide (June 2022)
- Apple Newsroom, iOS 14.5 offers Unlock iPhone with Apple Watch, diverse Siri voices and more (April 2021)
- AppsFlyer, Redefining ATT opt-in measurement for data accuracy (updated November 2025)
- AppsFlyer, Mobile ad market thrives four years after ATT (April 2025)
- Meta, Q4 2021 Earnings Call Transcript (February 2022)
- IAB, State of Data 2024 press release (March 2024)
- IAB, State of Data 2025: The Now, The Near, and The Next Evolution of AI for Media Campaigns (March 2025)
- Salesforce, State of Marketing Report: Tenth Edition (2026)
- Twilio Segment, State of Personalization 2024 press release (June 2024)
- BCG with Google, Responsible Marketing with First-Party Data: A $200 Billion Value Unlock Opportunity in Asia Pacific (May 2020)
- BCG, Delivering on the Promise of First-Party Data (March 2021)
- Pew Research Center, How Americans View Data Privacy (October 2023)
- Cisco, 2024 Consumer Privacy Survey (2024)
- CMS, GDPR Enforcement Tracker (counted 24 September 2026)
- DLA Piper, GDPR Fines and Data Breach Survey: January 2026 (January 2026)
- Cisco, New Cisco Survey Shows Strong Relationship Between Privacy Awareness and Trust in AI (October 2024)
Methodology. Numbers were collected on 24 September 2026 and checked against the original publisher's page, PDF or transcript, not against other statistics roundups. Vendor claims without a stated sample or method were excluded, except where a vendor's own undisclosed figure sits next to its disclosed one to show the gap (AppsFlyer's 50% vs 40%). ATT opt-in rates are never averaged across vendors or methods. GDPR totals carry the date of the count. Figures older than 24 months are flagged as dated in the text. Last updated 24 September 2026.