3rd-party cookies: which third-party domains your tracking sets

The check lists script, pixel and iframe sources from advertising and tracking vendors that set third-party cookies on your page. Safari and Firefox have blocked them for years.

What we check

The check reads every script, image and iframe source in the delivered HTML and keeps those whose host belongs to an advertising or tracking vendor that typically sets third-party cookies: DoubleClick, Google Ads, Meta, LinkedIn, TikTok, Hotjar, HubSpot, Intercom, Criteo, Taboola, Outbrain and X. Your own subdomains do not count. Neither does googletagmanager.com, because the container sets no cookies itself.

What the scan cannot see: the cookies themselves. Cross-site cookies cannot be read from a server fetch. The check is an inventory of sources. Whether those cookies get set before consent is what the deep scan shows in the module Cookies & scripts before / after consent.

Why it matters

Safari (ITP) and Firefox (ETP) have blocked third-party cookies by default for years. Chrome withdrew its planned phase-out in 2025 in favour of user choice, which changes nothing about the finding: a setup whose attribution depends on third-party cookies measures fragments in a large share of browsers, and the gap grows with every browser update. How attribution works without those cookies is covered in the guide to cookieless attribution.

Common causes

Old retargeting and ad pixels from past campaigns keep setting cross-domain cookies.
Embedded iframes (YouTube, Maps, social widgets) simply bring their third-party cookies along.
Affiliate and attribution services still work on a third-party basis instead of a first-party subdomain.
A forgotten chat or personalisation widget loads tracking from third-party domains.

The fix

Assign every listed domain a purpose and remove dead pixels. Move what remains to first-party: measurement through your own endpoint (server-side tagging), attribution through conversion APIs instead of browser cookies. Switch embeds such as YouTube to the nocookie domain or load them only after a click.

Matching template

CMP and GTM Consent QA Template

The repeatable test plan for default-denied, consent update and reject, across all four signals.

Get the QA template →

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Asked often

Why is googletagmanager.com not in the list?

The tag manager sets no cookies itself; the cookies come from the tags it loads. Since September 2026 the check only counts hosts that actually set advertising or tracking cookies: Meta, LinkedIn, TikTok, Hotjar, HubSpot, Google Ads, Criteo and the like.

Chrome cancelled the phase-out, is the topic closed?

No. Chrome keeps serving third-party cookies, Safari and Firefox have blocked them by default for years. For those visitors a purely cookie-based setup measures fragments, and their share depends on your audience, not on your setup.

What replaces third-party cookies?

First-party data through your own endpoint (server-side tagging) and server-side conversion APIs such as Meta CAPI and Google Enhanced Conversions. The cookies then live on your domain and attribution runs on server-to-server events.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint