Introduction

For years, Google framed Privacy Sandbox as the technology that would finally end third-party tracking, first on the web, then on Android too. The plan promised a future where advertisers could still measure and target ads without the kind of cross-app and cross-site tracking that had drawn years of regulatory scrutiny.

That future did not arrive the way it was pitched. As of October 2025, Google formally deprecated Privacy Sandbox on Android, and Chrome never actually removed third-party cookies either. This article walks through what the plan was supposed to do, what it actually shipped, and where things stand now.

What Privacy Sandbox Was Supposed to Do

Privacy Sandbox began as a browser initiative, first announced by Google in 2019 as a plan to phase out third-party cookies in Chrome while still supporting an ad-funded internet. The goal was to replace individual cross-site tracking with a set of new, privacy-preserving APIs that could handle things like interest-based advertising and conversion measurement without identifying a specific person across different websites.

Google extended the same philosophy to Android in February 2022, proposing a parallel set of tools for mobile apps. The idea was that app developers and advertisers relying on cross-app tracking would eventually need a privacy-preserving alternative, and Google wanted to build that alternative before regulators or platform competitors forced a messier transition.

Both efforts shared the same basic structure: replace a single, powerful tracking mechanism with narrower, purpose-built APIs that Google would control and audit, rather than simply blocking tracking outright and leaving advertisers with nothing.

Why “Cookies” Was Always the Wrong Word for Android

It is worth pausing on a detail that gets lost in most casual explanations of this topic. Android apps do not actually use browser cookies. Cookies are a web browser technology, tied to how websites and browsers communicate, and they simply do not exist inside a native mobile app the way they do inside Chrome or Safari.

What Android apps have relied on instead is the Advertising ID, a resettable identifier Google built into Android specifically so ad networks could track and target users across different apps without needing something more invasive like a device’s permanent hardware identifier. Privacy Sandbox on Android was really aimed at reducing reliance on that Advertising ID and on the software development kits, or SDKs, that apps use to share user data with ad networks.

So while “the end of third-party ad cookies” is a reasonable shorthand for the web side of this story, the Android chapter was always a separate, related effort focused on app-level tracking infrastructure rather than cookies themselves.

What Privacy Sandbox on Android Actually Built

Between 2022 and 2025, Google did ship real, testable technology under the Privacy Sandbox on Android name. The initiative moved through multiple Developer Preview and Beta releases, reaching public Android 14 devices with APIs like Protected Audience, which handled ad auctions on-device, and Attribution Reporting, which measured whether an ad led to a conversion without exposing individual user activity to advertisers.

Google also built an SDK Runtime, a sandboxed environment meant to isolate third-party advertising SDKs from the rest of an app, limiting how much data those SDKs could quietly collect. Alongside it came On-Device Personalization, aimed at letting some ad targeting happen locally on a user’s phone rather than by sending behavioral data back to a server.

Google explicitly promised, when it announced the initiative, that it would continue supporting existing ad platform features for at least two years while these new tools were built and tested, and that it would give the industry substantial notice before making any disruptive changes. That promise turned out to matter more than it seemed at the time.

The Reversal Nobody Expected

The clearest fact about Privacy Sandbox today is this: as of October 17, 2025, Google’s own developer documentation states plainly that Privacy Sandbox on Android is deprecated. That is not a delay or a pause. It is Google formally stepping back from the initiative it had spent roughly three years building.

The retirement was not limited to Android either. Google’s official update on the topic listed several specific technologies being retired across both Chrome and Android, including the Attribution Reporting API, IP Protection, and On-Device Personalization, citing low levels of adoption and ecosystem feedback about their expected value as the reasons.

Some individual components remain in some form, and Google has said it will retain documentation for retired features for reference. But the overall program, as originally pitched, no longer exists as an active roadmap Google is pushing the industry toward.

Why Google Pulled Back

Google’s own explanation centers on adoption. According to its update on Privacy Sandbox plans, many companies tested the new APIs, but usage of several key features never reached the scale needed for advertisers and ad tech companies to actually rely on them for stable, ongoing measurement.

Regulatory pressure played a role too, though in a somewhat unusual direction. Rather than regulators pushing Google to eliminate tracking faster, scrutiny from bodies including the UK’s Competition and Markets Authority focused on whether Privacy Sandbox itself could entrench Google’s advertising dominance, since Google would have controlled the replacement infrastructure that every other ad company would need to use. That regulatory concern was part of what stalled Chrome’s original cookie deprecation timeline for years before Google eventually abandoned it.

Industry resistance compounded both problems. Advertisers and publishers who depended on existing tracking methods were broadly skeptical that Privacy Sandbox’s replacement tools could match the effectiveness of what they were being asked to give up, and that skepticism showed up directly in the low adoption numbers Google later cited as its reason for retiring the technologies.

What Chrome Did With Third-Party Cookies

The Android story does not stand alone. It followed a very similar reversal on the browser side that makes the full picture clearer. Google originally planned to deprecate third-party cookies in Chrome entirely, with a timeline that slipped repeatedly from an initial 2022 target through 2024 and into 2025.

In July 2024, Google shifted its approach, proposing a new user choice prompt that would let people decide whether to allow third-party cookies in Chrome, rather than removing the capability outright. Then, in April 2025, Google dropped even that plan. The company confirmed it would not introduce the prompt and would not deprecate third-party cookies in Chrome, instead simply maintaining the cookie controls already present in Chrome’s existing privacy settings.

As of this writing, third-party cookies remain enabled by default in Chrome, subject to existing technical controls, exactly as they have been for years. Other major browsers took a different path long before any of this: Safari and Firefox have both blocked third-party cookies by default since 2020.

Where Ad Privacy on Android Stands Now

With the original Privacy Sandbox roadmap retired, Android’s advertising ecosystem has largely reverted to the tools it already had. The Advertising ID and existing SDK-based tracking remain the primary mechanisms apps and ad networks use, essentially unchanged by the multi-year Privacy Sandbox effort.

That does not mean nothing has changed at all. Google has continued tightening Play Store policy requirements around data disclosure and app verification, including stricter developer identity verification rules expected to take fuller effect by late 2026, suggesting Google’s approach to ad privacy has shifted from replacing the tracking infrastructure itself toward policing how that infrastructure is disclosed and used. Google has also said it will keep working with groups like the W3C on longer-term, interoperable privacy standards, even though the specific Privacy Sandbox technologies built toward that goal did not survive.

For anyone who spent the last few years preparing for a Privacy Sandbox-driven overhaul of Android advertising, the practical takeaway is straightforward: that specific transition is not happening, at least not in the form Google spent years describing.

Key Takeaways

• The premise did not hold: Privacy Sandbox on Android was officially deprecated as of October 17, 2025, not completed.
• Cookies were never quite the right frame for Android: Apps rely on the Advertising ID and SDK tracking, not browser cookies.
• Chrome kept third-party cookies too: Google abandoned its cookie deprecation plan in April 2025 after years of delays.
• Low adoption drove the retirement: Google cited low usage of key APIs like Attribution Reporting as a primary reason for retiring them.
• Regulatory concerns cut both ways: Scrutiny focused partly on whether Privacy Sandbox itself could entrench Google’s ad market position.
• What remains: The existing Advertising ID and SDK-based tracking infrastructure, now governed more by Play Store policy than by new privacy APIs.

Frequently Asked Questions

Is Privacy Sandbox on Android still active?
No, Google’s developer documentation confirms Privacy Sandbox on Android has been deprecated as of October 17, 2025.

Did Google actually remove third-party cookies from Chrome?
No, Google abandoned its cookie deprecation plan in April 2025, and third-party cookies remain enabled by default in Chrome.

Do Android apps use cookies the way websites do?
No, Android apps do not use browser cookies; they typically rely on the Advertising ID and SDK-based tracking instead.

Why did Google retire Privacy Sandbox?
Google cited low adoption of several key APIs, along with feedback from advertisers, developers, and regulators about the technologies’ expected value.

What replaced Privacy Sandbox on Android?
Nothing formally replaced it; existing tracking tools like the Advertising ID remain in place, alongside tighter Play Store policy requirements.

Conclusion

The idea that Privacy Sandbox marked the end of third-party ad cookies on Android does not match what actually happened. Google spent roughly three years building an alternative tracking framework for Android, only to formally deprecate the entire initiative in October 2025, following a nearly identical retreat from cookie deprecation in Chrome months earlier. Third-party tracking on Android continues to run largely on the same infrastructure it always has, and anyone still planning around a Privacy Sandbox-driven future should know that plan has already been shelved.