# Does personalisation still work now that third-party cookies are going away?

Asked by Fiona Blake on 2025-05-20. Tags: privacy, cookies, personalization.

We are a UK insurer, so I have to be cautious about what data any tool actually
uses. Our previous personalisation vendor leaned heavily on third-party data
enrichment, and with third-party cookies being blocked more or less everywhere
now, half of its targeting quietly stopped matching.

Before we invest in rebuilding audiences in Croct, I would like to understand
what the personalisation is actually based on. If a visitor blocks third-party
cookies entirely, what signals are left to target on, and where is the data
stored? I would rather hear the honest limits up front than discover them later

## 2 answers

### Answer from Camille Roy (2025-05-20)

Third-party cookies were never part of the picture here, so nothing
degrades when they are blocked. Croct is privacy-first by design
and targets on first-party signals it observes itself: on-site behavior,
campaign source (UTMs on the visit), location, device, interests, and any
custom attributes you set from your own systems.

Storage is first-party too. By default identity lives in localStorage, with
optional first-party cookies if you need identity across subdomains. Either
way it is your domain, not a third-party tracker, so cookie blockers that
go after cross-site tracking do not touch it.

The audience conditions are evaluated in real time on each interaction, so
a "visitor from a paid campaign on mobile who viewed the claims page" kind
of audience matches from what happens in the current session, no enrichment
feed required. The honest limit: you will not get third-party demographic
or intent data appended out of nowhere, because that data simply is not
there. Everything you target on is something the visitor actually did or
told you.

### Answer from petew (2025-05-21)

We went through the same transition from an enrichment-heavy vendor and the
surprise for us was how much of our old targeting we could rebuild from
first-party signals alone, campaign source and behavior covered most of it.

If you want something to circulate internally before committing, the Croct
blog has a [privacy-first personalization playbook](https://blog.croct.com/post/privacy-first-personalization-playbook)
and a piece on [the end of third-party cookies](https://blog.croct.com/post/third-party-cookies-end)
that lay out the first-party model in more detail. Useful ammunition for a
cautious compliance review, in a good way.