For most of the last decade, paid media ran on a comfortable assumption. You could follow a person from the moment they saw an ad to the moment they bought, tie the sale neatly back to the click that earned it, and read your return on ad spend off a single dashboard. Third-party cookies made that chain possible, and a generation of marketers learned to trust it.
That chain has been coming apart for a while. Browsers restrict cross-site tracking by default, people decline tracking when they're asked, and the platforms increasingly estimate what they used to observe directly. The result isn't that performance marketing stopped working. It's that the easy way of proving it worked has gone quiet, and a lot of teams are still reading their dashboards as if nothing changed. The brands that keep spending with confidence are the ones that rebuilt how they measure before the old method failed them completely.
What privacy-first actually changed for paid media
It helps to separate two things that often get blurred together. The advertising still happens. People still see ads, click them, and buy. What changed is the visibility into that journey. Third-party cookies were the connective tissue that let one company recognise a user on a site it didn't own, and that tissue has mostly dissolved through a mix of browser policy and privacy regulation.
The practical effect is signal loss. Conversions that once arrived fully labelled now arrive partial, or not at all. Audiences built on cross-site behaviour shrink and age faster. Reporting that looked precise to the decimal point is quietly running on far more estimation than it admits. None of this means your spend is wasted. It means the instruments you used to judge that spend need replacing.
Why last-click attribution stopped telling the truth
Last-click attribution was never an honest model, even in the cookie era. It handed every bit of credit to the final touch before a sale and ignored everything that made the sale possible: the display ad that introduced the brand, the social post that built familiarity over a few weeks, the branded search that only happened because of all of it. The last click didn't create the customer. It just happened to be standing closest to the finish line when the customer arrived.
In a world with clean data, you could at least argue last-click was a known, consistent bias. Now it's something worse. With gaps in the data, last-click over-credits whatever channel still happens to be observable and under-credits everything upstream that's gone dark. The danger isn't just a slightly wrong report. It's a wrong decision. You quietly defund the prospecting, the awareness, the top-of-funnel work that actually generated demand, simply because it no longer shows up in a dashboard. The number looks efficient right up until the pipeline dries out.
Measuring paid ROI when the cookie is gone
Here's the uncomfortable part: there is no one-to-one replacement for the old tracking. Nothing you can switch on tomorrow that hands you the same clean person-to-purchase line you used to have. What works instead is a layered approach, where each method covers the blind spots of the others.
It usually stacks up like this. Start with consented, server-side conversion tracking, the most accurate signal you can still legitimately collect, sent from your own server rather than scraped together by a browser tag. On top of that sit the platform's modeled conversions, which fill the observable gaps with estimates. Treat these as directional, not gospel; they're the platform's best guess, and the platform has an interest in the answer. To find out what your spend is actually doing, run incrementality tests: hold out a region or an audience, run the campaign everywhere else, and measure the real lift between the two. That holdout is the closest thing you have left to a clean experiment. Finally, media mix modeling steps back and looks at the whole picture, correlating total spend across every channel against total outcomes, with no need for user-level tracking at all.
No single one of these is the truth. The discipline is triangulation: when server-side data, an incrementality test, and your mix model all point the same direction, you can act with real confidence. When they disagree, that disagreement is the signal. It's telling you where to look next.
Building a measurement stack that survives
A measurement stack that holds up under privacy pressure is built bottom-up, and the order matters more than the tools.
The foundation is first-party data: the information your customers give you directly through sign-ups, purchases, your CRM, and offline conversions. This is data you own, with consent, that no browser update can take away. Everything else is built on it.
On that foundation you layer the plumbing: a proper consent setup so you're only ever working with data you're allowed to use, server-side tagging so your signal doesn't depend on a fragile browser tag surviving the trip, and clean, consistent naming across campaigns so the data is actually analysable when it lands. Only once that base is solid do you add the models and tests on top: the modeled conversions, the incrementality holdouts, the mix modeling.
Build it in this order and the whole thing degrades gracefully. When one signal weakens, and one always eventually does, the layers beneath it hold the picture together instead of letting the whole report collapse. Build it in the wrong order, bolting models onto a thin or non-compliant data base, and you've just built a more sophisticated way to be confidently wrong.
What a performance marketing agency does differently now
Media buying itself has become table stakes. The platforms automate most of the bidding, targeting, and optimisation that used to be the job. If an agency's main pitch is still that they'll run your ads, they're selling you something the algorithm already does.
The real work has moved. It's in measurement, building the triangulated picture that tells you what's actually working. It's in first-party data, helping you collect, structure, and activate the data you own. It's in consent and compliance, making sure the whole operation is built on data you're legally allowed to use, which is now a competitive advantage rather than a checkbox. And above all, it's in proving lift, running the experiments that separate spend that drives incremental revenue from spend that would have converted anyway.
This is where we focus. You can see how we approach it on our performance marketing page. We've built this measurement discipline across more than 500 brands in the US, UK, and Canada, and as a global company with our headquarters in Delaware and teams in London and Gurugram, the pattern holds everywhere: the brands that win the cookieless transition are the ones that measure honestly, not the ones with the cleverest dashboard.
Where this leaves you
The honest summary is that measurement got harder, and that's fine. The old certainty was always partly an illusion: last-click gave you a precise number that was confidently pointing at the wrong channel. What's replacing it is less tidy but far more truthful, a few imperfect methods that, read together, tell you what your money is actually doing.
If you take one thing away, make it the order of operations. Own your data first. Get consent and server-side tracking right next. Add models and experiments last. Do it in that sequence and you'll keep spending with confidence long after the cookie is a footnote. Do it backwards, and no amount of new tooling will save the report.
Frequently Asked Questions
Can you still measure performance marketing ROI without third-party cookies?
Yes, just not the old way. No single tracker recreates that clean person-to-purchase line, but layering consented server-side tracking, modeled conversions, incrementality tests, and media mix modeling gives you a more honest read on ROI than last-click ever did.
What replaces last-click attribution in a privacy-first setup?
Triangulation. You combine a few measurement methods and look for where they agree, with incrementality testing, a holdout that measures real lift, as your closest thing to ground truth. The question shifts from which touch gets the credit to whether this spend is actually driving incremental revenue.
What is first-party data and why does it matter now?
It is the data customers give you directly, sign-ups, purchases, CRM, offline conversions, with consent. It matters because it does not rely on third-party cookies, so no browser update can take it away. It is the foundation everything else is built on.
Are modeled conversions reliable enough to spend against?
As one input, yes. They are the platform's estimate of conversions it cannot directly observe, so treat them as directional, and remember the platform has a stake in the number. Use them for day-to-day trends, but validate big budget calls against incrementality tests and mix modeling.
How do I choose a performance marketing agency for a cookieless world?
Look past media buying, since the platforms automate that, and ask how they measure. The right agency talks fluently about first-party data, server-side tracking, and proving incremental lift through testing. If the pitch is mostly that they will run your ads, they are selling yesterday's job.
Want this done for your brand?
Tell us where you are and what you are trying to grow. We will reply with a straight read on your situation and what is worth doing first. No obligation, no lock-in.