// THE 2027 CMO / PERSONALIZATION
Personalization After the Cookie Reversal
Chrome's cookie decision and the retirement of several Privacy Sandbox APIs changed the implementation plan. They did not remove privacy obligations or the cold-start problem for personalization.
A personalization roadmap needs to identify the data it can lawfully use, the signals available at arrival, and the outcomes it will test. A browser deadline cannot settle those questions.
Chrome's cookie decision
On April 22, 2025, Anthony Chavez, Google's VP of Privacy Sandbox, posted the reversal in one sentence: "We've made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies." As of this writing, that decision still stands. Chrome's announcement kept its existing approach to user choice; it did not make third-party cookies available in every browser setting.
Google cited divergent perspectives about changes affecting third-party-cookie availability. The announcement preserves user choice; it is not a promise that every browser or user will make third-party tracking available.
Google announced the retirement of ten Privacy Sandbox technologies
On October 17, 2025, Google announced the retirement of ten Privacy Sandbox technologies: Attribution Reporting, Protected Audience, Protected App Signals, Topics, Related Website Sets, IP Protection, On-Device Personalization, Private Aggregation, SelectURL, and SDK Runtime. Google cited low adoption and said phase-outs would follow Chrome and Android processes. The same announcement kept CHIPS, FedCM, and Private State Tokens in its ongoing work. It was not a shutdown of the entire initiative on that date.
That makes those APIs unsuitable assumptions for a continuing roadmap. Review dependencies against the published retirement plan and the browsers your customers use.
Privacy-preserving targeting still needs an implementation and an adoption path. The retirement does not establish that privacy regulation caused the outcome or that first-party systems can solve every targeting problem.
State privacy rules differ
The cited state-law review counts twenty comprehensive consumer privacy laws in effect in 2026, including Indiana, Kentucky, and Rhode Island from January 1. Rights, exemptions, sensitive-data definitions, and consent requirements differ by statute. Do not treat that count as twenty identical sets of access, deletion, correction, and portability rights.
Enforcement provisions need the same date check. Under Delaware's Section 12D-111, offering an opportunity to cure became discretionary on January 1, 2026; it was mandatory, where a cure was possible, during 2025. Montana's SB 297 amendments took effect October 1, 2025, removing the mandatory cure provision from its enforcement section. The earlier April 1, 2026 sunset is no longer the operative date. An opportunity to fix a violation before enforcement is not a substitute for complying when the law applies.
Map the jurisdictions, data, processing purpose, and rights workflow your program actually touches. A single cookie policy cannot establish compliance across them.
Article 50 applies from August 2, 2026
The European Commission's Article 50 guidance gives August 2, 2026 as the application date. Duties depend on system behavior and whether you are its provider or deployer. They include disclosures for specified AI interactions and generated content; they do not cover every recommender merely because it personalizes. The December 2 exception is limited to Article 50(2) marking/detection duties for systems placed on the market before August 2.
Have the responsible legal and product teams map the actual interaction, content, and role to the applicable duty. Use the effective date rather than an age-in-weeks description that becomes stale.
Keep the 2021 statistic attached to its study
McKinsey's November 2021 personalization report is the source behind the often-repeated value and revenue-lift figures. It describes that period's research, including the pandemic shift to online shopping. Label the date, cohort, and conditions when using it.
A 2021 result can help frame a test, but it cannot underwrite a guaranteed lift for a new program. A newer statistic is not automatically more comparable. Choose a relevant method and cohort, then measure your own outcome.
What is actually working, with a name attached
First-party personalization done well still moves real numbers, cookies aside. Bloomreach's own case study on Terno, a Central European grocery retailer, reports a 27 percent conversion lift from a campaign called "empty fridge": using Loomi AI to learn that the average customer restocks roughly every 3.5 days, then triggering a personalized reminder featuring that specific customer's regular items right as the cycle predicts they are running low, instead of a generic weekly email blast.
The case uses purchase history and a restocking trigger. It is a vendor-published result, not an independent audit or a guaranteed lift. The mechanism offers a testable use for data an existing customer has already supplied.
The problem cookies never solved anyway
A new, unidentified visitor may have no purchase history linked to the session. That is the cold-start constraint. First-party signals can still exist on a first website visit, including prior account relationships, consented customer records, a referral, or behavior collected during the current session. "First visit" does not mean "no data by definition." I use session zero for the arrival-time personalization problem.
The projections at personalize.jeffbrokaw.com model a hypothesis using external, consented signals at arrival. They are illustrative projections, not measured conversion results or a shipped case study. The data-access, consent, matching, and latency assumptions need testing before treating that model as an operating result.
What to actually put in the 2027 plan
Review browser and vendor dependencies against their current plans. Give consent and rights handling a defined owner and map the laws relevant to the data you process.
If the stack uses interactive or generative AI, have legal and product owners check Article 50's specific provider/deployer duties. Its application date is August 2, 2026; the scope depends on the system, not the word "personalization" on the roadmap.
Build the first-party data infrastructure regardless of what cookies do next. Terno's result did not depend on a cookie decision either direction. The retailers making this work are the ones treating purchase history as a targeting asset in its own right, not a stopgap for the third-party data they used to buy.
Give arrival-time personalization its own test. Specify which signals exist, how a match is checked, how quickly the page can respond, and what happens when the visitor cannot be matched.
Use pre-test validation to check the hypothesis before launching a live experiment. Keep the projected model separate from the measured control and treatment outcomes.
Frequently asked questions
Are third-party cookies actually going away in Chrome?
Google's April 22, 2025 announcement kept Chrome's existing approach to third-party-cookie choice and abandoned the new standalone prompt. It did not announce a replacement deprecation deadline. Availability still depends on the user's browser settings; the announcement does not guarantee access to every visitor's third-party cookies.
What happened to Google's Privacy Sandbox?
On October 17, 2025, Google announced plans to retire ten Privacy Sandbox technologies, citing low adoption. It said phase-outs would follow Chrome and Android processes, while continuing work on CHIPS, FedCM, and Private State Tokens. The announcement was not a completed shutdown of the whole initiative on that date.
Is the McKinsey $1 trillion personalization statistic still accurate?
It is a dated finding from McKinsey's 2021 report, not a live benchmark for every personalization program. Retain its date and conditions, and select evidence by relevance and method rather than recency alone.
Does the EU AI Act affect marketing personalization?
Article 50 applies from August 2, 2026, but obligations depend on the system's interaction/content and your provider or deployer role. It is not a blanket rule for every recommender. The December 2 grace period is limited to Article 50(2) marking/detection duties for systems placed on the market before August 2.
How many US states have comprehensive privacy laws in 2026?
The cited 2026 review counts twenty comprehensive state consumer privacy laws. Their rights, exemptions, consent rules, and enforcement provisions differ. Check the statutes applicable to the program rather than assuming a uniform national rule.
What is session zero, and why doesn't first-party data solve it?
Session zero describes the arrival-time personalization problem for a new visitor. A first visit may still have prior customer/account data or current-session signals. The difficult case is an unidentified visitor without usable history. The personalize.jeffbrokaw.com figures remain modeled projections, not measured results.
Sources
Primary sources: Google's April 22, 2025 cookie announcement and October 17, 2025 retirement announcement; McKinsey's 2021 report; European Commission Article 50 guidance; Delaware's privacy statute; and Montana's amended enforcement section with the DOJ's effective-date summary. MultiState's 2026 summary supplies the state-law count. Bloomreach's Terno case is a vendor-reported example, not a general personalization benchmark.
About the author
Jeff Brokaw is a CMO and Certified Chief AI Officer who builds AI workflows, measurement systems, and the commercial operations around them.