Your checkout page probably loads a payment widget, a chat bubble and two or three CDN subdomains. Every one of them likely leans on a cookie to hold session state. When third-party cookies get squeezed, those tools break in quiet, hard-to-debug ways.
That’s the problem CHIPS solves. And as of December 2025, it finally works in every major browser.
What CHIPS actually does
CHIPS stands for Cookies Having Independent Partitioned State. It adds a Partitioned attribute to the Set-Cookie header. Instead of storing a cookie under one key (the domain that set it), the browser stores it under two: that domain plus the top-level site in the address bar when it was set.
Translation: a chat widget from support.example embedded on retailer-a.example gets one cookie jar. The same widget on retailer-b.example gets a completely separate one, with no shared history. Same script, blank slate.
Because the partition key uses the registrable domain, continuity survives across your own subdomains — a cookie set on shop.example still works on checkout.example. What dies is the cross-site identity graph.
The syntax, in one line
Per PPC Land’s reference, a complete example looks like:
Set-Cookie: __Host-example=34d8g; SameSite=None; Secure; Path=/; Partitioned
A few implementation notes worth passing to your dev team:
- Secure is mandatory — partitioned cookies only travel over HTTPS.
- SameSite=None still matters and does separate work. Without it, the cookie never reaches a cross-site embed at all, Partitioned or not.
- The __Host- prefix is typical, binding the cookie to an exact hostname.
- Chrome caps storage at 180 cookies per partition and 10KB per pairing — limits unpartitioned cookies don’t face.
- Publishers usually do nothing. The attribute is set by the third-party service’s own server.
Why it survived when Privacy Sandbox didn’t
Here’s the part performance marketers should clock. CHIPS was proposed under Privacy Sandbox — Google engineer Kaustubha Govind opened the W3C Technical Architecture Group review on June 30, 2021, and Google’s Dylan Cutler authored the IETF draft.
Then Google reversed course. In April 2025 it confirmed Chrome would keep third-party cookies. In October 2025 it retired most remaining Privacy Sandbox tech: Attribution Reporting API, Protected Audience, Topics and Related Website Sets.
CHIPS wasn’t on that list. The reason is simple — it isn’t a targeting replacement. It’s plumbing, and Firefox and Safari implemented it independently. Chrome shipped it by default in Chrome 114 (May 30, 2023), Firefox re-enabled it in 141 (beta June 24, 2025), and Safari’s support pushed it to Baseline “Newly available” in December 2025.
Isolation vs. continuity: pick one
CHIPS solves isolation. It does not solve linkage. If you genuinely need a cookie to follow a user across separate top-level domains your organisation owns, CHIPS won’t help — Google points developers to the Storage Access API or Related Website Sets instead. And Related Website Sets was retired in October 2025 after Brave, Mozilla and Apple opposed it.
So the practical shortlist for cross-domain state is now thin: Storage Access API, or rethink the architecture.
The Safari bug to watch
One live issue deserves your attention. A WebKit bug filed on January 24, 2026 documents Safari 26.2 dropping partitioned cookies after a multi-hop cross-site redirect chain returns to the original top-level site — while an equivalent unpartitioned cookie survives.
That implicates OAuth and OpenID Connect login flows. Exactly the handoff CHIPS is supposed to protect. The bug remains open.
What to do this week
Adoption is still modest — Chrome’s own usage tracking puts the Partitioned attribute at roughly 20% of page loads, partly because urgency evaporated once third-party cookies stayed in Chrome.
Don’t wait for a forcing function. Three moves:
1. Inventory every embedded third-party service on your commercial pages — payments, chat, CDN, headless CMS, sandboxed content.
2. Ask each vendor whether they set Partitioned. If they don’t, ask when.
3. If any login or checkout flow redirects through multiple sites, test it in Safari 26.2 and treat the result as unverified until the WebKit bug closes.
Broken sessions cost conversions long before they show up in an attribution report. This is a 30-minute audit that protects revenue.
Source: PPC Land
