How to Configure Strict Third-Party Cookie Blocking and Partitioning in Google Chrome

Cross-site tracking relies extensively on third-party cookies stored across unrelated web browsing contexts. In response to heightened user privacy expectations and evolving web platform standards, Google Chrome implements strict cookie blocking alongside Cookies Having Independent Partitioned State (CHIPS). When partitioned, cookies set by embedded third-party services—such as payment gateways, map widgets, and chat embeds—are sandboxed to the top-level origin, preventing cross-domain user tracking.

Understanding Third-Party Cookie Sandboxing and CHIPS

Modern browser privacy architecture transforms traditional global cookie storage into partitioned silos:

• Unpartitioned Cookies (Legacy): An embedded widget on site-a.com can read the exact same cookie when embedded on site-b.com, allowing third-party trackers to construct pervasive browsing profiles.
• CHIPS Partitioning (Partitioned attribute): Chrome creates a dual-keyed partition composed of the top-level site origin (e.g., https://site-a.com) and the embedded domain. The cookie remains inaccessible when visiting site-b.com.
• Related Website Sets (RWS): Allows companies to declare associated domains (e.g., regional storefronts) that may share state without exposing user telemetry across unrelated web properties.

Configuring Strict Third-Party Cookie Blocking in Chrome

To enforce strict blocking and isolate embedded tracking cookies:

1. Launch Chrome and click the three-dot menu icon in the upper-right corner.
2. Select Settings, then click Privacy and security in the left sidebar.
3. Click on Third-party cookies.
4. Select Block third-party cookies. This blocks cross-site cookies completely while allowing partitioned storage for sites adhering to modern privacy APIs.
5. Enable the toggle for Send a "Do Not Track" request with your browsing traffic for additional compliance signaling.

Inspecting Partitioned Cookies in Chrome DevTools

Developers and security auditors can verify whether third-party cookies are properly partitioned:

1. Open Chrome DevTools by pressing F12 or Ctrl + Shift + I (Windows) / Option + Command + I (macOS).
2. Navigate to the Application tab.
3. In the left sidebar, expand the Cookies category under Storage and select your target domain.
4. Examine the cookie data table:
   • Look for the Partition Key column.
   • Partitioned cookies will display the top-level site URL (e.g., https://digitash.com) within this column.
   • Unpartitioned cookies blocked by Chrome’s privacy engine will be flagged with a yellow warning icon indicating phaseout status.

Managing Per-Site Exceptions for Legacy Web Portals

Certain legacy enterprise portals or single-sign-on (SSO) gateways may break when third-party cookies are strictly blocked:

• Temporary Omnibox Toggle: Click the eye or tune icon in the Chrome address bar to temporarily allow third-party cookies for the active domain.
• Persistent Site Exceptions: In Settings > Privacy and security > Third-party cookies, scroll to Allowed to use third-party cookies and click Add to register specific domain patterns (e.g., [*.]example-sso.com).

Configuring Enterprise Policy for Organization-Wide Enforcement

IT administrators can mandate strict cookie partitioning across managed device fleets using Windows Group Policy or Google Admin Console by configuring the BlockThirdPartyCookies and CookiesAllowedForUrls policy keys.