To count the same person twice, for a frequency cap or a retarget, you need one identifier that holds still across visits. The cookie was the original answer, and you have probably heard it is disappearing. Here is what that means: five separate places it can fail.
Quick refresher: a cookie is a key/value pair set through a Set-Cookie response header, stored in the browser, then sent back automatically on every later request to that domain. Netscape invented it in 1994 to remember a shopping cart between page loads, one small job. The industry built an entire identity layer on top of it anyway.
First gate: does the browser even allow it. Safari has blocked third-party cookies since 2017, Firefox since 2019. Chrome still allows them, and Chrome alone carries roughly 65% of global traffic this year, more than every other browser combined.
Second gate: does the law allow it. The EU, UK, Brazil and China run opt-in, nothing fires until the user says yes, and GDPR gives cookie storage no fallback to legitimate interest, only consent. The US runs opt-out instead: a cookie fires by default until the user objects. Twelve states now legally require honoring that objection when sent as a browser signal.
Third gate: this is called cookie syncing, buyer and seller platforms exchange their own cookie IDs with each other so they can recognize the same person under two different values. It isn’t a standing connection, it has to keep re-happening: sync only completes when the seller’s tag actually calls the buyer’s sync pixel during that one page visit. Miss that call and nothing happens until it lines up again on a later visit.
Fourth gate: even synced, it dies fast, by design and by accident. Every cookie carries a built-in expiry, and Chrome caps it at 400 days no matter what’s requested. Some carry no expiry at all, a session cookie, and vanish the moment the browser closes. Users clear browsing data.
Fifth: even alive, a cookie identifies a browser, never a person, in both directions. The same person on a phone, a laptop, and a work desktop becomes three unrelated IDs. A shared family or library computer collapses several people into one.
A less obvious version of the same problem, and a growing one given how much traffic now starts inside a social app: Instagram, TikTok and Facebook open links in their own isolated browser rather than the phone’s, keeping the whole experience inside the app’s own branded view instead of risking someone bouncing to the standard browser and not coming back. That isolated view keeps its own separate cookie jar, disconnected from the real browser’s, so the same person looks like a stranger clicking from inside the app.
Cap on a cookie and you’re only capping the slice that survived every gate: the browser, the law, the sync, the clock, or the device can each leave you counting a stranger.
