An opt-out mechanism for Chrome's third-party cookie grace period

Chrome's third-party cookie grace period provides a way for sites experiencing breakage to request additional time to move away from third-party cookies to alternative solutions. Eligible grace period participants are granted continued access to third-party cookies for a limited time. We plan to maintain the grace period at least until we introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing.

Chrome is also providing a mechanism to allow sites to opt out of the grace period for a percentage of Chrome clients. The opt-out mechanism will enable sites to run their own staged rollouts to help them transition away from relying on the grace period, in order to test and move towards long-term solutions.

Why developers need the opt-out mechanism

Developers can set a Chrome flag to disable the grace period to test grace period opt-out locally, but this is not appropriate for testing at scale. To enable production-scale testing, Chrome is providing a mechanism to enable sites to opt out of the grace period for a percentage of Chrome clients that are subject to Chrome's Tracking Protection mechanism, which restricts third-party cookies for 1% of Chrome clients.

Configure grace period opt-out percentages

To take part in the opt-out, you need to provide a publicly accessible configuration file in the .well-known directory of your site at /.well-known/tpcd/grace-period.json. You can view the expected URL of your opt-out configuration file by entering your site or service's URL at goo.gle/3pc-lookup. The grace-period.json file provides opt-out percentages for the the grace period:

• ThirdPartyOptOutPercentage
  As a third-party provider, opt out of the grace period for a percentage of Chrome clients accessing your embedded content or services (on any top-level site).

• FirstPartyOptOutPercentage
  As a first party (top-level site), opt out of the grace period for a percentage of Chrome clients accessing embedded content or services on your site. This is only used when the top-level site has been added to a grace period, i.e. the first-party site pattern in goo.gle/3pc-lookup is not the * wildcard.

These percentages can have values of 0, 25, 50, or 100. For example:

{
  "ThirdPartyOptOutPercentage": 25
}

Changing the grace period opt-out percentage only affects the Chrome clients subject to Chrome's Tracking Protection mechanism, but does not affect whether those clients have Tracking Protection enabled in general.

Note: This opt-out does not restore cookie access for users who have explicitly disabled third-party cookies from Chrome settings or with the use of Incognito mode.

Test deployment

If you want to take advantage of the grace period opt-out, we recommend you begin by deploying grace-period.json as soon as possible, with a value of 0 for one or both of the keys. This will allow you to validate if Chrome is processing the file as expected, without affecting grace period activation. You can then begin to increase the percentage when you're ready. Developers can query grace period activation status for sites through our third-party cookie site compatibility look-up tool.

Note: The grace period opt-out is not currently supported for essential sites with temporary exemptions.

The grace-period.json file must be well formed in order to take effect. To avoid errors, check your file with the grace period opt-out validation tool.

Subdomains

As shown in the following examples, the scope of the opt-out is the same as the scope of the origin enrolled for the grace period. The grace period opt-out applies to the enrolled origin and its subdomains.

The .well-known/tpcd/grace-period.json configuration file must be hosted at the origin enrolled for the grace period.

Registered origin	Subdomain matching?	Configuration file	Opt-out scope
https://foo.example	No	https://foo.example/.well-known/tpcd/grace-period.json	https://foo.example
https://sub.foo.example	No	https://sub.foo.example/.well-known/tpcd/grace-period.json	https://sub.foo.example
https://foo.example	Yes	https://foo.example/.well-known/tpcd/grace-period.json	https://*.foo.example

Debug the opt-out mechanism

Google servers regularly check the grace-period.json file (if it exists) on each site for which the grace period is active. Opt-out percentages can then be distributed to all Chrome clients, though this process may take 24 to 48 hours to complete. Developers can check grace period activation status from the third-party cookie site compatibility look-up tool to understand when an opt-out is in effect.

Third-party example

In the following example, third-party.example has been enrolled in the grace period. They host the following file at third-party.example/well-known/tpcd/grace-period.json:

{
  "ThirdPartyOptOutPercentage": 25
}

With this file in place, the grace period will be deactivated for 25% of the 1% of Chrome clients subject to Tracking Protection that access sites or services from third-party.example.

First-party example

In the following example, first-party.example has been enrolled for the grace period. They host the following file at first-party.example/well-known/tpcd/grace-period.json:

{
  "FirstPartyOptOutPercentage": 50
}

With this in place, the grace period will be deactivated for 50% of the 1% of Chrome clients subject to Tracking Protection, that visit their site.

Note: It is also possible to set a SubdomainOptOuts value to specify distinct opt-out values for subdomains of the current site. The explainer provides examples of this.

Find out more

If you have questions regarding the opt-out mechanism, file an issue on the Privacy Sandbox support repository.

• Explainer for the Third-party Cookie Grace Period Opt-Out

• The "tpcd/grace-period.json" Well-Known Resource Identifier

• Intent to Ship: Third-party Cookie Grace Period Opt-Out

• Third-party cookie dependency grace period

• Well-known URI

• RFC 8615 - Well-Known Uniform Resource Identifiers (URIs)