CHIPS stands for Cookies Having Independent Partitioned State, a browser mechanism that lets a cookie opt into storage walled off by the top-level site a person is visiting. Also called partitioned cookies, the feature adds a new attribute, Partitioned, to the Set-Cookie header, so a cookie carrying it is stored under two keys instead of one: the domain that set it, and the site shown in the address bar at the time. The same embedded service ends up with a different, isolated cookie jar on every top-level site that embeds it, rather than one shared jar following it everywhere. The mechanism solves a narrow problem: some embedded services, such as chat widgets or content delivery subdomains, need a cookie to hold state during a single visit, without that cookie becoming a way to identify the visitor across unrelated sites.

How partitioning works

Ordinary cookies are keyed on a host key, the hostname or registrable domain of whichever server set them. If a chat widget from support.example is embedded on retailer-a.example and later on retailer-b.example, the browser has historically sent the same cookie to support.example both times, since the host key alone decided which cookie went where. That single key is what makes third-party cookies useful for cross-site tracking, since a server can recognise the same browser across every site that embeds it.

CHIPS adds a second key. A partitioned cookie is stored against a pair, the host key and a partition key derived from the scheme and registrable domain of the page displayed when the cookie was set, and a browser only attaches a partitioned cookie when the request's own partition key matches. The cookie set while embedded on retailer-a.example carries the key ("https", "retailer-a.example"); loaded again on retailer-b.example, the same script gets a blank slate, a different partition with no shared history. Because the key tracks the top-level registrable domain rather than the exact hostname, a cookie set on shop.example remains available on checkout.example provided both share that domain, preserving continuity across a retailer's own subdomains while isolating it from unrelated sites.

Setting one requires the Partitioned attribute, the Secure attribute, since partitioned cookies must travel over encrypted connections, and typically the __Host- prefix, binding the cookie to the exact hostname: a complete example reads Set-Cookie: __Host-example=34d8g; SameSite=None; Secure; Path=/; Partitioned. SameSite=None still does separate work, governing whether a cookie is sent cross-site at all; without it, a cookie never reaches a cross-site embed regardless of Partitioned. Chrome also caps partitioned storage at 180 cookies per partition and 10 kilobytes per pairing, a ceiling unpartitioned cookies do not face.

Where it sits in the stack

CHIPS operates entirely inside the browser, ahead of any advertising auction. No OpenRTB field carries partition-key information, since the browser enforces the scheme unilaterally through which cookies it attaches to a request. The parties who configure it are operators of embedded third-party services, chat providers, mapping and payment widgets, content delivery networks and headless content management systems needing state scoped to a single embedding site; publishers generally take no action themselves, since the Partitioned attribute is set by the third party's own server. Google's documentation also lists sandbox domains serving untrusted content, such as googleusercontent.com, third-party CDNs gating assets on the visitor's authentication state, and embedded advertising components needing state scoped to one publisher, a category that places CHIPS adjacent to advertising infrastructure without making it advertising-specific.

CHIPS is not a substitute for cases where a cookie must follow a user across genuinely different top-level sites the same organisation owns. Google directs developers with that need toward the Storage Access API and Related Website Sets instead, since Related Website Sets does not integrate with CHIPS partitioning at all: choosing between the two is a choice between isolation and continuity.

Origin and evolution

Google engineer Kaustubha Govind opened the World Wide Web Consortium's Technical Architecture Group review for CHIPS on June 30, 2021, describing an opt-in attribute for partitioning a cross-site cookie by top-level site. The choice to make it opt-in was deliberate: Firefox had already begun partitioning third-party cookies by default in its strict tracking-protection mode, dating to Mozilla's state-partitioning work in February 2021, but Google argued developers needed to signal intent explicitly to avoid breaking services whose servers assumed an unpartitioned cookie would keep working. Safari had tried a third path years earlier, partitioning cookies by heuristic under Intelligent Tracking Prevention 2.1 in 2019, before abandoning that for blocking third-party cookies outright, citing developer confusion.

Chrome ran an origin trial from March 31 to August 30, 2022, later extended through Chrome 116 before general availability. A second Technical Architecture Group review on October 19, 2022 proposed raising the per-partition cookie limit from an initial ten to 180 and capping storage at 10 kilobytes, and the process also dropped, in November 2022, an early requirement that partitioned cookies forgo the Domain attribute, once trial participants found it complicated migration without adding security benefit under SameSite-by-default rules. According to the IETF specification, authored by Google's Dylan Cutler, the draft updates the RFC6265bis cookie standard with the new attribute.

Chrome shipped CHIPS by default from Chrome 114, released May 30, 2023. Firefox implemented the feature but kept it disabled over web compatibility problems, before re-enabling it with Firefox 141, reaching beta on June 24, 2025. Safari's rollout proceeded through internal feature-flag work from around September 2024, reaching a state that MDN and the Baseline compatibility project describe as "Newly available" across all three browsers in December 2025.

Why it matters for marketers

CHIPS matters less as a targeting tool than as infrastructure determining whether ordinary embedded tools keep working as third-party cookies grow harder to rely on. A brand's site commonly embeds a payment provider, a chat widget and several content delivery subdomains, each dependent on a cookie holding session state, and without CHIPS those services either lose that state when third-party cookies are blocked, or run directly in the page's own script context, raising separate security concerns.

The wider context is Google's unsettled retreat from Privacy Sandbox, the initiative under which CHIPS was proposed. Google abandoned its cookie deprecation plan in April 2025, days after a court found the company had monopolised ad tech markets, then retired most remaining Privacy Sandbox technologies six months later, including the Attribution Reporting API, Protected Audience, Topics and Related Website Sets. CHIPS was not among them: unlike those proposals, aimed at replacing behavioural targeting, it is baseline cross-browser infrastructure implemented independently by Firefox and Safari, so its adoption case does not depend on third-party cookies vanishing from Chrome. Even so, urgency to migrate for advertising use cases weakened once Google confirmed it would keep third-party cookies in Chrome rather than push a standalone deprecation prompt.

Limitations and disputes

Adoption remains modest. Chrome's own usage tracking puts the Partitioned attribute at roughly 20 percent of page loads, reflecting both the narrow use cases it addresses and reduced pressure once third-party cookies persisted in Chrome. Firefox's alternative, defaulting all third-party cookies to partitioned behaviour without any server-side change, achieves broader coverage automatically but at the cost of surprising developers whose services expect unpartitioned behaviour, the outcome Google's opt-in design was built to avoid.

Implementation gaps have surfaced even after browsers claimed support. A WebKit bug filed on January 24, 2026documented Safari dropping partitioned cookies after a multi-hop cross-site redirect chain returned to the original top-level site, while an equivalent unpartitioned cookie survived intact, reproducing on Safari 26.2 and implicating OAuth and OpenID Connect-style login flows, precisely the handoff CHIPS is meant to keep working. The bug remains open as of this writing.

A more structural limitation is that CHIPS solves isolation, not linkage. Organisations needing to share a cookie's state across genuinely separate top-level domains must instead use Related Website Sets or the Storage Access API. Related Website Sets was itself retired by Chrome in October 2025, after Brave, Mozilla and Apple had already opposed it as an exception to the site-as-privacy-boundary principle CHIPS is meant to enforce.

Disambiguation

Related Website Sets, formerly First-Party Sets, pursues close to the opposite goal: where CHIPS isolates an embedded service's cookies per top-level site, it grants a defined group of commonly owned domains shared access to unpartitioned storage. Chrome retired the feature in October 2025 after Firefox and Safari had already declined to implement it.

The Storage Access API is a JavaScript method, requestStorageAccess, letting embedded content ask the browser for permission to use ordinary, unpartitioned cookies cross-site, typically through a permission prompt, and underlies how Related Website Sets grants its exceptions.

The SameSite attribute is older and orthogonal to CHIPS. With values Strict, Lax or None, it governs whether a cookie is sent on a cross-site request at all; partitioning only applies once a cookie has already been permitted to travel cross-site under SameSite=None.

Firefox's default state partitioning, distinct from CHIPS despite addressing the same risk, partitions all third-party cookie storage automatically in strict tracking-protection and private-browsing modes, without any server adding an attribute. Mozilla nonetheless recommends CHIPS, since it produces more predictable partitioning across browsers.

Recent developments

Cross-browser availability completed only recently. PPC Land's roundup of newly available web platform features, published January 2, 2026, reported that Chrome 114 and Firefox 141 had already established support before Safari's addition completed cross-browser availability. The open WebKit redirect-chain bug reported three weeks later, on January 24, 2026, remains the most concrete unresolved technical issue as of this writing, and any organisation depending on partitioned cookies surviving an OAuth or OpenID Connect redirect through Safari should treat the behaviour as unverified pending a fix. Beyond that defect, CHIPS has settled into quiet, largely uncontested infrastructure, continuing to ship, unlike Related Website Sets, the Attribution Reporting API or Topics, across all three major rendering engines.

Timeline

  • February 2021: Mozilla introduces default state partitioning in Firefox's strict tracking protection mode
  • June 30, 2021: The W3C Technical Architecture Group design review for CHIPS is opened
  • March 31 to August 30, 2022: Chrome's initial origin trial window for partitioned cookies
  • October 19, 2022: A second Technical Architecture Group review proposes raising the partition cookie limit to 180 and setting a 10 kilobyte cap
  • November 2022: The no-Domain attribute requirement is dropped from the specification; the IETF internet-draft is published
  • May 30, 2023: Chrome 114 ships CHIPS by default, ending the origin trial for Chrome
  • September 2024: WebKit begins internal feature-flag work on partitioned cookie support
  • April 22, 2025: Google confirms Chrome will keep third-party cookies, reducing urgency for CHIPS-specific migration
  • June 24, 2025: Firefox 141 reaches beta, re-enabling CHIPS after a period of disablement for compatibility reasons
  • October 2025: Chrome retires most other Privacy Sandbox technologies, including Related Website Sets, while CHIPS continues shipping
  • December 2025: CHIPS achieves Baseline "Newly available" status across Chrome, Firefox and Safari
  • January 2, 2026: PPC Land reports cross-browser parity for the feature
  • January 24, 2026: A WebKit bug documents partitioned cookies being dropped after multi-hop cross-site redirects on Safari 26.2

Summary

Who: Google engineers, including Dylan Cutler and Kaustubha Govind, proposed and specified CHIPS through the World Wide Web Consortium's incubation process, with Firefox and Safari subsequently implementing it independently. Operators of embedded third-party services, such as chat, mapping and payment providers, set the Partitioned attribute in practice.

What: A Set-Cookie attribute, Partitioned, that stores a cookie under a combined host key and partition key derived from the top-level site, so the same embedded service receives an isolated cookie jar on every different top-level site that embeds it, rather than one shared jar.

When: Proposed in June 2021, available in Chrome by default from May 2023, re-enabled in Firefox from mid-2025, and reaching Baseline cross-browser availability with Safari's support in December 2025.

Where: Inside the browser, applied to cookies set by embedded third-party content in cross-site contexts such as iframes, ahead of any advertising auction or bidstream.

Why: It lets embedded services that need short-lived, site-scoped session state keep working as browsers restrict traditional third-party cookies, without reintroducing the cross-site tracking capability that unpartitioned third-party cookies historically provided.