Skip to main content
Cookie Gate
Category: Tracking Technologies

CHIPS

Also known as: CHIPS, Cookies Having Independent Partitioned State
Simply put

CHIPS, which stands for Cookies Having Independent Partitioned State, is a web technology that lets a third-party cookie be stored separately for each website a user visits, rather than shared across all of them. This is often described as 'partitioned' cookies because the data is walled off per top-level site. The evidence packet provided does not contain reliable technical sourcing for this term, so this definition should be treated as provisional and verified against authoritative technical and regulatory sources before being relied upon.

Formal definition

CHIPS (Cookies Having Independent Partitioned State) refers to a mechanism for opting a third-party cookie into partitioned storage, so that the cookie is keyed to the top-level site under which it is set and is not accessible in other cross-site contexts. From a compliance standpoint, partitioning affects how tracking is scoped but does not by itself change the legal analysis: under the EU/UK ePrivacy regime, placing or accessing information on a user's device generally still requires prior consent unless the cookie is strictly necessary, and any resulting processing of personal data remains subject to the GDPR. Whether a partitioned cookie qualifies as exempt depends on its purpose rather than its storage model, and this is a fact-specific question. The evidence packet supplied does not include authoritative technical or regulatory sourcing for CHIPS, so the technical specifics above should be independently confirmed before use.

Why it matters

For privacy and compliance teams, CHIPS matters because partitioning changes how third-party cookies behave technically without necessarily changing the underlying legal obligations. A cookie that is partitioned per top-level site is scoped more narrowly than a conventional third-party cookie shared across many sites, which can reduce certain forms of cross-site tracking. However, teams should not assume that adopting partitioned storage removes the need for consent or for a lawful basis under applicable law.

The compliance analysis generally turns on the purpose of a cookie rather than its storage model. Under the EU and UK ePrivacy regime, placing or accessing information on a user's device typically still requires prior consent unless the cookie is strictly necessary, and any processing of personal data that follows remains subject to the GDPR. Whether a partitioned cookie qualifies as exempt is a fact-specific question that depends on what the cookie does, not on whether it is walled off per site.

It is important to flag a significant limitation: the evidence available for this entry does not include authoritative technical or regulatory sourcing for CHIPS. As a result, the description here should be treated as provisional and verified against primary technical specifications and relevant data protection authority guidance before being relied upon for compliance decisions. No specific enforcement actions, figures, or named incidents relating to CHIPS can be responsibly cited on the current evidence.

Who it's relevant to

Web developers and engineering teams
Developers implementing or evaluating partitioned cookies need to understand that scoping a cookie per top-level site changes its technical behavior but does not automatically satisfy consent obligations. Implementation choices should be confirmed against current technical specifications and coordinated with privacy colleagues rather than treated as a compliance shortcut.
Privacy officers and data protection professionals
Privacy teams should assess partitioned cookies by purpose rather than storage model, since exemption from consent under the ePrivacy regime generally depends on whether a cookie is strictly necessary. Given the lack of authoritative sourcing in the current evidence, these teams should verify the concept against primary regulatory and technical materials before relying on it.
Legal counsel and compliance advisors
Counsel advising on cookie compliance should recognize that CHIPS raises fact-specific questions and that obligations differ across the EU, the UK, and individual US states. The provisional status of this entry means legal conclusions should not be drawn from it alone without independent confirmation.
Marketing and analytics compliance teams
Teams deploying advertising and analytics technologies should not assume that partitioning reduces their consent responsibilities. In most EU jurisdictions such cookies typically require prior consent, and the same reasoning generally extends to similar technologies. This entry should be checked against authoritative sources before informing tooling or vendor decisions.

Inside CHIPS

Partitioned attribute
CHIPS (Cookies Having Independent Partitioned State) relies on the Partitioned attribute added to the Set-Cookie header, which instructs the browser to store the cookie in a partition keyed to the top-level site where it is set.
Partition key
Access to a partitioned cookie is scoped by the top-level site context. A third-party cookie set under one first-party site is not readable when the same third party is embedded in a different first-party site, limiting cross-site tracking capability.
Third-party embed use cases
CHIPS is designed to support legitimate cross-site embedding scenarios (such as embedded content, chat widgets, or sub-resources) that need per-site state without relying on unpartitioned third-party cookies that enable tracking across sites.
Security requirements
Partitioned cookies are generally required to carry the Secure attribute, meaning they are transmitted only over HTTPS, consistent with the technology's browser-defined constraints.
Relationship to third-party cookie deprecation
CHIPS is a browser mechanism intended to provide a narrower, privacy-protective alternative to conventional unpartitioned third-party cookies as browsers restrict or phase out the latter.

Common questions

Answers to the questions practitioners most commonly ask about CHIPS.

Does CHIPS (Cookies Having Independent Partitioned State) mean third-party cookies are exempt from consent requirements?
No. CHIPS is a technical mechanism that partitions a third-party cookie by top-level site, so the cookie cannot be used to track a user across different sites. This addresses a cross-site tracking concern at the browser level, but it does not alter the legal analysis. In most EU jurisdictions, the ePrivacy rules still govern the placing of or access to information on a user's device regardless of whether the cookie is partitioned, and any resulting processing of personal data remains subject to the GDPR. Where such a cookie is not strictly necessary, prior consent may still be required. CHIPS should therefore be treated as a privacy-enhancing technical control, not as a basis for skipping a consent assessment.
Is CHIPS a replacement for a consent management platform or for obtaining valid consent?
No. CHIPS is a browser-level partitioning technology, not a consent mechanism. It does not capture, record, or manage user choices, and it does not by itself demonstrate that consent was freely given, specific, informed, and unambiguous where such consent is required. Tools and technical measures can support compliance but do not replace legal judgment or the organizational record-keeping obligations that typically accompany consent. Whether a CMP is needed depends on the applicable legal regime and the categories of cookies and similar technologies in use.
How does CHIPS interact with our existing cookie categorization?
CHIPS affects how a cookie is stored and scoped technically, but it does not change how a cookie should be categorized for compliance purposes. A partitioned cookie is still classified by its purpose, for example strictly necessary, functional, analytics, or advertising. In EU law, strictly necessary cookies are generally exempt from consent, whereas analytics and advertising cookies typically require prior consent, and partitioning does not move a cookie from one category to another. Review each partitioned cookie against its actual purpose rather than assuming its technical scope determines its treatment.
Should we adopt CHIPS for our cross-site functionality, and what should we document?
Whether to adopt CHIPS is primarily a technical and product decision, often driven by browser changes to third-party cookie behavior and a desire to limit cross-site tracking. If you adopt it, it is generally advisable to document which cookies are partitioned, their purposes, and how each is treated within your consent framework. This documentation can support the transparency and record-keeping expectations that accompany consent obligations, but the underlying legal basis for placing and accessing each cookie must still be assessed separately.
Does using CHIPS reduce our obligation to disclose cookies in our cookie notice?
Not on its own. Transparency and information obligations generally require that users be informed about the cookies and similar technologies in use and their purposes, and partitioning a cookie does not remove it from that scope. A partitioned cookie is still placed on or accessed from the user's device, so where disclosure is required it should continue to appear in your cookie notice or preference interface. The precise disclosure expectations vary between the EU, the UK, and individual US states, so confirm requirements against the regimes that apply to you.
Is CHIPS treated the same way across the EU, the UK, and US state privacy laws?
Not necessarily. CHIPS is a browser technology and is jurisdiction-neutral in itself, but the legal treatment of the cookies it partitions differs by regime. In most EU jurisdictions and in the UK, non-essential cookies generally require prior opt-in consent, whereas several US state frameworks such as the CCPA and CPRA often rely on an opt-out model and may recognize signals like Global Privacy Control. CHIPS does not harmonize these differences, and enforcement positions and regulatory guidance continue to evolve, so applicable obligations should be assessed per jurisdiction.

Common misconceptions

Using CHIPS means consent is no longer required because the cookies are partitioned and privacy-protective.
CHIPS is a technical mechanism that limits cross-site state, but it does not by itself resolve legal obligations. In most EU and UK jurisdictions, the ePrivacy rules govern the storing of or access to information on a user's device regardless of whether the cookie is partitioned, so consent may still be required unless the cookie qualifies as strictly necessary. Any processing of personal data that follows is separately governed by the GDPR. Whether a given partitioned cookie is exempt depends on its purpose, not on the Partitioned attribute.
CHIPS is a Google or IAB product that guarantees compliance with cookie laws.
CHIPS is a browser-level cookie mechanism, not a compliance tool or a consent framework such as a CMP or the IAB TCF. It supports certain cross-site use cases in a more constrained way but does not replace legal judgment, consent collection, or record-keeping obligations, and it does not itself certify lawfulness in any jurisdiction.
Because partitioned cookies cannot track users across sites, they fall outside all privacy and e-privacy rules.
Reduced cross-site linkability lessens certain tracking risks but does not automatically place a cookie outside the scope of applicable rules. Consent obligations under EU and UK law generally turn on whether the technology is strictly necessary for a service the user requested, and US state frameworks such as the CCPA and CPRA apply their own opt-out and disclosure requirements. Whether CHIPS changes the analysis in a specific case depends on facts not settled by the mechanism itself.

Best practices

Treat CHIPS as a technical control that shapes cookie scope, and separately assess your legal basis: evaluate ePrivacy consent requirements for setting or accessing the cookie and GDPR requirements for any resulting personal data processing.
Do not assume partitioned cookies are exempt from consent; classify each cookie by purpose and apply strictly-necessary analysis in EU and UK contexts rather than relying on the Partitioned attribute alone.
Ensure partitioned cookies are served with the Secure attribute over HTTPS, consistent with the mechanism's requirements, and document the technical configuration of each embed that uses CHIPS.
Map your CHIPS-based cross-site embeds and record their purposes so they can be surfaced accurately in disclosures, consent categories in your CMP, and consent or record-keeping logs.
Account for jurisdictional differences: EU and UK deployments generally require prior consent for non-essential cookies, while certain US state regimes such as the CCPA and CPRA may instead rely on opt-out and disclosure, so tailor your approach per region.
Monitor evolving browser behavior and data protection authority guidance on partitioned cookies, and revisit your assessment as third-party cookie deprecation and related regulatory positions continue to develop.