Every six months for the past three years, another headline declares that personalization is dying. Third-party cookies deprecated. Safari ITP tightened. Firefox blocking cross-site tracking by default. And each time, the same anxious question from DTC brand operators: "Does this mean we can't personalize anymore?"
No. It means you have to personalize differently. And honestly, the new approach gives you better signal than the old one did, if you know what to look for.
We built Cartlyzer's ranking engine on the assumption that third-party data would continue to erode. That constraint pushed us toward in-session behavioral signals, and what we found was that those signals are sharper than anything a cross-site cookie could provide. Here is what we've learned.
What Third-Party Cookies Actually Gave You (And Why It Was Noisier Than You Think)
Third-party cookies enabled cross-site tracking: an ad network could see that your visitor had spent time on a competitor's sneaker page three days ago, and you could bid to reach that person. For large ad-spend platforms, that retargeting loop had real value.
For on-site personalization, the contribution was murkier. The cookie might tell you that this visitor's device had browsed athletic gear in the past week. But it couldn't tell you:
- Whether they were browsing for themselves or buying a gift
- What price ceiling they were actually operating under right now
- Whether the mood driving this session was "researching" or "ready to buy"
- Which specific product attributes they were weighing in this moment
In other words, third-party data told you something about who arrived. It said almost nothing about what they were doing once they got there. The in-session signal gap was always the problem, even when cookies were abundant.
First-Party Session Signals: The Vocabulary You Already Have
Your storefront generates a live behavioral stream the moment a visitor loads your collection page. Most analytics stacks compress this stream into aggregate summaries, scroll depth, bounce rate, time on page. Those are useful for marketing attribution but nearly useless for real-time personalization decisions.
The raw signal is richer. Here is what a single 90-second collection page session actually produces:
Hover dwell time by product card. A visitor who pauses the cursor for 2+ seconds on a product image is doing something different from one who scans straight through. We treat hover dwell as a soft interest signal. When two or three cards in the same price tier accumulate dwell events in quick succession, that tells us price tolerance more accurately than any demographic segment could.
Filter and sort interactions. A visitor who immediately opens the price filter and sets a ceiling is giving you explicit purchase-intent signal. A visitor who sorts by "new arrivals" is browsing, not buying, in most cases. These two visitors should see different product rankings even if they arrive from the same ad campaign.
Vertical scroll velocity. Fast linear scrolling (skimming) versus stop-start patterns (evaluating) correlate differently with eventual add-to-cart rates. The stop-start pattern is significantly more predictive of conversion, and you can detect it within the first 15 seconds of a session.
Return navigation after product click. A visitor who clicks a product detail page, reads it, and returns to the collection grid is not bouncing. They are actively comparing. If they click back within 8 seconds, they likely rejected that product quickly on price or a mismatch in the first visible image. If they click back after 30+ seconds, they were genuinely evaluating. These two behaviors warrant different responses in how you rerank the grid on their return.
The Problem With "Consent Mode" and Why You Still Need Session Signals
Google's Consent Mode v2 and similar frameworks let brands recover some attribution signal through modeled data even when users decline cookies. This is useful for ad measurement. It is not useful for on-site personalization.
Modeled attribution tells you, in aggregate, that your YouTube campaign probably drove 23% more conversions than it's getting credit for in last-click. That is a budget allocation insight. It does nothing to tell you how to rank your product grid for the individual visitor currently scrolling it.
We're not saying consent mode is worthless. It's valuable for understanding which channels are bringing you high-intent visitors. But it cannot replace the in-session behavioral stream for real-time merchandising decisions. These are two different data layers solving two different problems.
Building a First-Party Identity Without a Login Wall
One legitimate concern DTC brands raise: if you can't track across sessions with cookies, how do you build any persistent profile on an anonymous visitor? You get one session of signal, and then they're gone.
This is partly true and partly overstated. Here is the realistic picture.
For repeat visitors, most DTC brands have more first-party identity hooks than they use. If someone has ever completed a checkout, they have an email in Klaviyo. If they open email campaigns and click through, that click carries a session identifier that most ESPs pass as a UTM parameter. A visitor who lands from a Klaviyo email and browses your collection page is not anonymous, even without any cookie. You can load their purchase history and browsing history directly into the personalization layer before they reach your grid.
For genuinely new anonymous visitors, the honest answer is: you have this session only. That is enough to do meaningful real-time ranking. A visitor who arrives via a paid search ad for "merino wool sweater men medium" and immediately filters to medium sizes and the $80-$120 price range has given you a high-fidelity purchase intent signal with no prior history required. You don't need to know who they are. You need to know what they want right now.
A growing DTC apparel brand we worked with was investing heavily in Klaviyo profile enrichment for personalization, then applying that enrichment only to email campaigns. The storefront was entirely static. Moving the same first-party data into the live grid ranking added meaningful lift in revenue per visitor for logged-in or ESP-identified sessions, without touching a single cookie.
Server-Side Tracking and What It Changes for Personalization
Server-side event tracking, via tools like Elevar or custom GTM server-side containers, has become more common in DTC as client-side tracking reliability has dropped. Ad blockers and browser privacy features can suppress 30-40% of client-side pixel fires on some audiences.
For personalization specifically, server-side tracking changes the data collection reliability problem, not the signal quality problem. You can now collect more complete click and conversion data. You still need to decide what signals are worth collecting and what inference model makes sense to run on top of them.
The architectural shift we'd recommend for any growing DTC brand: treat your event stream as a first-class data asset rather than an ad platform input. Server-side collection directly into a warehouse or stream processor gives you data that you own, that does not get filtered by browser policy, and that you can use for personalization logic independently of any ad network's privacy constraints.
What This Means for Your Storefront Ranking in Practice
You do not need cross-site identity to rank products accurately for a live session. You need:
- A clean event schema capturing hover, filter, sort, click, scroll, and return-to-grid events with session-level identifiers
- A lightweight inference layer that can update product rankings in near-real-time (under 200ms response) based on the accumulating signal
- Integration with your first-party CRM data (Klaviyo or equivalent) so identified returning visitors get a warm start with their purchase history loaded
The third-party cookie was a shortcut that let you import someone else's profile of your visitor. First-party session signals are harder to collect cleanly and harder to build inference on top of, but they describe what the visitor actually does on your specific storefront. That specificity is the advantage.
The brands that treated cookie deprecation as a crisis were the ones most dependent on off-site data. The brands that treat it as a forcing function to get serious about their own behavioral data collection are ending up in a better position. The signal was always better in-session. The deprecation just removed the option to ignore it.