You probably blocked third-party cookies in Chrome without noticing the second setting that enables Related Website Sets, which lets companies group their own domains together. This grouping keeps cross-site logins and sessions active across related sites, while third-party features like embedded media and payment gateways fail on unrelated sites. You should pay attention if you've ever stayed signed in when you expected to be logged out.
The exception came with paperwork
Chrome never let a company simply declare two sites as related
Related Website Sets isn't a feature that automatically applies to any site. For any company to get a pass on Chrome's cookie rules, they needed to prove it through a set of strict, public verification processes. Companies submit this declaration to a public registry, where anyone can verify it, and host it as a file on the company's domain. In this file, the company lists a primary domain, then includes a capped set of its associated domains, service domains, and country-code variations. Chrome reads this list, including the rules applied inside it.
However, membership in a Related Website Set was simply linked to the Storage Access API and did not automatically grant unrestricted cookie access. Within sets, storage access requests can skip the traditional permission prompt. Even though users still had to take an on-page action, there were fewer restrictions than outside the set.
As long as third-party cookies remained available, the exception did nothing. But if Chrome restricts them, maybe through Tracking Protection experiments, user-enabled blocking, or the planned phase-out, a set's auto-grant becomes activated; there's a significant difference between broken sessions and a seamless hop.
When you block third-party cookies in Chrome, the browser displays a follow-up toggle: “Allow related sites to see your activity in the group.” People don't always notice it after turning on cookie blocking. The average person isn't hunting down the list of sets on a public GitHub repository or the verification files on the website's domain. The documentation made the feature available but effectively hid it. Since "related" may effectively unlock a different treatment, the question worth asking is: who decides that two sites qualify?
Related to the browser, unfamiliar to you
Chrome’s version of “related” didn’t always match the reader’s understanding
Limits existed to ensure "related" doesn't expand into a loophole. That is exactly why Google created an anti-abuse measure:a capped set size. In practice, a single user may stay signed in when they move between domains of the same company — its main site and a country-specific domain, a separate login domain, or a branded product site. This feels like an invisible hop; outside a Related Website Set, third-party cookies are limited, so re-authentication is forced.
There is a real difference between expectation and ownership. Where a company is looking at a family of sites, you may see totally strange and unconnected entities. It introduces a privacy cost because people don't always judge relationships the way companies do. Here, Chrome drew a boundary that the average user doesn't automatically recognize.
A narrower wall, not a torn-down one
Why the fix itself became the privacy debate
Certain sites actually need to function as a single service, especially around login. However, the tension it creates is real. The protection third-party sites apply to strangers relaxes because Chrome treats them as related sites.
Google hasn't built this kind of identifying mechanism to help ad trackers spy. Its goal is to keep multi-domain sites working. However, to make these sites work seamlessly, Google had to sacrifice some privacy between the related domains.
|
Situation |
Unrelated sites |
Related Website Set |
Old third-party cookies |
|---|---|---|---|
|
Cross-site login/session |
Restricted |
Narrow exceptions |
Broadly possible |
|
Access to another site’s storage |
Restricted |
Controlled |
Largely unrestricted |
|
General cross-site tracking |
Not the intent |
Not what it enabled |
Core privacy concern |
|
Obvious to the user |
Usually |
Often not |
Often invisible |
Although a rule is completely public, it doesn't mean it's automatically visible to the person it affects.
Chrome built the exception, then removed it
After Google decided to keep third-party cookies, the reason Related Website Sets were created was lost. This feature was built primarily to soften the move to a web without those cookies. The exception simply didn't make sense when the move was canceled.
Chromium started removing it with the original plan for M150. However, as noted in a Google Groups email, even in mid 2026, about 0.86 percent of page loads still showed usage, triggering a final cut in M152.
You can toggle off "Allow related sites to see your activity in the group" after blocking third-party cookies. This provides stricter separation as the feature is phased out. This feature gave certain company sites a way to communicate when it was genuinely needed, and it shouldn't be viewed as a backdoor for tracking.
The cookies themselves were never the hardest part of ending third-party cookies; the harder task was deciding which connections between sites were worth maintaining.