You've spent this course learning to target sharply, align budget to objective, and build creative that converts. Now the ground shifts: the tracking that made much of that precision possible is being pulled back. This unit is about staying effective when the old signals disappear, so you can reach the right people without depending on data you're no longer allowed to collect.

Start by getting specific about what changed, because "privacy" is too vague to act on. Three constraints matter most, and each breaks something different.

iOS 14.5+ introduced App Tracking Transparency, the pop-up that asks users to allow tracking across apps. Most people decline. For you, that means Meta and other in-app campaigns lose visibility into cross-app behavior, so conversion tracking, retargeting pools, and lookalike seeds all shrink and get noisier.

GDPR is a consent law, not a technical setting. It requires a lawful basis and explicit opt-in before you collect or process personal data on EU users. Practically, no valid consent means no legitimate targeting or tracking of that person, and sloppy handling carries real fines.

Third-party cookie deprecation removes the connective tissue that let advertisers follow a user from site to site. As those cookies disappear, classic third-party audience segments and cross-site retargeting stop working reliably.

The through-line: legacy targeting leaned on data collected about people as they moved around the web, and that flow is closing. Naming which constraint is biting helps you fix the right thing instead of panicking about all three at once.

Here's the reframe to carry into every stakeholder conversation: you haven't lost the ability to reach people, you've lost one method of finding them. Two levers replace it. First-party data is information you collect directly with consent: newsletter signups, CRM records, purchase history, and on-site behavior. Because the user gave it to you, it's compliant, durable, and usually higher quality than anything you rented. Contextual targeting places your ad next to relevant content rather than following a specific person, so you target the page and the moment instead of the profile.

• Dan: With third-party cookies going away, are we just flying blind on retargeting?
• Nova: Not blind - we lean on what we own. Our email list, on-site behavior, purchase history. That's first-party data, and it's consented.
• Dan: And the people who never gave us their email?
• Nova: That's where contextual targeting comes in. Instead of following the person, we place the ad next to content they're already reading.
• Dan: So we target the page, not the profile.
• Nova: Exactly. Compliant by design, and often just as relevant.

Notice Nova doesn't grieve the lost cookie. She names what the team still owns, then adds context to cover the people first-party data can't reach. That pairing is the whole play.

Putting it together, a privacy-safe strategy sequences these levers deliberately. Begin by auditing and growing the first-party data you can collect with clear consent: signup incentives, gated content, loyalty programs, and clean CRM capture. Use that data to build your core audiences and to seed lookalikes from consented customers rather than third-party segments. Then layer contextual placements to reach new, unknown prospects alongside relevant content. Throughout, reduce third-party cookie dependence explicitly, and confirm every step honors ATT and GDPR consent. The reassurance for a nervous stakeholder is concrete: contextual relevance often performs comparably, and first-party audiences tend to convert better because they're built on real, owned signals.

The single takeaway: when tracking-based targeting erodes, you don't lose reach, you shift its foundation to data you own and context you choose. Your next few steps put this to work in stages: first a quick pattern-check matching each privacy constraint to what it actually limits, then a live conversation talking an anxious stakeholder off the ledge and onto a compliant plan, and finally a written recommendation you could hand to a client. Before any of that, try the reframe out loud: the next time someone says tracking is dead, answer with what you still own.