From Cookies to Clean Rooms: Winning Retail Media Strategies in the Age of Privacy

Table of Contents

Retail Media has been the undisputed star of digital marketing in recent years. It has established itself as the third giant of advertising, just behind the titans of search and social media. Its success is based on a powerful premise: using consumers’ real purchase data to offer them incredibly relevant ads at the exact point of sale. For brands, it’s a dream come true. For retailers, a multi-million source of revenue.

But a perfect storm is brewing on the 2025 horizon. The pillar that supported much of this ecosystem, the free flow of third-party data and the famous cookies, is crumbling. Driven by new and strict privacy regulations and a consumer who is increasingly aware of their digital footprint, the playing field is changing completely.

This article is not a harbinger of the end of Retail Media. On the contrary, it is a guide to navigating this new era. We will explore how privacy laws are impacting current strategies. And, most importantly, what practical steps brands and retailers can take to survive and thrive. Because from 2025 onwards, success will no longer depend on how much data you accumulate, but on how intelligently and ethically you use it.

Context: why 2025 is a turning point

The combination of greater regulatory enforcement, new transparency and consent obligations, and technical changes in browsers and platforms is redesigning how we capture, activate and measure data. And this is where the turning point for Retail Media in 2025 lies.

But, far from being a brake, privacy is becoming a competitive advantage for those who master the use of first-party data, secure collaboration through clean rooms and other privacy-enhancing technologies (PETs), and standardised measurement geared towards incremental sales.

The market context supports this transition: Retail Media remains among the fastest-growing channels, but it is also one of the most scrutinised for its promise of sales attribution and the proliferation of networks competing for limited budgets.

The new privacy landscape: What has really changed?

To understand the future, we must first understand the forces that are shaping it. It is not a single change, but three seismic shifts that are converging at the same time.

The end of an era: the disappearance of third-party cookies

For decades, third-party cookies have been the foundation of online advertising. They are small snippets of code that follow users from one website to another, building a detailed profile of their interests and behaviours. Have you ever searched for a pair of trainers and then seen ads for those same trainers on every website you visit? That’s the work of third-party cookies.

Google Chrome, the world’s most used browser, officially began the phasing out of third-party cookies in January 2024. Apple has already done so in Safari and with its App Tracking Transparency (ATT) policy, which requires explicit user consent to be tracked. In practice, this means that the ability to follow a user across the internet to show them ads is fading away.

The regulatory framework: The laws that put the user in charge

The General Data Protection Regulation (GDPR), in force in Europe since 2018, marked a before and after by granting citizens effective control over their personal information and redefining how companies manage it. From there, laws such as the CCPA and its update, the CPRA in California, as well as regulations promoted in Brazil, Canada, India and the United Kingdom, consolidated a trend that soon spread worldwide.

Beyond legal requirements, these regulations are based on a central idea: personal data is the property of the individual. From this arises the corporate obligation to act with transparency, explain how they will use the information and obtain explicit consent. This regulatory framework, which is becoming increasingly broad and demanding, is fundamentally transforming the way the advertising industry relates to people.

The shift in the consumer: Trust as the new currency

The third and perhaps most important factor is the consumer themselves. Today, users are more sceptical and better informed. They know their data is valuable and demand greater control. A study by McKinsey reveals that 87% of consumers would not do business with a company if they had doubts about its security practices.

Privacy has ceased to be a technical issue and has become a purchasing decision factor. Consumers reward brands that are transparent and respectful with their loyalty, creating a bond of trust that goes far beyond a simple transaction.

Concrete impact on Retail Media strategies

These changes are not theoretical; they have very practical consequences for the daily tactics of any marketing professional working with Retail Media.

Data and audiences: the new reality

The first consequence is that consented first-party data becomes the ultimate differentiating asset. Loyalty programmes take on new strategic importance. Retailers can collect information directly with their customers’ consent.

The value exchange gains prominence. Retail Media networks that rely on transaction and loyalty data, obtained with a clear and documented value exchange, can build high-quality audiences without depending on third-party identifiers. But they also need to strengthen their preference centres, register legal bases by purpose and offer simple and symmetrical revocation methods.

The design of the consent experience, aligned with the guidelines of the French agency CNIL or the Spanish AEPD, not only reduces the risk of sanctions: it also increases the opt-in rate when it communicates tangible benefits to the customer and simplifies the choice.

In parallel, the reliance on IDs that aim to replicate third-party cookies must be evaluated with legal and ethical scrutiny. This should be done on a case-by-case basis, given the explicit restrictions on combining data without a legitimising basis and the user’s signals of refusal that must be respected. Clean rooms and Privacy-Enhancing Technologies (PETs) emerge as key solutions. In these spaces, neither party exposes raw data: matching and analysis are carried out in a protected manner, with aggregated outputs and strict access controls.

Activation: new ways to reach the consumer

Retailers are strengthening their digital properties. In activation, the emphasis shifts towards the retailer’s own on-site and in-app environments. Here, the relationship with the user and the consent framework are clearer, and audience “matching” is native.

Off-site strategies are evolving towards first-party audiences and aggregated signals. Google’s Privacy Sandbox and contextual advertising are gaining ground. Advertisers adapt their messages to the content the user is consuming.

Lookalike audience models face significant limitations. Their effectiveness decreases without robust third-party data. Cross-site strategies require solid legal bases and explicit consents.

Measurement and attribution: from detail to a global vision

Measurement and attribution is, perhaps, the area where the changes are felt most intensely. Tracking at the individual user level is becoming less viable, while data aggregation methods are consolidating as the dominant alternative. To adapt, companies are opting for hybrid approaches that combine different sources of information.

In this new scenario, controlled experiments and geo-testing are gaining prominence. Media Mix Modelling (MMM) is once again taking centre stage, and incrementality metrics are considered the most solid reference for proving effectiveness. In parallel, the guidelines of the Interactive Advertising Bureau (IAB) and the Media Rating Council (MRC) ensure comparability, independent audits reinforce credibility, and transparency in measurement emerges as a true differentiating factor.

Governance and contracts: compliance as a priority

Data Processing Agreements (DPAs) are becoming mandatory in all collaborations. Retention limits require constant review. Data minimisation guides technical and commercial decisions.

Data protection impact assessments are integrated into business processes. Recognition of opt-out signals such as Global Privacy Control (GPC) is becoming standard. The ability to respond to user rights is becoming more professional.

Vendor evaluation includes mandatory privacy criteria. Clean rooms and identification solutions must meet strict standards. Support for user rights is becoming a contractual requirement.

Adaptation strategies: from threat to opportunity

Far from being the apocalypse, this new scenario is an opportunity to build a stronger, more transparent and effective advertising ecosystem. Here are the four key strategies to lead the change.

Strategy 1: Make First-Party Data the main asset

Retailers are sitting on a goldmine of this type of data:

Purchase history: The most valuable data. You know what they buy, when and how often.
Loyalty programmes: Provide demographic and preference information in exchange for benefits.
On-site and in-app browsing: Which categories they visit, what products they search for, what they add to their basket.
Customer service interactions: Questions, problems and direct feedback.

How can you boost them?

Enrich profiles: Use surveys, interactive quizzes and preference centres where users can explicitly tell you what they are interested in.
Unify information: Make sure that data from the physical shop, the website and the app are connected to have a real 360º view of the customer.

Quality trumps quantity in the new era. A piece of data obtained with consent is worth more than hundreds of inferred data points. Precise segmentation replaces mass audiences. Authentic personalisation generates better results than invasive hyper-personalisation.

Strategy 2: Technology as a bridge: Data Clean Rooms and CDPs

Data Clean Rooms function as secure collaboration spaces. Imagine them as a locked room where a retailer and a brand can analyse joint data. Inside this room, a system cross-references the information in an anonymised way to find matches and generate reports. For example, the brand can find out how many of the users who saw its TV ad are also members of the retailer’s loyalty programme, without either party seeing the other’s personal data. This allows for measurement and advertising collaboration while fully respecting privacy.

Customer Data Platforms (CDPs) unify scattered information. They connect data from the point of sale, e-commerce, mobile app and customer service. This unified view allows for consistent personalisation across all touchpoints.

Strategy 3: The rebirth of contextual advertising

Contextual advertising is not new, but it is experiencing a renaissance. Instead of being based on who the user is, it is based on the context of what they are viewing at that moment. The modern version goes far beyond placing a car ad in a motoring magazine. Thanks to artificial intelligence, it is now possible to analyse the content of a page in real time to understand its theme, sentiment and nuances.

Practical example: A gluten-free pasta brand does not advertise to “people interested in healthy living” (behavioural segmentation), but instead places its ad directly on a page with gluten-free lasagne recipes (contextual segmentation).

This strategy completely respects the user’s privacy. It does not require cookies or cross-site tracking. It is based on the present moment and the current content. Users perceive these ads as less intrusive and more useful.

Strategy 4: Building a circle of trust with the consumer

The best technical strategy will be useless if there is no trust. Privacy should not be seen as a legal obligation, but as a competitive advantage.

Radical transparency: Communicate clearly and simply what data you collect and, above all, what benefit the customer will get in return. Forget the endless legal texts.
The value of the exchange: The consumer is willing to share their data if they receive real value in return. This could be:
- Discounts and personalised offers.
- Product recommendations that actually save them time.
- Exclusive content or early access to products.

When a customer feels they are in control and that the brand is using their data to improve their experience, the relationship is strengthened.

Building the future: How transparency is redefining Retail Media

Retail Media has entered its “privacy-native” phase. At this stage, privacy is no longer perceived as a restriction but becomes the cornerstone of a more competitive and sustainable model. The transition to an ecosystem based on first-party data, explicit consent and technologies that allow collaboration without compromising information security will mark the difference between the companies that adapt and those that are left behind.

This change requires moving from an approach of indiscriminate data accumulation to a strategy where value for the customer is the main driver. Transparency, respect and technological innovation are now requirements for gaining relevance in an increasingly demanding market.

Brands and retailers that embrace this logic will not only ensure their growth, but will also lead the redefinition of advertising as a more creative, ethical and effective space. In short, the great asset of the future will not be the quantity of data, but the quality of the relationships built from it. And in that scenario, transparency and trust are consolidated as the most powerful currency in digital marketing.