Google will block use of the third-party cookie from its Chrome browser by the end of 2021, killing off the mechanism that drives much of online advertising. In July 2020, a group of U.S. senators urged the FTC to investigate adtech companies for improperly siphoning personal identifiers sent for ad placements through the digital ad market’s main sales channel. To pivot into a cookieless, privacy-first future, the advertising industry has adopted two strategies to let it continue to personalize advertising and use consumer profiles. This article analyzes legal compliance and data governance questions about the ad industry’s new approaches to handling consumer PII. It gathers insight from lawyers and consultants from BakerHostetler, Davis & Gilbert, Loeb & Loeb and Winterberry Group about regulatory and business risks and the factors that will shape the adoption of these cookieless approaches. See our two-part series on the CCPA and online ads: “Facebook Finally Acts, AG Starts Enforcement” (Jul. 29, 2020); “Contract and Compliance Consequences” (Aug. 5, 2020).