{"id":3270,"date":"2026-10-29T12:26:08","date_gmt":"2026-10-29T02:26:08","guid":{"rendered":"https:\/\/www.gpayments.com\/blog\/?p=3270"},"modified":"2026-10-29T12:26:08","modified_gmt":"2026-10-29T02:26:08","slug":"third-party-cookies-3ds-method","status":"publish","type":"post","link":"https:\/\/www.gpayments.com\/blog\/article\/third-party-cookies-3ds-method\/","title":{"rendered":"How Restrictions on Third-Party Cookies Affect the 3DS Method"},"content":{"rendered":"\n

In browser-based EMV 3D Secure (EMV 3DS), the 3DS Method lets the issuer’s Access Control Server (ACS) collect browser information through a hidden frame on the merchant’s checkout. Because that frame belongs to the ACS while the page belongs to the merchant, anything the ACS stores there runs in a third-party context. Browser rules on third-party cookies and storage therefore decide how much the ACS can recognise about a returning device.<\/p>\n

Where browsers stand on third-party cookies<\/h2>\n

The position changed several times between 2020 and 2025 and has now settled:<\/p>\n\n\n\n\n\n\n\n
\n

Browser<\/strong><\/p>\n<\/td>\n

\n

Third-party cookies by default<\/strong><\/p>\n<\/td>\n

\n

Source<\/strong><\/p>\n<\/td>\n<\/tr>\n<\/thead>\n

\n

Safari<\/p>\n<\/td>\n

\n

Blocked, through Intelligent Tracking Prevention, since 2020<\/p>\n<\/td>\n

\n

National Law Review<\/a><\/p>\n<\/td>\n<\/tr>\n

\n

Firefox and Brave<\/p>\n<\/td>\n

\n

Blocked by default<\/p>\n<\/td>\n

\n

Stape<\/a><\/p>\n<\/td>\n<\/tr>\n

\n

Chrome<\/p>\n<\/td>\n

\n

Allowed; Google confirmed in April 2025 that it would keep its existing approach and user controls rather than phase them out<\/p>\n<\/td>\n

\n

Stape<\/a><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u00a0<\/p>\n

Chrome has separately enforced storage partitioning in third-party contexts since Chrome 115, so local storage used inside a third-party frame is kept separate for each top-level site (Salesforce developer guidance<\/a>). In October 2025 Google retired most of its Privacy Sandbox APIs, keeping CHIPS (partitioned cookies), FedCM and Private State Tokens.<\/p>\n

What restrictions on third-party cookies mean for the 3DS Method<\/h2>\n

Where an ACS relies on a cookie or stored identifier set inside the 3DS Method frame to recognise a returning device, that recognition works differently across browsers. In Safari, Firefox and Brave, the third-party cookie is blocked by default. Even where storage is allowed, partitioning means a value stored while the cardholder shops at one merchant is not visible when the same cardholder shops at another.<\/p>\n

The 3DS Method itself still matters. It gives the ACS a chance to collect current browser information before the authentication request, and skipping it still raises challenge rates (why skipping the 3DS Method raises your challenge rate<\/a>). What changes is the value of anything the ACS expects to persist in that frame between visits.<\/p>\n

What issuers should rely on instead<\/h2>\n