Skip to content
Digital Marketing5 March 2026 · By the Intense Path Editorial Team

Retargeting Without Following People Around the Internet

Frequency caps, exclusion lists and a consent-first setup turn retargeting from harassment into a reminder. You reach fewer people. The ones you reach have not already decided to resent you.

On This Page
Pass It On

Found this useful? Send it to someone who’s building.

Retargeting Strategy After Third-Party Cookies | Intense Path

Somebody buys a sofa. For the next six weeks, every site they open shows them that sofa. Same photograph, same price, same button. They already own it. The campaign is spending money to tell a customer, repeatedly, that the company it belongs to does not know they are a customer.

That is not a targeting failure. It is a configuration failure with a strategy underneath it, and it happens because a retargeting strategy usually gets set up once, by whoever built the account, and is then judged only on the cost per acquisition it reports. Nobody is assigned to notice that it has become unpleasant.

Our position: retargeting still works, and almost every setup we inherit is doing it in the most expensive and least dignified way available. The fix is three settings and one change of mind. The settings are frequency caps, exclusion lists and a consent-first build. The change of mind is deciding that a smaller permissioned audience is worth more than a large borrowed one.

Why the setup you inherited stopped working

The classic pixel-and-pool arrangement assumed something that is no longer true: that a third-party cookie set on your site would still be readable, on another site, weeks later. Browsers have spent years dismantling that assumption. Some block third-party storage outright, some cap the lifetime of script-written cookies to days, some strip identifiers out of links. Consent frameworks removed another slice.

The result is not that retargeting stopped. It is that the audience quietly became a fraction of what the dashboard implies, weighted towards the visitors with the least privacy protection, which is rarely the segment you actually want. Match rates degraded without an alert firing. Nothing broke loudly. It simply got worse in a way no report was designed to show.

So we treat a retargeting review as a measurement problem before a creative one. If you cannot say what proportion of your visitors are consenting, and what happens to the audience when they do not, you are optimising a number whose shape you cannot see. The discipline is the same one that governs any analytics work: name the gap before you spend against it.

Most teams treat consent as a legal overlay bolted onto a marketing system designed without it. That ordering causes every problem which follows: banners engineered to confuse, tags that fire before a choice is recorded, audiences half-populated with people who declined and half with people who were never properly asked.

Build it the other way round. Decide what you may collect, then design what you will do with it. A tag that fires only on a recorded consent signal produces a smaller audience that is entirely defensible. One that fires optimistically produces a larger audience and a liability, and the liability does not go away because the dashboard looks better. Our own cookie policy is written to that standard, which is the only reason it is short.

The banner is part of the campaign

A consent banner designed to trick people into accepting produces consent worth nothing legally and audiences worth nothing commercially, because the people in them did not mean it. Design the banner as though a regulator and a customer will both read it, since eventually both will.

Frequency caps: the one setting that does most of the work

Ask most advertisers what their frequency cap is and you get a pause. Ask the platform and you often find it is either unset or set at a number chosen by whoever wanted to spend the budget fastest.

Frequency is where wear-out lives. The first few impressions do the reminding. Somewhere after that, additional impressions stop working and start doing damage, and the damage never appears in a conversion report because irritation is not a tracked event. It appears later, as a brand people have decided they dislike, for reasons they would struggle to articulate if you asked them.

How we set them

  • Cap per person, per week, not per campaign. Three campaigns each capped generously is not a cap. It is three caps and one very tired human.
  • Cap across the account wherever the platform allows it. The visitor does not experience your campaign structure. They experience the total.
  • Put a hard end on the membership window. An audience nobody ever leaves produces the sofa problem. Most consideration windows are far shorter than the pool somebody built.
  • Vary the creative before you raise the cap. If the answer to fatigue is always more impressions, the campaign has no second thing to say.

One honest caveat: caps cost you volume, and on a small budget the volume was already thin. If your retargeting pool is genuinely tiny, tight caps can leave a campaign delivering almost nothing, at which point the money belongs somewhere else entirely rather than in a campaign kept alive for tidiness.

Exclusion lists separate retargeting from harassment

Exclusions are the least glamorous part of an advertising account and the part that most changes how a company is experienced. Every audience you build should have a matching list of people who must never see it.

The sofa buyer is the obvious one. The less obvious ones are the people who already enquired and are mid-conversation with your sales team, the existing customers being served an acquisition offer better than their renewal, the applicants who visited the careers page, and the people who unsubscribed and are now being paid for a second time.

The exclusions we always build

  1. Converted, by conversion type. Purchased, enquired, booked, subscribed. Each one ends a different campaign, and collapsing them into a single event is how a customer ends up back in a prospect sequence.
  2. Currently in a sales conversation. If somebody is talking to a person, stop talking to them with an advert. This one needs a genuine connection between the ad account and the sales record.
  3. Existing customers, unless the offer is for them. Nothing corrodes a renewal like watching a better price advertised to strangers.
  4. Unsubscribed or objected. A person who opted out of your email and is then retargeted has learnt something specific about your company, and it is not flattering.
  5. Non-audiences: staff, suppliers, applicants, bots. They inflate the pool, spend the budget and never convert, which quietly makes every efficiency figure you report a little bit false.

Exclusions only work if the systems can actually talk to each other, which is a plumbing question rather than an advertising one. It usually lands with whoever owns marketing automation, because that is where the record of who converted, who replied and who opted out already lives.

First-party audiences, and what they honestly cost

A first-party audience is built from something a person gave you knowingly: an email address, an account, a downloaded document, a booking. You match that to the platform rather than borrowing an identifier from a browser actively trying to stop you.

ConcernThird-party pixel poolFirst-party audience
Who is in itAnyone the pixel saw, including bounces and botsPeople who gave you something deliberately
Consent basisAssumed, then partly withdrawn by the browserExplicit, recorded, and revocable on request
LifespanShortening, and shortened again without noticeThe length of the relationship, subject to your retention policy
Match qualityDegrades quietly as storage rules tightenStable, because the identifier belongs to you
ReachLarger on paperSmaller, sometimes drastically
What breaks itA browser release you did not know was comingAn unsubscribe, which is the correct outcome

Read the reach row again, because that is the trade. You will reach fewer people. On a first-party rebuild the pool can be a small fraction of what the pixel claimed, and the first month of reporting looks like a downgrade. We take the trade anyway, for three reasons: the audience survives the next browser change, it can be used across email and advertising without a second consent argument, and every person in it has already chosen to hear from you.

The uncomfortable consequence is that building the audience becomes a marketing problem rather than a tracking problem. A pixel needed nobody to agree to anything. A first-party list needs a reason for somebody to hand over an address, and most of the reasons companies currently offer are thin: a newsletter nobody asked for, a gated document that turned out to be a brochure. If your only collection mechanism is a footer sign-up form, the audience will stay small and the rebuild will look like a failure when it is really a shortage of anything worth exchanging.

So do that work first. Decide what you can give somebody that is genuinely worth an email address, put it where people already are rather than behind a modal, and be explicit about what you will send. An audience assembled that way is smaller on the first day and better on every day after, because the people in it remember agreeing and are not surprised to hear from you.

A content-led sequence beats a discount chase

Most retargeting says one thing, louder and louder. Somebody looked at a product, so they see the product, then the product with a discount, then the product with a bigger discount. The sequence contains no argument, only volume and money.

A content-led sequence assumes the visitor left for a reason and tries to answer it. First impression: the thing they looked at. Second: the objection you know they have, answered by a page rather than by a claim. Third: the evidence a careful buyer would want before committing. Fourth, if there is a fourth, the offer. The discount is where the sequence ends, not where it begins.

That needs actual content to point at, which is where most versions of this plan collapse. The sequence wants three or four genuinely useful pages, published on a rhythm nobody has to be heroic about, which is what a content calendar that survives a busy quarter exists to protect. If publishing a page requires a developer and a release window, the sequence will never be maintained past month two. A structured content workspace such as Acrosite takes the other route: editors work in a form, and the files are generated, committed and deployed without anybody opening a terminal.

The page they land on

Retargeting clicks are expensive clicks, and they arrive on mobile, often on a poor connection, from somebody whose attention you already borrowed once. A landing page that takes four seconds to show its main image is spending media budget on a spinner. That is the practical reason Core Web Vitals are worth fixing on pages that receive paid traffic, whatever they do or do not do for rankings. And when a page converts poorly with too little traffic to test properly, the honest method is conversion work without the traffic to test: reason from the evidence you have rather than waiting for a significance you will never reach.

Measuring it without flattering yourself

Retargeting is the most over-credited line in most advertising accounts, because it deliberately targets people who already showed intent. Some of them were coming back anyway. The campaign takes the credit, the platform reports it happily, and nobody in the meeting asks the awkward question.

The awkward question is what happens if you switch it off, in one region or for one segment, for long enough to see. That is a real test and it costs real revenue to run, which is why it almost never happens. Short of it, hold the reporting to what it can honestly support. Our parent company put the general version of this well in what ninety days can honestly show, and the same limits govern what you can measure in the first ninety days of any new programme.

The number we would actually put in front of a board is not cost per acquisition. It is whether the people the campaign brought back are still customers two renewals later, which is the argument for judging lifecycle marketing and paid media on the same timescale instead of on two different ones.

A retargeting campaign is a conversation with somebody who has already met you. Volume is not the variable that improves it.

What you give up, said plainly

All of the above has a price, and pretending otherwise would make this a sales page rather than an argument.

You lose reach, immediately and visibly. You lose some attribution clarity, because a consent-first setup observes less and models more. You lose the flattering dashboard, because a first-party audience cannot be inflated with people who never agreed to anything. And you add work: exclusions have to be maintained, consent has to be recorded properly, and somebody has to own both of those jobs by name.

What you gain is a system that does not break when a browser ships a release, an audience usable in more than one channel, and a company nobody has learnt to resent. Weighed across a year rather than a month, that is not a close call. It is also why we would rather spend the third month of a programme on activation rather than acquisition, since a campaign that keeps refilling a leaking product is a subscription to disappointment.

If you want somewhere to start this week, start with exclusions. They are free, they take an afternoon, and they stop the worst thing your advertising is currently doing. Caps next. The first-party rebuild after that, because it is the slowest piece and the one that needs other teams. Then look again at whether the paid programme still deserves the budget it has. If you would like somebody to read the account before you change it, send us what you are running and the audiences it was built on.

Take these with you
Exclusion lists are the cheapest improvement available to most advertising accounts, and they stop the behaviour customers actually complain about.
A frequency cap set per person across the whole account, with a hard end to the membership window, prevents the wear-out no conversion report will ever show you.
First-party audiences reach fewer people and survive browser changes, which is a trade worth taking once you judge the programme over a year rather than a month.
A content-led sequence answers the objection that caused somebody to leave, while a discount chase only repeats itself until it is cheaper.
Retargeting is the most over-credited line in a paid account because it targets people who already showed intent, so report it with that caveat attached.

Common questions.

Does retargeting still work now that third-party cookies are restricted?

Yes, but with a smaller and differently shaped audience than the dashboard suggests. Browser restrictions on third-party storage, shortened cookie lifetimes and consent requirements all reduce who can be matched, and the loss is uneven rather than random. Retargeting built on first-party data you collected with permission is the version that keeps working, because the identifier belongs to you rather than to a browser.

What is a sensible frequency cap for a retargeting campaign?

Cap per person across the whole account rather than per campaign, and put a hard limit on how long somebody stays in the audience. The right number depends on your consideration window, since a considered purchase justifies a longer one than an impulse buy. The test is simple. If you would be uncomfortable seeing your own advert that often, the cap is too loose.

Which audiences should always be excluded from retargeting?

People who already converted, people currently in a sales conversation, existing customers being shown an acquisition offer, anyone who unsubscribed or objected, and internal traffic from staff, suppliers and applicants. Each of those either wastes budget or damages a relationship. Building the exclusions requires the advertising platform to know what the sales and email systems know, which is usually the real project.

What is the difference between first-party and third-party retargeting audiences?

A first-party audience is built from data people gave you directly, such as an email address or an account, then matched to the platform. A third-party pool is assembled from identifiers a browser allowed a script to store. The first is smaller, stable and defensible under privacy rules. The second looks larger and degrades without warning whenever a browser tightens its storage policy.

How do you retarget people without being creepy?

Limit how often they see you, stop when they act, and say something new each time. Most of the discomfort people report traces to three specific things: excessive frequency, adverts that follow a purchase already made, and creative repeating the exact product viewed with no new reason to return. Fixing frequency, exclusions and sequence removes nearly all of it.

Can you prove retargeting actually caused a sale?

Not reliably from platform reporting alone, because retargeting deliberately reaches people who already showed intent and would partly have returned unprompted. The only clean evidence comes from holding out a region or segment long enough to compare, which costs revenue and is rarely approved. Short of that, report retargeting with the caveat attached rather than as incremental revenue.

Facing this in your
own business?

Tell us where you’re headed — we’ll map the shortest honest route.

Start a Project