v152 · Web APIs · Privacy

CHIPS Explainer

Related Website Sets (RWS) — Chrome's mechanism for granting cross-site cookie access across a declared set of related domains — is being removed. The primary replacement for most use cases is CHIPS: Cookies Having Independent Partitioned State. This explainer shows the key difference and how to migrate.

How CHIPS replaces RWS

brand.com (primary)

RWS declaration: brand.com owns auth.brand.com, cdn.brand.com

auth.brand.com cdn.brand.com

accessible from all three sites

RWS let a "primary" site declare a JSON set of associated sites. Sites within the same set could access each other's unpartitioned cookies after calling document.requestStorageAccess(). The browser automatically granted cross-site cookie access within the set.

brand.com

→

competitor.com (different RWS)

Cross-set access: blocked
But within a set: unpartitioned cookies are shared → cross-site tracking vector

Regulators and privacy researchers argued that RWS allowed organizations to label an arbitrary collection of domains as "related," then access unpartitioned cross-site cookies across all of them — a cross-site tracking mechanism with a label. The Privacy Sandbox team decided to remove RWS and replace it with CHIPS for the embedded content use case.

CHIPS: same embed on different top-level sites → different cookie jars

site-a.example

embed.brand.com

site-b.example

embed.brand.com

CHIPS partitions the cookie jar by top-level site. embed.brand.com embedded in site-a.example gets a completely separate cookie from embed.brand.com embedded in site-b.example. No cross-site tracking — but the embed still works with its own session.

# Before (RWS — removed)
# /.well-known/related-website-set.json on primary domain
{
  "primary": "https://brand.com",
  "associatedSites": ["https://auth.brand.com"]
}

# After (CHIPS — no JSON file, just Set-Cookie attribute)
# On the embedded origin's server response:
Set-Cookie: embed_session=abc123;
  Partitioned;          # enables CHIPS partitioning
  SameSite=None;         # required for cross-site embeds
  Secure;                # required with SameSite=None
  HttpOnly;
  Path=/;
  Max-Age=86400

Migration is a single attribute addition: add Partitioned to any SameSite=None; Secure cookie. No JSON file, no domain registration, no browser origin trial. Works in Chrome 114+, Firefox 132+, Safari (partitioned by default).

see also