Behavioral targeted advertising: the four kinds of behavior it runs on, who is withdrawing each one, and what replaces it

Behavioral targeted advertising means choosing who sees an advertisement from what a person has already done, rather than from who they are or what they are searching for right now. It is defined entirely by its data supply, which is why it has changed more in the last five years than any other form of targeting. There are four kinds of behavior being targeted, each arrives through a different mechanism, and each one is being restricted by a different party: the browser makers, the mobile operating systems, and state privacy law. Knowing which of the four your campaigns rely on tells you what you lose and what to put in its place.

The four kinds of behavior, and where each one comes from

Behavior	How it reaches an ad platform	Who controls the supply	What it is used for
On your own site or app	Your own analytics, tags and customer records	You do	Retargeting visitors, excluding existing customers, triggered email
Across other people's sites	Third party cookies and tracking pixels set by an ad network	The browser maker	Interest categories, audience segments bought from a platform or a data provider
Inside mobile apps	A device advertising identifier passed by the app	The mobile operating system	Cross app audiences, app install campaigns, measurement
Purchases and offline activity	Customer lists uploaded and matched, or bought from a data provider	You and the data provider, inside privacy law	Customer match, lookalikes, suppression lists

Only the first and the last are supplies you have any ownership of. The middle two are borrowed from companies whose incentives point the other way, and that is the whole story of what has happened to this form of advertising. For where behavioral signals sit among the other ways to choose an audience, the full menu is in audience targeting in marketing and the six signals.

Who is withdrawing each supply, and what takes its place

These restrictions arrived separately, from parties with separate reasons, which is why a plan that treats them as one event gets the replacement wrong.

• Browser defaults on cross site cookies. Safari blocks third party cookies by default and has done since 2020, following several years of its tracking prevention work. Firefox blocks third party tracking cookies by default and later added isolation of cookies per site. For visitors on those browsers, cross site behavioral audiences and the attribution built on them were already gone before any policy debate. What replaces it: contextual placement, which targets the page rather than the person, and your own first party data.
• Chrome and the Privacy Sandbox. Google has published a set of proposals, including an interest based one called the Topics API, intended to deliver interest categories from the browser rather than from cookies. Its position on whether to remove third party cookies from Chrome at all has been revised more than once. Read the current state on Google's own Privacy Sandbox announcements rather than in any article, this one included, because this is the single fastest moving item on the page.
• Mobile operating systems on the device identifier. Since iOS 14.5, an app has to ask the user's permission through a system prompt before accessing the device advertising identifier for tracking across other companies' apps and sites. That turned a default supply into an opt in one. What replaces it: modeled and aggregated measurement from the ad platforms, your own logged in data, and campaign structures that need fewer small audiences.
• State privacy law on the use itself. California's privacy law names cross context behavioral advertising directly and gives residents a right to opt out of their data being shared for it, including through a browser signal a site has to honor. A growing number of other states have comprehensive laws with comparable opt out rights for targeted advertising. What replaces it: nothing. This one is a constraint on the use rather than a gap in the supply, so the answer is a consent and preference record rather than a different data source.
• European consent rules. In the European Union, non essential cookies need consent before they are set, and the data behind behavioral targeting sits under the General Data Protection Regulation. Consent bites earlier there than in the United States, so a single global tag setup usually gets one of the two markets wrong.

What this changes about a plan, in order

• The list you own is now the strongest behavioral signal you have. Your customers, your subscribers, your visitors, with consent recorded. It is the only one of the four supplies that no browser update removes.
• Contextual is back, and it is not a downgrade. Placing an advertisement beside content about the subject reaches somebody thinking about that subject right now, with no personal data involved. It lost ground because behavioral targeting was cheaper to buy at scale, not because it stopped working.
• Search intent is untouched by all of this. A person typing a query has declared the intent in the query itself, so nothing has to be inferred from their history and no identifier has to survive a browser update. That is why search budgets have been the stable part of most plans through this whole period.
• Suppression matters more than targeting. Excluding existing customers from acquisition campaigns is a first party operation that works regardless of what the browsers do, and it is usually the single biggest efficiency available to a small advertiser.
• Audiences have to be bigger than they used to be. With opt in identifiers and blocked cookies, small narrow audiences no longer fill. Build fewer, broader segments and let the platform's own optimization work inside them.

The consent record is the asset, so build it like one

Every one of the restrictions above assumes you can answer one question about any person in your database: what did they agree to, when, and where. Store that as a record rather than as a checkbox state, with one row per person holding the date, the source, the wording they saw and the scope they agreed to. A database that can produce that row is a database you can keep using when a law changes. A database that holds only an on or off flag has to be re-permissioned from scratch.

The same record is what makes a suppression list reliable. Opt outs belong in a list the next campaign reads, not in a deleted row, because a deleted contact is one re-import away from being mailed again.

How to tell whether behavioral targeting is earning its cost

Platform reporting attributes generously to retargeting, because it reaches people who were already going to come back. Use your own figures and a holdout.

• Hold out a share of the audience. Exclude a random tenth of your retargeting audience, then compare conversions per thousand people between the held out group and the targeted group over the same weeks. The difference is what the advertising added. The rest is attribution.
• Work out the incremental cost per acquisition. Divide the spend by only the extra conversions the holdout comparison revealed, not by every conversion the platform claims. That number is the one to compare against your other channels.
• Separate new from returning. Count acquisition and retargeting results apart. Blending them makes a retargeting campaign look like growth when it is reaching people you already had.
• Check the reach you actually get. If an audience is not filling, the identifiers are not there and the budget is going to whoever is left, which is rarely the segment you defined.

How each platform sells this inventory, and the three buying models underneath it, is set out in paid advertising platforms and the three ways they are bought, which is the page to read before deciding where a behavioral budget goes at all.

Behavioral targeting: the questions a plan has to answer

What is behavioral targeted advertising?

Choosing who sees an advertisement based on what a person has previously done, such as pages visited, content engaged with, apps used or things bought. It is distinct from demographic targeting, which uses who somebody is, and from search targeting, which uses what they are looking for at that moment.

Is behavioral targeting the same as retargeting?

Retargeting is the subset that uses behavior on your own property, which is the part you own and the part that still works everywhere. The broader term also covers audiences built from behavior across other companies' sites and apps, which is the part that depends on borrowed identifiers.

Do I need consent to run it?

In the European Union, consent is required before non essential cookies are set. In the United States, several state laws give residents a right to opt out of their data being used or shared for targeted advertising, and California's law names cross context behavioral advertising specifically and requires a browser opt out signal to be honored. Treat an opt out mechanism and a consent record as part of the build, and take the current obligations for your markets from the regulators rather than from a vendor's summary.

Is it still worth doing?

On your own first party data, yes, and it is one of the highest return things a small advertiser does, because the audience has already shown up once. On bought cross site audiences, test it against a contextual placement on the same budget before committing, since the identifier supply differs sharply by browser and by device and the reach you are quoted is not the reach you will get.

What is the difference between behavioral and contextual targeting?

Behavioral targets the person from their history. Contextual targets the page from its subject. Contextual needs no identifier, survives every browser change, and reaches somebody who is reading about the subject at that moment, which for many categories is a closer signal than a visit they made three weeks ago.

How do I start if I have none of this set up?

In this order: get your own analytics and consent capture working, build a customer list with consent recorded, use it to suppress existing customers from acquisition campaigns, then add retargeting of your own visitors. Only after those four are running does buying somebody else's behavioral audience become a sensible fifth step.

The targeting you have no say in

Every form of targeting above ends with your advertisement in front of a person. A growing share of buyers now shortens that journey: they ask ChatGPT, Gemini, Perplexity or Claude who to use in a category and get back three or four companies with a sentence of reasoning each. No budget bought that placement, no segment was defined, and nothing a browser blocks or allows affects it. It is assembled from what has been published about each company, which makes it the one audience that cannot be bought and the one that is growing. AI Knows Us asks those buying questions across the main assistants and records who gets named and what the answers were built from.