Chrome 80 Launches Secure-by-Default SameSite Cookie Rules
Chrome 80 introduces a new secure-by-default cookie classification system that treats undeclared cookies as SameSite=Lax. Developers must use specific settings to maintain third-party cookie functionality.
Chrome 80 introduces a new secure-by-default cookie classification system that automatically treats cookies without a declared SameSite attribute as SameSite=Lax. This means cookies are no longer sent with cross-site requests by default, which significantly increases user security and privacy. Only cookies explicitly set with the SameSite=None and Secure attributes remain available in third-party contexts, provided the connection is secure.
The enforcement of these new defaults begins in February 2020 with a small percentage of Chrome 80 users before gradually expanding to everyone. Developers can check if their browser applies the new rules by visiting a specific testing page and looking for all green rows. To track the exact timing and progress of this gradual rollout, Google directs developers to monitor the official SameSite Updates page.
Developers need to watch for new warnings in the Chrome Developer Tools console, which flag cross-site cookies that lack the required configuration. These console alerts indicate that cookies supporting certain site features are not properly set up for the new standard. While these warnings usually require developer action, Google notes that some services intentionally issue redundant cookie pairs for legacy compatibility, which triggers harmless warnings for systems like Google's own services.