Reach without the creep: what we gave up by not using cookies
6 min read The Ads.Mahhala Team
Everyone has had the moment. You look at a pair of boots once, and for the next fortnight those boots follow you across every website you open — into the news, into the weather, into an article about someone's divorce. It is the single most-complained-about thing on the internet that is not actually malicious.
We built Ads.Mahhala without it. Not as a marketing angle we arrived at later, but as a constraint we started with: the ads we serve set no cookies on the pages where they appear. No advertising identifier, nothing written to your browser's storage, no profile assembled across sites.
That decision has costs. It is more honest to talk about those first.
What we actually gave up
Some measurement precision. With a cookie you can follow one browser from impression to click to purchase with high confidence. Without one, we match conversions back to clicks using the IP address and browser user-agent within an attribution window. That is a coarser instrument. It will occasionally miss a conversion that really did come from an ad, and it struggles when someone clicks on a phone and buys later on a laptop.
Frequency capping across sites is harder. We can limit how often a campaign shows within a placement and within a session. Guaranteeing that one specific person sees an ad no more than three times across forty different websites in a week is exactly what a persistent identifier is for, and we do not have one.
No retargeting. We cannot offer you the boots-follow-you-around product, because building it requires the thing we chose not to build. If your entire acquisition strategy is retargeting cart abandoners, we are not the right network for that part of it.
Those are real trade-offs, and any network that tells you cookieless costs nothing is selling you something. We think they are worth it. Here is why.
What contextual targeting gets right
The assumption behind behavioural advertising is that who someone is predicts what they will buy better than what they are doing right now. For a lot of purchases, that is simply not true.
Someone reading a 2,000-word article comparing loft insulation materials is, in that moment, a better prospect for insulation than almost any behavioural segment you could build. They have told you what they are thinking about by choosing to read it. You did not have to follow them for six months to learn it, and the signal is fresher than any profile — it is about this week's problem, not last spring's.
This is what contextual targeting does. We match ads to the page, the publisher's declared audience, the country and the device. The page is the signal. It has the pleasant property of being accurate on the first impression rather than after weeks of data collection, and it works identically for someone who has blocked every tracker on earth.
Why this matters more for a small brand
Big brands can absorb being slightly disliked. Their advertising is a background hum, and one creepy retargeting sequence does not change how anyone feels about a company that has existed for eighty years.
A small business does not have that buffer. When you have four hundred customers, each one's opinion is a meaningful fraction of your reputation, and the way you show up in someone's day is part of your product. An ad that appears next to relevant writing on a site the reader already trusts borrows a little of that trust. An ad that visibly demonstrates you have been watching them spends it.
There is also the practical argument. Roughly a third of users run some form of tracking protection, and the number climbs every year as browsers ship it by default rather than as an option. Advertising built on third-party identifiers degrades quietly for all of those people — you keep paying, the targeting keeps getting worse, and the reporting does not tell you it is happening. Contextual placement does not care. The page is the page whether or not the reader has blocked anything.
The consent-banner tax
Here is a cost most people do not price in.
Every non-essential cookie a publisher permits is a row in a consent dialog, and every consent dialog is friction between a reader and the content they came for. It suppresses engagement, it annoys people, and — since the dialogs became mandatory — it has produced a generation of readers who dismiss them reflexively without reading, which serves nobody's interests including the regulator's.
Because we set no cookies through our advertising, we add nothing to that dialog. Publishers on our network do not have to expand their consent flow to carry us. That is a genuine reason for a good publisher to accept our ads, which is a genuine reason there is decent inventory for advertisers to buy. The incentives line up in the right direction, which is rarer in this industry than it should be.
What we are not claiming
We are not claiming to be a privacy product. We run an advertising network, and advertising networks process data.
Our servers log IP addresses, user-agents and derived country when an ad is served or clicked, because you cannot deliver geographically-targeted advertising, bill for it, or detect click fraud without doing so. An IP address is personal data, and we treat it that way. What we do not do is turn any of that into a persistent identity, join it up across unrelated sites, sell it, or let advertisers see individual rows — they see counts and totals for their own campaigns.
The distinction we care about is between processing what delivery requires and accumulating a profile because it might be useful later. We do the first. We have deliberately built ourselves so we cannot do the second, which is a stronger commitment than a policy, because a policy can be revised on a quiet Tuesday.
If you want the full detail, it is in the Privacy Policy and the Cookie Policy, and both are written to be read rather than to be survived.
The bet
Behavioural advertising is not going to disappear next year. But it has been getting steadily less effective and more expensive to maintain for most of a decade — third-party cookies deprecated, mobile identifiers made opt-in, tracking protection on by default, regulators unimpressed.
The bet we are making is that the durable version of this industry looks more like buying attention in the right context than like following individuals around, and that a network built for that from the start is in a better position than one retrofitting it under pressure.
We would rather be early to that than clever about postponing it.
Create an advertiser account to run a campaign, or talk to us about listing your site as a publisher.