GoogleAll the figures below come from HTTP Archive’s July 2025 crawl of 16.2 million sites. Every cookie figure comes from its top one million subset, which the Cookies chapter measures separately.
Who else is collecting data on your website?
More companies than you installed. More than nine in ten pages load at least one third party, and on the top one million sites roughly 60% of the cookies a visitor picks up were set by someone other than you.
Content loaded from a site other than the one the visitor typed in. Only domains found on at least five unique pages were counted at all.
The chapter’s functional categories are ad networks, analytics, CDNs, video providers, tag managers and others. Fonts and maps sit in the same bucket as ad vendors.
CNAME cloaking and server-side tracking are counted as first party, so the chapter says its measurements represent a lower bound on actual prevalence.
It does not scroll, click or accept a banner, so anything that only fires after an interaction is not in these numbers.
How many third parties does a normal page load?
Sixteen third-party domains on the median page. Across all sites the median page makes 83 third-party requests on desktop and 79 on mobile, five more than a year earlier.
Web Almanac, 2025 · July 2025 crawl, 16.2 million sites
View data
| Item | Value |
|---|---|
| Top 1,000 desktop | 129requests |
| Top 1,000 mobile | 106requests |
| All sites desktop | 83requests |
| All sites mobile | 79requests |
Those are requests, not companies: the median page reaches 16 domains, and one of them can pull in the next. See also what Google sees when it crawls a contractor’s site.
Which companies are they?
Mostly Google. The top ten third-party domains are dominated by Google-owned services, and Meta’s facebook.com is the only one that is not, at rank seven on 21% of pages.
fonts.googleapis.com, googletagmanager.com, google-analytics.com, accounts.google.com and adservice.google.com all sit in the top ten third-party domains.
facebook.com ranks seventh, present on 21% of pages. It is the only non-Google domain in the top ten.
Measured by providers per page, the top categories are ad, analytics and CDN, in that order. The chapter publishes the order, not a share for each.
The top 1,000 sites load more third-party requests than the rest of the web, but the same names keep appearing.
Web Almanac, 2025 · share of all third-party requests, top three types only
View data
| Item | Value |
|---|---|
| Script | 24.8% |
| Image | 19.9% |
| Other | 13.9% |
How many cookies end up in a visitor’s browser?
A median of nine per site, on the top one million. A quarter of sites set four or fewer, and the top 1% set 395 or more.
Web Almanac, 2025 · top one million sites, all cookies
View data
| Item | Value |
|---|---|
| 25th percentile | 4cookies |
| Median | 9cookies |
| 75th percentile | 23cookies |
| 90th percentile | 44cookies |
The tail runs far past the chart: the heaviest site measured set 915 cookies in a single visit.
Who sets most of those cookies?
Google and Microsoft, by name. On the top one million sites, Google’s domains reach at least 33% of websites and Microsoft’s at least 14%.
Web Almanac, 2025 · top one million sites · approximate shares as the chapter states them
View data
| Item | Value |
|---|---|
| _ga (Google Analytics) | 60% |
| IDE (DoubleClick) | 35% |
| _gcl_au (Google Analytics) | 25% |
| test_cookie (DoubleClick) | 25% |
| MUID (Microsoft) | 23% |
_ga and _gcl_au are set by your own site on behalf of Google Analytics, on around 60% and 25% of websites.
Counting doubleclick.net, google.com and youtube.com, the chapter puts Google’s coverage at at least 33% of websites.
Counting bing.com, clarity.ms and linkedin.com, it puts Microsoft’s at at least 14% of websites.
test_cookie exists so DoubleClick can check whether the browser accepts third-party cookies at all.
What can you check on your own site?
What loads, what each thing leaves behind, and whether a banner you already have does what it claims. None of this is legal advice.
3.8% of sites claim TCF v2 and 1.7% are fully compliant with it, less than half of the ones claiming it. That gap is the thing worth checking on your own banner.
Adoption of any IAB consent framework sits just above 5.5%, with TCF at 4.0%, USP at 3.3% and the newer GPP at 0.9%. The Privacy chapter reports it held steady year over year.
The most common USP string is 1YNY, on 1.296% of sites: notice was given and the visitor did not opt out. The next, 1--- on 1.073%, is a placeholder that carries no meaningful signal.
The chapter’s crawler is US-based, and under TCF a banner is not required for non-EU visitors, so actual framework use is likely higher than what it measures.
- 01List the domains your home page loadsOpen the network panel in any browser and read the domain column. That list is the answer to the headline question for your own site.
- 02Name what each one does, and who added itA font host, a map, a chat widget and an ad pixel all look the same in that list. Someone on your side put each one there.
- 03Remove the ones nobody can explainAn old pixel from a campaign that ended still loads, still sets cookies, and still has a vendor behind it. See what a website audit actually checks.
- 04If you have a banner, test what it turns offThe gap the Privacy chapter measures is between claiming a framework and implementing it. Click refuse, then reload the list and compare.
Start with the list of domains your home page loads. Every other question here is really a question about one line on that list.
- 01List what loads
- 02Name each vendor
- 03Remove the unexplained
- 04Test the banner
Questions owners ask
Is a third party the same as a tracker?
No. The chapter’s categories put fonts, CDNs, video providers and tag managers next to ad and analytics vendors. What they share is that your page asks another company’s server for something while a visitor is looking at it.
My site is small. Does this apply?
The survey is web-wide and is not broken out by industry, so no figure here is for service businesses specifically. It does show third-party cookies falling with popularity: 78% on the top 1,000 sites, just under 50% on the top 10 million.
How long does a cookie stay in a browser?
A median of 364 days on desktop, on the top one million sites. The longest the survey can observe is 400 days, the hard cap Chrome imposes on cookie expiry attributes.
Does a consent banner mean this is handled?
Not by itself. Of the sites measured, 3.8% claim TCF v2 and only 1.7% are fully compliant with it, less than half of the ones claiming it. This is not legal advice.
Sources
- HTTP Archive, Web Almanac 2025, Third Parties chapter (July 2025 crawl; read from the chapter's source text, commit 46992bf, October 25, 2026) (2025)
- HTTP Archive, Web Almanac 2025, Cookies chapter (same crawl, measured on the top one million sites by CrUX rank) (2025)
- HTTP Archive, Web Almanac 2025, Privacy chapter (consent framework figures; the chapter notes its crawler is US-based) (2025)
- HTTP Archive, Web Almanac 2025, Methodology (16,213,084 sites, 15,426,398 of them mobile; CrUX release of June 2025) (2025)
The first meeting starts with findings, not promises.The free Business Health Report reads your business and shows you what it found, in days.
Get Your Free Business Health Report