What actually runs on the web, who owns it, and how it behaves — measured from 15.7M root pages in the public HTTP Archive crawl, not from surveys. Eight sections: adoption, market share, page burden, the entities behind the requests, the cookies they set, and which trackers travel together. Every percentage below shows the two counts it divides, every chart has its rows as a table and a CSV, and the full method and all ten queries are published.
68.3%of pages fire at least one request to a known tracker10,732,563 / 15,707,041 pages
79.8%of pages make at least one request to a Google-owned domain12,536,065 / 15,707,041 pages
6distinct third-party domains contacted by the median pagemedian of 14,576,517 pages
13.5%of pages show a detectable consent platform2,113,504 / 15,706,731 pages
40%of pages with analytics run two or more analytics tools3,943,906 / 9,911,318 pages
Every number here is checkable. The source is the public HTTP Archive crawl on BigQuery — not a
private dataset — so the ten queries that produced this report can be re-run by
anyone against the same tables. See the arithmetic ·
download the data · read the limits.
Share of pages running each technology category, across the last four quarterly crawls. Analytics rose from 63.0% to 65.6% of all pages; cookie-compliance tooling is flat at ~13.5%. The gap between the two is the consent debt of the web.
Share of root pages with the category detected (Wappalyzer-based), mobile crawl. n ≈ 15.7–15.9M pages per quarter.Data table
Category
Q3 ’25
Q4 ’25
Q1 ’26
Q2 ’26
Analytics
63.0%
66.1%
66.0%
65.6%
Tag managers
26.6%
26.8%
26.6%
26.4%
Cookie compliance
13.6%
13.8%
13.8%
13.5%
A/B Testing
3.1%
3.2%
3.3%
3.3%
Customer data platform
1.2%
1.1%
1.1%
1.1%
Latest crawl: Analytics 10,303,605 of 15,706,731 pages · Cookie compliance 2,113,504 of 15,706,731. Per-quarter counts are in the CSV.
2 · The analytics market, from the top 1k to the top 1M
Google Analytics sits on 56.0% of the top-1M sites — but only 49.7% of the top 1k, versus a peak of 60.5% around the top 10k. The largest properties are exactly where the alternatives (Snowplow, Matomo, first-party pipelines) show up most.
Google Analytics only. Share of pages in each CrUX rank bucket where GA is detected, 2026-06-01 crawl. Top-1k bucket is small (n=748 root pages, mobile).
…and the rest of the field
The same rank buckets, now with the four next-largest platforms plotted alongside GA. The challengers behave differently from each other: Snowplow concentrates in the top 10k, Clarity grows toward the long tail, and Adobe Analytics runs on 2.5% of the top 1k but 0.50% of the top 1M.
Wappalyzer-based detection per CrUX rank bucket, 2026-06-01 crawl (top-1k n=748 root pages, mobile). Legend values are the top-1M share.Every analytics technology by bucket — including Adobe and the mid-market
Technology
top 1k
top 5k
top 10k
top 50k
top 100k
top 500k
top 1M
Google Analytics
49.7%
59.4%
60.5%
58.5%
57.2%
55.9%
56.0%
Facebook Pixel
10.3%
18.6%
19.4%
20.2%
21.2%
23.5%
24.6%
Cloudflare Browser Insights
15.1%
21.5%
23.7%
24.6%
23.3%
21.4%
18.5%
Microsoft Clarity
4.0%
10.3%
9.9%
11.2%
11.1%
10.8%
9.8%
TikTok Pixel
2.9%
5.9%
6.9%
7.3%
6.8%
6.0%
4.9%
Hotjar
1.9%
3.1%
3.6%
3.6%
3.7%
3.8%
3.7%
Site Kit
·
·
·
1.5%
1.9%
2.4%
3.4%
Snowplow Analytics
14.0%
15.9%
12.8%
10.8%
7.9%
4.9%
3.4%
Yandex.Metrika
3.2%
4.5%
4.4%
3.7%
2.9%
2.7%
2.8%
Matomo Analytics
4.1%
4.7%
4.0%
3.3%
2.9%
2.8%
2.5%
Linkedin Insight Tag
·
1.7%
2.1%
2.2%
2.4%
2.4%
2.3%
Pinterest Conversion Tag
1.3%
2.9%
2.4%
2.4%
2.2%
1.8%
1.3%
comScore
4.9%
5.4%
4.8%
3.1%
2.2%
1.2%
0.9%
HubSpot Analytics
·
·
·
·
·
0.8%
0.9%
PixelYourSite
·
·
·
·
·
·
0.8%
Datadog
3.3%
3.9%
3.4%
2.3%
1.8%
1.0%
0.7%
Quantcast Measure
·
1.8%
1.4%
1.3%
1.2%
0.9%
0.7%
Google Ads Conversion Tracking
2.0%
2.3%
1.4%
1.5%
1.2%
0.9%
0.7%
VWO
1.2%
·
1.3%
1.1%
1.1%
0.9%
0.7%
Crazy Egg
·
·
1.0%
0.9%
0.8%
0.8%
0.6%
Naver Analytics
0.8%
·
·
·
·
0.7%
0.6%
Google Analytics Enhanced eCommerce
·
·
·
·
·
·
0.6%
MonsterInsights
·
·
·
·
·
·
0.6%
Plausible
1.6%
·
1.4%
1.0%
0.8%
0.6%
0.5%
Adobe Analytics
2.5%
3.2%
2.5%
2.1%
1.5%
0.8%
0.5%
Chartbeat
2.7%
3.2%
2.2%
1.6%
0.8%
·
·
Marfeel
2.4%
2.5%
2.2%
1.6%
0.7%
·
·
Adjust
2.0%
2.1%
1.4%
·
·
·
·
Liveinternet
1.3%
1.5%
1.8%
1.2%
0.9%
0.6%
·
Gemius
1.2%
2.8%
2.5%
1.5%
0.8%
·
·
Ahrefs
0.9%
·
·
·
·
·
·
Appsflyer
0.9%
1.2%
·
·
·
·
·
Braze
0.8%
·
·
·
·
·
·
Dynatrace
·
1.5%
1.6%
1.4%
1.0%
0.5%
·
Mixpanel
·
1.4%
·
·
·
·
·
Contentsquare
·
1.2%
·
·
·
·
·
Kwai pixel
·
·
·
·
·
0.5%
·
· = outside that bucket's top 15 (below the extract's cut), not necessarily zero.
The privacy-first long tail, full-crawl
Bucket top-15s hide the small platforms entirely — so we measured their full-crawl footprint directly:
Share of pages making at least one request matched by our open fingerprint library (66 vendors), by category. 10,732,563 of 15,707,041 pages (68.3%) talk to at least one known tracker; the average page makes 6.0 such requests.
Request-level detection against the 2026-06-01 crawl (15.7M pages). Categories are not exclusive — one page can match several.Data table — the counts behind every bar
Category
Pages with ≥1 match
Pages in crawl
Share
Avg matched req/page
Any known tracker
10,732,563
15,707,041
68.3%
5.99
Analytics
8,850,696
15,707,041
56.3%
1.31
Tag managers
8,051,425
15,707,041
51.3%
1.17
Advertising
4,886,715
15,707,041
31.1%
2.41
Social pixels
2,806,639
15,707,041
17.9%
0.57
Error monitoring
1,068,560
15,707,041
6.8%
0.18
Session replay
1,034,556
15,707,041
6.6%
0.28
Consent / CMP
572,213
15,707,041
3.6%
0.18
Experimentation
119,534
15,707,041
0.8%
0.05
CDP
59,144
15,707,041
0.4%
0.02
“Any known tracker” is a rollup across all 66 vendors, not the sum of the rows — a page matching both an analytics and an advertising rule is counted once.
Put sections 1 and 3 together: 68.3% of pages send data to a known tracker, while 13.5% run a detectable consent platform. Even allowing for consent built in-house, the distance between those numbers is the story.
4 · Who owns the surveillance web
Third-party domains grouped by parent entity (our open entity map — 43 owners over 102 domains, deduplicated at page level in BigQuery so a page loading four Google domains counts once). Google (Alphabet) reaches 79.8% · Cloudflare reaches 26.1% · Meta reaches 19.7% · jsdelivr.net reaches 10.2% · Amazon reaches 9.9% of all pages.
Share of 15.7M pages making ≥1 request to any domain of the entity. Bar color = category (legend at the top of this report).
Where the requests go
The same entities sized by request volume — every third-party request across the crawl, 547.7M in total across the observed set:
Squarified by requests (additive). Small cells: hover for names; full data in the table.Entity table (top 40)
Entity
Category
Pages
Reach
Requests
Sets cookies
Google (Alphabet)
Advertising / ad-tech
12,536,065
79.8%
211.7M
4.2%
Cloudflare
Platforms & infra
4,094,495
26.1%
9.6M
0.7%
Meta
Social & video
3,096,158
19.7%
11.6M
1.6%
jsdelivr.net
Platforms & infra
1,608,833
10.2%
4.3M
—
Amazon
Advertising / ad-tech
1,557,798
9.9%
14.7M
13.1%
Microsoft
Advertising / ad-tech
1,296,780
8.3%
15.7M
32.2%
Automattic
Platforms & infra
896,480
5.7%
7.5M
—
Adobe
Martech, consent & other
842,569
5.4%
5.7M
20.2%
Sentry
Advertising / ad-tech
757,749
4.8%
1.2M
0.0%
Shopify
Platforms & infra
736,185
4.7%
31.8M
2.5%
fontawesome.com
Platforms & infra
723,928
4.6%
2.6M
0.0%
jquery.com
Platforms & infra
710,759
4.5%
869k
—
bootstrapcdn.com
Platforms & infra
637,269
4.1%
1.1M
0.0%
Yandex
Advertising / ad-tech
621,136
4.0%
10.1M
60.4%
unpkg.com
Platforms & infra
595,063
3.8%
1.5M
—
Wix
Platforms & infra
446,842
2.8%
87.5M
0.2%
TikTok (ByteDance)
Social & video
365,364
2.3%
3.1M
12.4%
Criteo
Advertising / ad-tech
310,711
2.0%
3.7M
28.6%
Contentsquare (Hotjar)
Analytics & monitoring
267,615
1.7%
868k
0.0%
LiveRamp
Advertising / ad-tech
267,111
1.7%
1.9M
94.3%
featureassets.org
Advertising / ad-tech
252,819
1.6%
256k
100.0%
Squarespace
Platforms & infra
250,299
1.6%
15.5M
0.0%
prodregistryv2.org
Advertising / ad-tech
248,968
1.6%
501k
100.0%
ID5
Advertising / ad-tech
248,704
1.6%
2.3M
50.3%
bidswitch.net
Advertising / ad-tech
233,777
1.5%
3.4M
48.8%
pinterest.com
Social & video
219,045
1.4%
860k
23.6%
Comcast (FreeWheel)
Advertising / ad-tech
217,020
1.4%
2.4M
98.3%
klaviyo.com
Martech, consent & other
211,417
1.3%
5.3M
0.0%
simpli.fi
Advertising / ad-tech
205,954
1.3%
1.2M
20.6%
creativecdn.com
Advertising / ad-tech
193,872
1.2%
1.4M
13.6%
cookiebot.com
Martech, consent & other
189,819
1.2%
213k
0.0%
3lift.com
Advertising / ad-tech
189,615
1.2%
2.5M
82.8%
trustindex.io
Martech, consent & other
188,872
1.2%
383k
0.0%
turn.com
Advertising / ad-tech
187,340
1.2%
687k
99.5%
liadm.com
Advertising / ad-tech
186,895
1.2%
1.6M
96.8%
stackadapt.com
Advertising / ad-tech
186,244
1.2%
864k
28.4%
temu.com
Martech, consent & other
184,651
1.2%
998k
99.9%
adform.net
Advertising / ad-tech
182,114
1.2%
2.1M
93.5%
CookieYes
Martech, consent & other
177,851
1.1%
1.6M
—
outbrain.com
Advertising / ad-tech
177,174
1.1%
1.1M
90.4%
Reach share = pages ÷ 15,707,041 crawl pages.
The individual domains with the widest reach
Below the entity layer: the 15 most-seen third-party domains, with how many of each domain's requests set cookies. Font/CDN infrastructure is marked — reach isn't automatically tracking — but note doubleclick.net on 29.7% of pages with 24% of its requests setting cookies.
Domain
Reach (pages)
Requests
Sets cookies
googleapis.com infra
57.4%
30.8M
0.4%
gstatic.com infra
55.2%
45.9M
—
googletagmanager.com
51.2%
19.7M
—
google.com
40.9%
34.4M
2.8%
google-analytics.com
39.7%
11.6M
—
doubleclick.net
29.7%
22.6M
23.6%
facebook.net
18.9%
6.8M
0.0%
cloudflare.com infra
15.8%
7.3M
0.9%
cloudflareinsights.com infra
12.9%
2.3M
—
jsdelivr.net infra
10.2%
4.3M
—
googlesyndication.com
8.1%
16.4M
—
youtube.com
6.7%
13.3M
17.9%
googleadservices.com
6.2%
3.8M
0.0%
cloudfront.net
5.6%
8.4M
11.3%
ytimg.com
5.5%
1.9M
—
“Sets cookies” = share of the domain's responses carrying Set-Cookie. “infra” = primarily fonts/CDN/static assets.
Third-party Set-Cookie responses aggregated by cookie name — measured on a 10% block sample of the crawl (header values are the most expensive column in the dataset; counts below are scaled estimates, shares are exact within the sample) — and classified with our open cookie database; names outside every cookie DB are attributed to the entity of their top-setting domain. 26 of the top 40 classify.
Cookie
Vendor
Purpose
Top setter
Times set
__cf_bm
Cloudflare
necessary
leadconnectorhq.com
15.4M
audit
Magnite
advertising
rubiconproject.com
5.6M
audit_p
Magnite
advertising
rubiconproject.com
5.6M
test_cookie
Google DoubleClick
advertising
doubleclick.net
5M
khaos
Magnite
advertising
rubiconproject.com
4.9M
receive-cookie-deprecation
Magnite
advertising
rubiconproject.com
4.9M
khaos_p
Magnite
advertising
rubiconproject.com
4.8M
uid
Unknown
unknown
adform.net
4.4M
bh
Yandex
advertising
yandex.com
3.5M
i
OpenX
advertising
openx.net
3.1M
uids
Unknown
unknown
pixad.com.tr
2.8M
tuuid
Unknown
unknown
360yield.com
2.8M
TDID
The Trade Desk
advertising
adsrvr.org
2.7M
vdz_sync
Unknown
unknown
cootlogix.com
2.6M
PugT
PubMatic
advertising
pubmatic.com
2.6M
TDCPM
The Trade Desk
advertising
adsrvr.org
2.6M
ljt_reader
Sovrn
advertising
lijit.com
2.5M
MUID
Microsoft
advertising
clarity.ms
2.4M
33x_ps
Unknown
unknown
33across.com
2.4M
ayl_visitor
Unknown
unknown
omnitagjs.com
2.3M
__Secure-YEC
Google (Alphabet)
advertising
youtube.com
2.3M
VISITOR_INFO1_LIVE
Google (Alphabet)
advertising
youtube.com
2.2M
VISITOR_PRIVACY_METADATA
Google (Alphabet)
advertising
youtube.com
2.2M
pi
PubMatic
advertising
pubmatic.com
2.2M
AWSALB
AWS Elastic Load Balancer
necessary
cloudfront.net
2.1M
How long they live
Lifetime mix for the ten most-set cookie names (from Max-Age; darker = shorter, lighter = longer):
Share of each name's Set-Cookie responses by declared lifetime. "Expires-only" = an Expires date with no Max-Age (not bucketed).Data table — lifetime mix per cookie name
Cookie
session
≤1 day
≤30 days
≤1 year
>1 year
Expires-only
__cf_bm
—
—
—
—
—
100.0%
audit
—
—
—
100.0%
—
—
audit_p
—
—
—
100.0%
—
—
test_cookie
—
—
—
—
—
100.0%
khaos
—
—
—
100.0%
—
—
receive-cookie-deprecation
—
—
—
65.4%
19.6%
15.0%
khaos_p
—
—
—
100.0%
—
—
uid
0.1%
0.0%
4.6%
8.2%
0.9%
86.2%
bh
—
—
—
—
—
100.0%
i
0.0%
—
—
57.3%
—
42.7%
Rows are ratios within each name's own Set-Cookie responses, so they are unaffected by the 10% sample. Absolute counts for all 40 names are in the CSV.
Reading a row: of the pages running A, what share also run B? The grid exposes the bundles — the Google stack, the Microsoft stack, and how consent platforms attach to each.
Row-conditional shares (values ≥30% printed, in %). One blue, darker→lighter with magnitude; diagonal blank.Data table — the 30 most common pairs (of 185)
Technology A
Technology B
Pages with both
Of A's pages
Of B's pages
Google Analytics
Google Tag Manager
3,597,533
45.0%
88.0%
Facebook Pixel
Google Analytics
2,022,303
84.7%
25.3%
Facebook Pixel
Google Tag Manager
1,331,228
55.8%
32.5%
Cloudflare Browser Insights
Google Analytics
1,005,545
54.1%
12.6%
Google Analytics
Microsoft Clarity
683,390
8.6%
91.3%
Cloudflare Browser Insights
Google Tag Manager
578,166
31.1%
14.1%
Google Tag Manager
Microsoft Clarity
558,676
13.7%
74.7%
Facebook Pixel
Microsoft Clarity
364,596
15.3%
48.7%
Cloudflare Browser Insights
Facebook Pixel
333,269
17.9%
14.0%
Google Analytics
Snowplow Analytics
331,750
4.2%
77.3%
Google Tag Manager
Snowplow Analytics
270,675
6.6%
63.0%
Google Analytics
Hotjar
250,039
3.1%
93.3%
CookieYes
Google Analytics
238,486
61.4%
3.0%
Google Analytics
TikTok Pixel
207,817
2.6%
84.0%
Facebook Pixel
TikTok Pixel
207,372
8.7%
83.8%
Google Tag Manager
Hotjar
203,194
5.0%
75.9%
Google Tag Manager
TikTok Pixel
175,186
4.3%
70.8%
Google Analytics
Yandex.Metrika
170,477
2.1%
34.1%
Cookiebot
Google Analytics
170,392
84.4%
2.1%
CookieYes
Google Tag Manager
158,024
40.7%
3.9%
Facebook Pixel
Hotjar
155,676
6.5%
58.1%
Cookiebot
Google Tag Manager
138,482
68.6%
3.4%
Google Analytics
Matomo Analytics
135,773
1.7%
41.1%
Google Tag Manager
OneTrust
112,999
2.8%
75.3%
Cloudflare Browser Insights
Microsoft Clarity
109,989
5.9%
14.7%
Google Tag Manager
Matomo Analytics
100,952
2.5%
30.5%
Google Analytics
OneTrust
97,928
1.2%
65.3%
Google Analytics
New Relic
96,616
1.2%
69.4%
Datadog
Google Analytics
94,000
60.2%
1.2%
Google Tag Manager
Yandex.Metrika
88,144
2.2%
17.6%
All 185 pairs are in the CSV. Pairs seen on fewer than 5,000 pages are cut from the extract.
Analytics stacking
Of pages running at least one analytics tool, 39.8% run two or more at once — double-tracking is normal, not an edge case.
Every one of the top 200 third-party domains: how much of the web it touches (x) against how often its responses set cookies (y). The top-right is the surveillance sweet spot; wide-reach zero-cookie domains are mostly fonts and CDNs.
200 domains, colored by category (legend at the top of this report). Cookie share = responses carrying Set-Cookie ÷ all responses from that domain.Data table — the 25 widest-reaching of the 200 plotted domains
Source: the public HTTP Archive dataset on BigQuery (httparchive.crawl.pages / .requests) — crawls of Q3 ’25, Q4 ’25, Q1 ’26, Q2 ’26; mobile client; root pages only (15.7M in the 2026-06-01 crawl). Third-party = the request's registrable domain differs from the page's.
Request detection (§3): every request URL tested against our open, versioned fingerprint library (66 vendors). The free Pixel & Tag Scanner uses the same rule format on a 52-vendor subset, so a scan there is a floor relative to these numbers.
Entities (§4, §8): our own curated, open domain→owner map (43 owners, 102 domains); multi-domain entities deduplicated per page in SQL, single-domain entities measured directly.
Cookies (§5): aggregated from response Set-Cookie headers; names classified by the same open database behind the Cookie Scanner. JavaScript-set cookies are not visible to this method.
Reproducible: HTTP Archive is a public dataset, and all ten queries are published in full — anyone can re-run them against the same tables. The rows behind every chart are downloadable as CSV. Generated 2026-08-01 (§1–3) and 2026-08-02 (§4–8).
Honesty notes: the top-1k bucket is small (n=748); category detection and request detection are different methods and are only compared directionally; reach ≠ tracking for infrastructure domains; the cookie census runs on a 10% block sample (its counts are ×10 estimates, while lifetime mixes are ratios and sample-safe) and sees header-set cookies only; technology pairs below 5k pages are cut from the co-occurrence extract; “·” in the market-share table means below that bucket's top-15 cut, not zero; category colors are editorial groupings.
Get the next data drop first
This report refreshes quarterly, and the next layer — entity concentration over time, fingerprinting signals, and the consent gap by country — lands with it. Subscribers get each drop first, plus The Tracking Wire weekly and the Web Tracking Field Guide.
Weekly. Free. One-click unsubscribe. Opens Substack in a new tab — you won't lose your place here.