What the categories mean
Every service in our classification list belongs to one category. These descriptions are about the type of service, not about any particular company or site.
| Category | Counted as tracking? | Entries in the list | Operators |
|---|---|---|---|
| Advertising | yes | 112 | 95 |
| Analytics | yes | 16 | 12 |
| Audience measurement | yes | 5 | 5 |
| Social networks | yes | 4 | 2 |
| Session replay | yes | 4 | 3 |
| Tag managers | no | 3 | 3 |
| Consent management | no | 6 | 5 |
| Paywalls and subscriptions | no | 2 | 1 |
Advertising
counted in the tracking figure
What it does
Services that take part in buying, selling or delivering online ads: ad servers, ad exchanges, bidding platforms and the companies that match ads to audiences. When a page loads, several of them can be contacted within milliseconds to decide which ad to show.
What it typically receives
Typically the address of the page, browser and device details, an approximate location derived from the connection, and an identifier kept in a cookie or similar. Some companies also match their identifiers with each other (often called “cookie syncing”), which can let one company recognise a visitor another one already knows.
Analytics
counted in the tracking figure
What it does
Services that count visits, pages and interactions to produce statistics for the site's operator.
What it typically receives
Typically the page address, where the visitor came from, device and browser details and an identifier that recognises returning visitors. Some analytics services belong to advertising companies and can combine this with data from their other services.
Audience measurement
counted in the tracking figure
What it does
Services that measure how many people, and what kind of audience, visit sites, often to produce the ratings used to sell advertising.
What it typically receives
Typically page views with an identifier, sometimes combined with panel data from volunteers. Because the same service is present on many sites, it can build a picture of browsing across them.
Social networks
counted in the tracking figure
What it does
Buttons, embeds and tracking pixels of social networks.
What it typically receives
Contacting them can tell the network that the page was loaded, even if the visitor never presses anything. For a visitor who is logged in to that network, the request may be linked to their account, depending on their settings.
Session replay
counted in the tracking figure
What it does
Services that record or reconstruct what a visitor does on a page (mouse movements, clicks, scrolling and, unless masked, sometimes typed text) so the site's operator can watch it back.
What it typically receives
Interaction data from the page. Vendors offer ways to mask sensitive fields; whether a site uses them is not visible to a passive measurement, so we only report that the service was contacted.
Tag managers
not counted in the tracking figure
What it does
Containers that load other scripts on behalf of the site.
Why it is not counted
A tag manager is not tracking by itself, so it is not counted. What it loads can belong to any other category; when those services are contacted they are classified and counted separately.
Consent management
not counted in the tracking figure
What it does
Services that show the cookie banner and remember the visitor's choice.
Why it is not counted
They are contacted to display the banner and to store the choice, so they are listed but not counted. Our “After the banner” test uses their buttons.
Paywalls and subscriptions
not counted in the tracking figure
What it does
Services that manage subscriptions and limits on free articles.
Why it is not counted
They often need to recognise returning visitors to count free articles, so they are listed but not counted as tracking.
What a service can do on your computer
On every site page we list what each tracking service did in the browser that loaded it. These are the things we count, in plain words:
- Ran a script. The service sent a program that your browser executed. A script can read details of the page and the browser, set cookies and send information back. What a particular script does is not visible to us, and the same kind of script is used for harmless purposes too.
- Image request (“pixel”). The browser asked the service for a picture, often a single transparent dot. The picture does not matter: the request itself tells the service that the page was loaded, along with the browser's usual details and any cookie it already has.
- Background request. The page sent or fetched data from the service without anything appearing on screen.
- Embedded frame. A small page from the service shown inside the page, often an ad.
- Cookie. A small piece of text the service asked your browser to keep. Session cookies disappear when you close the browser; the others stay, sometimes for a year or more, and are sent back to the service on later visits. We record each cookie's name and lifetime, never its value.
- Script behaviours. We also note when a script from a third-party domain calls browser features used for fingerprinting or tracking (reading image data from a canvas, asking for location, opening a WebRTC connection). These features have many legitimate uses, so a note is not an accusation.
All of this happens before you click anything. What each service receives, stores or does with it afterwards depends on its configuration and its own policies, and cannot be seen from the browser.
What we do not claim
- We do not rate how invasive a company is, and there is no “privacy score”. The figures are counts of what a page contacted.
- Companies and sites can reply or ask for a correction: see About and corrections.
- For what a specific company says it does with data, read its own privacy documentation. A page per company, with sources, may be added later.