Method and limits

What we measure, how, and what the numbers do not say.

What the numbers mean

• Tracking services are the distinct third-party services in our list classified as advertising, analytics, social or audience measurement that were contacted during the observation window. Tag managers, consent tools and paywalls are listed but not counted. What each category means.
• The count is before any interaction. A site that blocks everything until you accept shows a low number here; what happens after a choice is measured separately on After the banner.
• Counts describe what was contacted. They do not say what data was sent, why, or whether it was lawful.

Bands

For quick reading, the count of tracking services is also shown as a band. The ranges are fixed and public:

• A band is a label for a range of a count. It is not a grade of a site's privacy, ethics or legality, and a higher letter does not mean worse behaviour once a visitor has made choices.
• Only the count measured before any interaction is banded, and only when the confidence is high or medium. Results with low confidence get no band.
• The classification list is limited, so a count is a minimum: a site may contact more services than we recognise. The ranges may change as the list grows; any change will be announced here and in the feed.

Limits

• The measurement runs from GitHub servers in the US. Banners, consent walls and redirects differ by country, so results can differ for a reader elsewhere.
• The classification list is limited and hand-built. Domains missing from it appear as “Unclassified” and are not counted. Entries marked inferred rest on request paths or host names, not on a statement by the operator.
• Ownership of a site's own domains is declared by us and can be wrong. We take the outlet's side when unsure.
• Some sites refuse automated browsers. We report that instead of bypassing it. A failed pass lowers the confidence of a result: high means every pass worked, medium a majority, low a minority (indicative only, never compared).
• Script behaviour (canvas reads, geolocation, WebRTC) is recorded with the calling script's domain. These APIs have many legitimate uses.

Weight of third-party content

For each request we also record the transfer size of its response (headers plus compressed body) when it finished loading inside the observation window. “Third-party data” is the sum for third-party domains, and the share is measured against everything transferred in the same window. Sizes of responses that were still loading when the window closed are not counted, cached responses are not a factor (every pass uses a fresh browser), and pages that stream or load more later (video, infinite scroll) are cut at the window. Reports measured before sizes were collected show a dash.

What each service did in the browser

Each site page lists, for every tracking service seen in most passes, how many scripts, image requests, background requests and frames it made and which cookies it set (name and lifetime, never the value). The numbers are medians of the passes that worked, taken from the raw request log, so they can be checked in the published reports. They describe what happened in the browser, not what the service does with the data. Cookie lifetimes are recorded from schema 0.2 on; earlier reports only tell whether a cookie persists.

Reach by company

The Companies page counts, for each operator named in our list, the sites where one of its services in a tracking category was contacted in most passes. Subsidiaries are not merged into parents.

Two separate tests

Besides the weekly ranking, which never interacts with the page, two optional tests are published on their own pages. They use the same browser and classification list, are stored in their own folders and never change the weekly figures.

• After the banner: after the passive window, the consent banner's reject (or accept) button is pressed once and the next window is recorded. Only that one button is pressed, and only when our detector is confident it is that button.
• With a blocking list: the page is loaded while blocking the requests a public privacy filter list targets (domain rules only), and compared with the passive measurement from the same place.

Data and downloads

Everything is published under CC BY 4.0 (credit “Tracker Watch”). Fields and files are versioned (schema 0.2).

Blank cells mean not measured (or, for byte figures, not recorded by older reports). Counts are minimums because the classification list is limited.

Classification list

152 entries. Source: Small hand-written starter list, not audited. To be replaced or extended by a public tracker list once its licence has been reviewed (Disconnect, EasyPrivacy, DuckDuckGo Tracker Radar). Keys are domain suffixes; the longest matching suffix wins.