Websites set a median of 9 cookies per page load in 2025, according to HTTP Archive's Web Almanac crawl of the top 1 million websites, while the mean sits far higher at 23, per ShieldPage's March 2026 analysis of 5,000 sites across 12 industries. Neither number is wrong. They describe the same skewed distribution from two different angles: most sites are lean, a handful of media and ad-heavy sites are loaded, and the mean gets pulled toward the loaded end.
How many cookies does a website set on average?
The honest answer depends on whether "average" means the typical site or the mathematical mean, and the two diverge sharply here. HTTP Archive's Web Almanac, which crawls the top 1 million websites every year without interacting with any cookie banner, found a median of 9 cookies per page load in its July 2025 crawl, down slightly from a median of 10 in the June 2024 crawl. ShieldPage's separate March 2026 analysis of 5,000 sites reports a mean of 23 cookies and a median of 17, with a range running from 3 cookies on minimal small-business sites to 147 on heavy advertising and media pages.
Figure 1: Distribution of cookies per website across percentiles. Source: HTTP Archive Web Almanac, Cookies chapter, July 2025 crawl of the top 1 million websites.
The gap between the 25th percentile (4 cookies) and the 90th percentile (44 cookies) on desktop shows why a single "average" figure hides more than it reveals. A lean brochure site and a news homepage loaded with ad-tech partners are not comparable, even though both get folded into the same nationwide mean.
What is the split between first-party and third-party cookies?
Third-party cookies, set by domains other than the one a visitor is browsing, made up 61% of all cookies recorded across HTTP Archive's 2024 crawl of 1 million websites. First-party cookies, set by the site itself, accounted for the remaining 39%. ShieldPage's 2026 study of 5,000 sites landed on the same 61% third-party share independently, two years and a different methodology apart.
Figure 2: First-party versus third-party cookie share. Source: HTTP Archive Web Almanac, Cookies chapter, June 2024 crawl of the top 1 million websites.
Third-party concentration climbs with a site's popularity. HTTP Archive found the top 1,000 most-visited sites carry a 77% third-party share, well above the 61% average across the full 1-million-site sample, because larger sites run more analytics, advertising, and social-embed scripts than smaller ones.
Which industries set the most cookies?
Cookie counts vary by roughly a factor of seven between the heaviest and lightest industries. ShieldPage's March 2026 breakdown of 5,000 sites across 12 industries found media and publishing sites averaging 54 cookies per page load, more than six times the 8-cookie average recorded for nonprofit and education sites.
Figure 3: Average cookies per website by industry vertical. Source: ShieldPage, analysis of 5,000 websites across 12 industries, March 2026.
Ad and subscription-funded business models explain most of the gap. Media, travel, and retail sites all run remarketing pixels, on-site personalization, and third-party analytics layered on top of core site functionality, while professional-services and nonprofit sites tend to run little beyond basic analytics and a session cookie.
| Source | Sample size | Metric | Value |
|---|---|---|---|
| HTTP Archive Web Almanac (2025) | 1,000,000 sites | Median cookies, desktop | 9 |
| HTTP Archive Web Almanac (2024) | 1,000,000 sites | Median cookies, desktop | 10 |
| ShieldPage (2026) | 5,000 sites | Mean cookies, all industries | 23 |
| ShieldPage (2026) | 5,000 sites | Mean cookies, media/publishing | 54 |
Do cookies load before a visitor accepts a consent banner?
Frequently, and this is where the two data sources tell a consistent, uncomfortable story. HTTP Archive's own methodology notes state plainly that its crawler "does not interact with cookie banners (if any)," which means every count above reflects what a first-time visitor's browser receives before touching a banner at all. ShieldPage's 2026 analysis measured this directly and found that 43% of the 5,000 sites in its sample loaded at least one non-essential cookie before any consent interaction occurred.
That pattern lines up with what independent research on cookie acceptance has already found: banner design, not user intent, decides most consent outcomes, and a site that pre-loads non-essential cookies is not giving visitors a real choice regardless of what its banner says. Our cookie consent statistics for 2026 cover acceptance rates and enforcement costs in more depth. If your site's cookie disclosures have not been reviewed recently, you can generate a privacy policy that lists every category of cookie your site actually sets, rather than a generic template that omits half of what a scan would find.
How has the average cookie count changed over time?
ShieldPage's 2026 report tracked its own dataset back to 2022 and found average cookies per site declining slightly each year: 27 in 2022, 25 in 2024, and 23 in 2026. The third-party share moved the same direction, from 71% in 2022 down to 61% by 2026.
Figure 4: Average cookies per site trending down over three ShieldPage survey years. Source: ShieldPage, 5,000-site analysis, March 2026.
Figure 5: Cookie-count figures plotted against the year each source measured them. Sources: HTTP Archive Web Almanac (2024, 2025 editions), ShieldPage (March 2026).
The decline is modest rather than dramatic, and it tracks a period of tightening cookie regulation and browser-level restrictions on third-party tracking rather than a wholesale shift away from cookies. Sites are trimming the edges of their tracking stack, not removing it.
Which cookies actually require consent?
Not every cookie on a site needs a visitor's permission. GDPR's ePrivacy rules exempt cookies that are strictly necessary for a service the visitor explicitly requested, such as a shopping cart or a login session, while cookies used for analytics, advertising, or personalization require an opt-in first.
Figure 6: The consent test regulators apply to each cookie category. Source: GDPR ePrivacy guidance, as categorized in ShieldPage's 2026 cookie-purpose breakdown.
ShieldPage's category breakdown of its 5,000-site sample put 31% of all cookies in the essential bucket, covering session management, shopping-cart state, security tokens, and infrastructure load balancing, against 69% in categories that need consent: analytics, marketing and advertising, personalization, and social-media embeds.
Which vendors show up most often?
A small number of third-party vendors account for the bulk of tracking cookies across the web. ShieldPage's 2026 scan of 5,000 sites found Google-owned scripts, including Analytics, Ads, and DoubleClick, on 78% of sites, far ahead of any competitor.
| Vendor | Share of sites (2026) |
|---|---|
| Google (Analytics, Ads, DoubleClick) | 78% |
| Meta (Pixel, social plugins) | 61% |
| LinkedIn (Insight Tag, social plugins) | 34% |
| HubSpot | 18% |
| Hotjar | 16% |
| Intercom | 12% |
These figures do not sum to 100% because a single site typically runs several vendors at once. A retail site with a Meta Pixel for remarketing, Google Analytics for traffic reporting, and Hotjar for session recording contributes to all three counts simultaneously, which is part of why cookie counts climb so quickly once a site moves past analytics into a full marketing stack.
The Bottom Line
The honest answer to "how many cookies does the average website set" is two numbers, not one: a median of 9 that describes the typical site, and a mean of 23 that describes what the whole web looks like once heavy media and advertising sites are folded in. Either number matters less than what sits behind it: 61% of those cookies belong to third parties the visitor never directly interacted with, and roughly 43% of sites let at least one non-essential cookie load before the visitor makes any consent choice at all. For a site owner, that last figure is the actionable one. A cookie policy that lists categories your scanner found two years ago, rather than what your site actually loads today, will not match reality, and you can generate an updated privacy policy that reflects your current cookie footprint instead of guessing at what changed.
Frequently Asked Questions
How many cookies does the average website set? Websites set a median of 9 cookies per page load, according to HTTP Archive's 2025 Web Almanac crawl of the top 1 million sites, while the mean is much higher at 23 cookies, per ShieldPage's March 2026 analysis of 5,000 sites across 12 industries. The gap between the two numbers exists because a small number of heavy media and advertising sites pull the average upward.
What percentage of cookies on the average site are third-party? 61% of cookies are set by third parties rather than the site owner, a figure confirmed independently by both HTTP Archive's 2024 crawl of 1 million sites and ShieldPage's 2026 analysis of 5,000 sites.
Which industries set the most cookies? Media and publishing sites set the most, averaging 54 cookies per page load, followed by travel and hospitality at 41, according to ShieldPage's March 2026 breakdown of 5,000 websites across 12 industries. Nonprofit and education sites set the fewest, averaging 8.
Do cookies load before a visitor accepts a consent banner? Often, yes. 43% of sites load at least one non-essential cookie before any consent interaction, per ShieldPage's 2026 analysis, and HTTP Archive's crawler explicitly does not interact with consent banners at all, meaning its cookie counts reflect what a first-time visitor's browser receives by default.
Where the Numbers Come From
- HTTP Archive. (2025). "Web Almanac 2025, Cookies chapter." Median 9 cookies per page (desktop), crawl of the top 1 million websites, July 2025.
- HTTP Archive. (2024). "Web Almanac 2024, Cookies chapter." Median 10 cookies per page, 39% first-party versus 61% third-party split, crawl of the top 1 million websites, June 2024.
- ShieldPage. (2026). "The Average Website Sets 23 Cookies." Vendor blog analysis of 5,000 websites across 12 industries, published March 2026. Methodology and sample size are self-reported by the vendor rather than independently peer-reviewed.
- W3Techs. "Usage Statistics of Cookies for Websites." 41.6% of all websites set a detectable cookie on their homepage, dated 25 July 2026.
Note: All figures verified as of July 2026. HTTP Archive's Web Almanac figures reflect cookies observed before any consent-banner interaction, since its crawler does not click through banners. ShieldPage's figures are a single vendor's self-reported study rather than a peer-reviewed source and should be read as directional. This post is refreshed at least twice a year to track new Web Almanac editions.
