48 Trackers Per Site: Online Tracking 2026

The average website loads 48 third-party trackers per visit, according to NordVPN's 2025 research into the top 100 websites across 25 countries, and social media platforms alone average roughly 160. That single number, repeated across billions of page loads a day, is the practical scale of online tracking in 2026: nearly every site you visit is quietly reporting your presence to dozens of companies you never signed up with.

Not every tracker count agrees, because not every study measures the same thing. Below is what the two most-cited public datasets show side by side, followed by who is doing the tracking, how often your data moves through real-time ad auctions, and what changed in 2025 when Google reversed course on killing third-party cookies.

How many trackers does a typical website actually load?

NordVPN's Cybersecurity Research Lab visited the top 100 websites in 25 countries in 2025 using three separate tracker-blocking tools (Brave, Privacy Badger, and uBlock Origin) without logging in, and found 48 trackers per site on average, with social media websites reaching roughly 160 trackers each. A separate, continuously updated dataset from WhoTracks.Me, the Ghostery-maintained tracking observatory, reports a lower figure: 7 trackers per site on average and 41.1% of traffic to the top 10,000 sites touching at least one tracker. The gap is a methodology difference, not a contradiction: WhoTracks.Me counts distinct third-party tracking domains contacted during a page load, while NordVPN's browser-extension count captures a broader set of individual tracking requests and scripts, including ones a domain-level count would collapse into one entry.

Figure 1: Tracker counts vary by what is being counted, from individual requests to distinct tracking domains. Sources: NordVPN Cybersecurity Research Lab (2025), WhoTracks.Me/Ghostery (2025 dataset).

Treat 48 as the realistic mid-range figure for an ordinary commercial website and 160 as the ceiling for ad-supported media and social platforms, since both numbers come from the same research team using the same methodology across the same sites, just split by category.

What percentage of websites use trackers at all?

75% of desktop websites and 74% of mobile websites carry at least one third-party tracker, according to the HTTP Archive's 2025 Web Almanac, published in January 2026 from a crawl of millions of pages. Beyond the yes/no question, the same dataset shows tracking depth: 55% of desktop pages carry two or more trackers, and 39% carry three or more, with mobile pages skewing toward even higher counts at the top end.

Figure 2: Roughly three in four websites track visitors by default. Source: HTTP Archive, 2025 Web Almanac (published January 2026).

A quarter of the web carrying zero third-party trackers sounds like a meaningful privacy-respecting minority, but the Web Almanac's own trend data tells a less reassuring story: a 2026 academic study of educational websites found the mean number of third-party services per site rose from about 1.16 in 2013 to roughly 2.0 after 2022, while the share of sites with zero third-party connections fell from about 52% to 22 to 24% over the same period. Fewer sites are tracker-free with each passing year, not more.

Who is doing the tracking?

A small number of companies account for most of the web's tracking footprint. Google-owned properties appear on 61% of all webpages measured by the 2025 Web Almanac, with Google Analytics alone present on 53% of pages and Google AdSense on 6.18%. Facebook trails at 22% of pages by entity, with the Facebook Pixel specifically embedded on 16%.

Figure 3: Google's tracking footprint dwarfs every other single company. Source: HTTP Archive, 2025 Web Almanac.

On cookies specifically, the same crawl found DoubleClick.net, Google's ad-serving domain, set as a third-party cookie on 20% of desktop sites, ahead of YouTube at 9% and Google.com at 8%. First-party analytics cookies show the same concentration: Google Analytics' _ga cookie appears on 46% of webpages, more than triple the reach of Meta's _fbp cookie at 14%. If your site runs Google Analytics or a Meta Pixel, both of which trigger these exact cookie names, generating a privacy policy that names them by name is a documented legal requirement in most jurisdictions with a cookie-consent law, not just good practice.

How often is personal data exposed through ad auctions?

Every time a webpage with real-time bidding (RTB) advertising loads, a visitor's data, including location, browsing history signals, and device details, gets broadcast to every company bidding for that ad slot, whether or not they win. The Irish Council for Civil Liberties measured the scale of this in May 2022 and found that RTB exposes a person's data 376 times a day in Europe and 747 times a day in the United States, totaling roughly 178 trillion broadcasts a year across both regions combined. At the time of that audit, Google's own documentation listed 964 companies authorized to receive RTB bid data by default, and Microsoft's Xandr platform listed 1,647. No comparably comprehensive follow-up audit has been published since, so treat these as the most complete measurement available rather than a real-time 2026 figure; the RTB ecosystem's basic mechanics have not changed since 2022.

Figure 4: A single person's data moves through real-time bidding auctions hundreds of times a day. Source: Irish Council for Civil Liberties, "The Biggest Data Breach" report (May 2022).

What changed with third-party cookies in 2025?

For most of the past decade, the tracking industry expected third-party cookies to disappear from the dominant browser. That did not happen. Google spent years signaling a full phase-out, then reversed direction twice in 2025 alone.

Figure 5: Six years of delayed deprecation ended with third-party cookies staying on by default. Source: Google Chrome policy announcements, as compiled by Usercentrics and Didomi (2025).

In April 2025, Google confirmed it would not deprecate third-party cookies in Chrome and would not ship the standalone consent prompt it had spent a year designing as a replacement, instead leaving today's existing cookie controls in place. Six months later, in October 2025, Google formally retired the remaining Privacy Sandbox APIs, including Attribution Reporting, Topics, and Protected Audience, on both Chrome and Android, ending a six-year initiative that regulators and the ad industry had never fully adopted. The practical result for 2026: third-party cookies remain a live, default-on tracking mechanism in the world's most-used browser, and the 48-tracker average from NordVPN's research is not a number in decline.

Do visitors know they are being tracked, and does it bother them?

73% of Americans say they have very little or no control over the data companies collect about them, according to Pew Research Center's May 2023 survey, the most recent full re-run of this specific question as of this post's publication. The same research found 81% of respondents felt very or somewhat concerned about how companies use the data they collect, a gap between concern and perceived control that has held roughly steady across Pew's repeated surveys on this topic since 2019.

Metric	Figure	Source
Average trackers per website	48	NordVPN Cybersecurity Research Lab, 2025
Average trackers, social media sites	160	NordVPN Cybersecurity Research Lab, 2025
Websites with 1+ tracker (desktop)	75%	HTTP Archive 2025 Web Almanac
Americans feeling no/little data control	73%	Pew Research Center, May 2023

Table 1: The headline tracking figures from this post, in one place.

Figure 6: How a single page load turns into dozens of tracking events. Source: compiled from HTTP Archive 2025 Web Almanac and ICCL RTB report (2022) figures cited above.

The Bottom Line

Every dataset in this post measures tracking differently, yet all of them point the same direction: the open web runs on third-party tracking by default, not by exception. Whether you use NordVPN's 48-tracker average, the Web Almanac's 75% prevalence figure, or WhoTracks.Me's more conservative domain-level count, three in four websites are sending visitor data somewhere the visitor did not directly choose, and Google's 2025 decision to keep third-party cookies alive means that will not change on its own in 2026. For site owners, the practical obligation runs the other way: if your own site runs Google Analytics, an ad pixel, or any third-party script that sets a cookie or collects an identifier, disclosing exactly what you collect and why is what most cookie and privacy laws require, and you can generate a privacy policy that names your actual trackers rather than relying on a generic template that lists none of them.

Frequently Asked Questions

How many trackers does the average website have? 48 trackers per site on average, according to NordVPN's 2025 analysis of the top 100 websites in 25 countries. Social media sites carry far more, averaging 160 trackers each, and a separate WhoTracks.Me dataset covering the top 10,000 sites puts the median closer to 7 trackers per page, since it counts only domain-level third-party requests rather than every script and pixel NordVPN's browser-based test captured.

What percentage of websites use tracking cookies or scripts? 75% of desktop websites and 74% of mobile websites contain at least one third-party tracker, per the HTTP Archive's 2025 Web Almanac, which analyzed the privacy behavior of millions of pages crawled in 2025.

How many times a day is a person's data exposed through online ad auctions? 376 times a day in Europe and 747 times a day in the United States, according to the Irish Council for Civil Liberties' May 2022 report on real-time bidding data broadcasts, the most recent full-scale audit of this kind, totaling roughly 178 trillion data broadcasts a year across the US and Europe combined.

Is Google still allowing third-party cookies in Chrome? Yes. Google confirmed in April 2025 that it would not deprecate third-party cookies in Chrome after years of delayed plans, and it retired the replacement Privacy Sandbox APIs entirely in October 2025, leaving third-party cookies as a live tracking mechanism in the world's most-used browser going into 2026.

Where the Numbers Come From

1. NordVPN Cybersecurity Research Lab. (2025). Analysis of the top 100 websites in 25 countries (approximately 2,500 sites), tested with Brave, Privacy Badger, and uBlock Origin. Found 48 trackers per site on average, 160 for social media sites.
2. HTTP Archive. (2026). "2025 Web Almanac: Privacy chapter," published January 15, 2026. 75% of desktop and 74% of mobile pages carry at least one third-party tracker; Google present on 61% of pages, Google Analytics on 53%.
3. WhoTracks.Me (Ghostery). Live tracking observatory covering the top 10,000 websites. Reports 7 trackers per site on average and 41.1% of traffic touching a tracker; continuously updated, checked July 2026.
4. Irish Council for Civil Liberties. (2022). "The Biggest Data Breach: ICCL report on the scale of Real-Time Bidding data broadcasts in the U.S. and Europe," published May 2022. 376 daily exposures in Europe, 747 in the US, 178 trillion broadcasts a year.
5. Usercentrics. (2025). "Google's changing approach to third-party cookies: impacts and solutions." Confirms Google's April 2025 decision not to deprecate third-party cookies in Chrome.
6. Usercentrics. (2025). "Google Privacy Sandbox officially shuts down: What it means and what's next." Documents the October 2025 retirement of the remaining Privacy Sandbox APIs.
7. Pew Research Center. (2023). "How Americans View Data Privacy," survey fielded May 2023, published October 18, 2023. 73% report very little or no control over company data collection; 81% report concern.

Note: All figures verified as of July 2026. The ICCL's real-time bidding figures are from its May 2022 report, the most recent full-scale audit of RTB data broadcast volume publicly available; no comparably comprehensive follow-up has been published since. Pew's data-control figure is from its most recent full survey re-run in May 2023. All other figures are drawn from 2025 or January 2026 measurements. Tracker counts are refreshed at least twice a year to track new NordVPN, HTTP Archive, and WhoTracks.Me data releases.