Everywhere you go online, you are being tracked. Nearly every time you visit a website, trackers collect data about your browsing habits and send it back to targeted advertising systems, which build detailed profiles about your interests and make big profits in the process. Some places will track you more than others.
In a little noticeable change late last year, thousands of websites became more transparent about how many companies your data is shared with. In November, those pesky cookie popups — which ask your permission to collect and share data — started sharing how many advertising “partners” each website works with, providing a further glimpse into the vast advertising ecosystem. It’s not pretty for many sites.
A WIRED analysis of the top 10,000 most popular websites shows that dozens of sites say they share data with more than 1,000 companies, while thousands of other websites share data with hundreds of companies. Quiz and puzzle website JetPunk tops the pile, with 1,809 “partners” that can collect personal information, including “browsing behavior or unique IDs.”
More than two dozen websites owned by publisher Dotdash Meredith, including Investopedia.com, People.com and Allrecipes.com, all say they can share data with 1,609 partners. The newspaper The daily email lists 1,207 partners, while internet speed monitoring company Speedtest.net, online medical publisher WebMD and media outlets Reuters, ESPN and BuzzFeed all claim they can share data with 809 companies. (WIRED lists 164 partners for context.) These hundreds of advertising partners include dozens of companies that most people have probably never heard of.
“You can always assume that they will all try to explain who you are first,” he says Midas Nouwens, an associate professor at Aarhus University in Denmark, who previously developed tools to automatically opt out of tracking by cookie popups and helped with website analytics. The data collected may vary by website and the cookie pop-ups provide some control over what can be collected; However, the information may include IP addresses, device fingerprints, and various identifiers. “Once they know that, they can add you to different data sets, or use it for enrichment later when you go to another site,” says Nouwens.
The online advertising world is a messy, murky space, where networks of companies can build profiles of people with the aim of showing you tailored ads as soon as you open a web page. Strong for years privacy laws in Europe, such as GDPR, have resulted in websites showing cookie consent pop-ups asking permission to store cookies that collect data on your device. In recent years, studies have shown that cookie pop-ups are also included dark patterns, ignored people’s choicesand are ignored by people. “Every person we’ve ever observed in user testing doesn’t read any of this. They find the fastest way to rule it out,” said Peter Dolanjski, director of product at privacy-focused search engine and browser DuckDuckGo. “So they end up in a worse privacy situation.”
For the website analysis, Nouwens deleted the 10,000 most popular websites and analyzed whether the collected pop-ups mentioned partners and, if so, how much they made public. WIRED manually verified all websites mentioned in this story and visited each to confirm the number of partners shown. We looked at the highest total number of partners across the entire dataset, and the highest number of partners for the top 1000 most popular websites. The process, which is just a snapshot of how websites share data, provides a single view of the complex ecosystem. Results may vary depending on where in the world someone visits a website.
It also only includes websites that use only one system to serve cookie pop-ups. Many of the world’s largest websites (think Google, Facebook and TikTok) use their own cookie pop-ups. However, thousands of websites, including publishers and retailers, use third-party technology created by consent management platforms (CMPs) to serve the pop-ups. These pop-ups largely follow the standards of the marketing and advertising group IAB Europe, which describes in detail what information should be included in the cookie pop-ups.