How CookieTosser works

Most websites ask for your consent before tracking you. Many start tracking anyway, before you've answered. CookieTosser checks what actually happens: every month we load the world's most-visited websites, click nothing, and record every cookie that gets set and every outside company the page contacts. Each site gets a report you can look up.

How we scan

Which sites. The most-visited sites on the Tranco list, a research ranking of popular domains that is refreshed daily. We leave out adult and gambling sites, and any site whose robots.txt asks crawlers to stay off its homepage.
How. An ordinary desktop Chrome browser, with a fresh profile for every site, loads the homepage once. It waits for the page to finish loading and for the network to go quiet, then waits a few more seconds for tags that fire late. It never clicks, scrolls or answers a consent banner.
From where. The monthly scan runs from a server in the EU. Many sites behave differently for European visitors, where the GDPR applies, so the region is shown on every report.
What we record. Each outside host the page contacted, and each cookie that was set: its name, domain and lifetime. We never store cookie values, which can contain identifiers.
How often. Monthly. Every report shows the date of its scan.

How we classify

Companies. We group outside hosts by the company that runs them, using a list we maintain (for example, doubleclick.net belongs to Google's advertising business). Hosts we haven't identified are listed under their own domain as "unclassified" and are not counted as trackers.
Cookies. Cookie purposes come from the Open Cookie Database, an open catalogue of cookies (Apache 2.0 licence). A cookie it doesn't list, set by a known advertising or analytics company's domain, is counted as that company's. Anything else stays "unclassified".
Tracking, in our headline numbers, means an advertising, analytics or social media company, or an advertising or analytics cookie.

What a report can't tell you

It's one moment on one page. Sites change their tags, run experiments and show different things to different visitors. A report describes one homepage load, not the whole site or every visit.
It isn't a legal finding. Whether a cookie needs consent depends on its purpose and on the law where you are. Some tracking is permitted without consent, and some sites have agreements we can't see. A report is an observation, not an accusation.
Not everything is visible. Tracking that happens on the site's own servers, or through tools that look like the site's own domain, doesn't show up as a third party.
Classification is imperfect. Company and cookie categories describe each one's main role. If one is wrong, tell us.

Who runs it

CookieTosser is an independent site. It's supported by advertising and, where marked, by affiliate links to consent-management tools. Those relationships never change what a report shows.

Corrections are welcome. See the corrections page, or email hello@cookietosser.com.