Google loaded on 1,127 sites in our October 2026 scan: 46% of the 2,450 most-visited sites we checked, before any visitor had given consent.
Category: Functional. A company can do several jobs; this is its main role on the pages we saw.
Its cookies typically last about 6 months. Only 48% of the sites where it loaded had a consent banner visible at all. It's especially common on .jp sites: 86% of them load it, versus 46% of all sites we scanned.
About Google
Google's own domains carry a mix of infrastructure most sites depend on: fonts, reCAPTCHA, the consent-management prompts Google requires from publishers using its ad products, and other core services.
On a typical page it's serving a font from fonts.gstatic.com, running a reCAPTCHA or Sign in with Google widget, or loading Google's Funding Choices consent message. Some of these set cookies of their own, such as the NID or __Secure-ENID cookies used to remember settings.
A signed-in user's My Ad Center settings govern how Google-wide data is used for ad personalization, even though most of what shows up here isn't advertising.
Often loaded alongside
Sites that load Google most often also load Google Analytics (77%), Google Ads (64%), Meta (23%), jsDelivr (17%), and Amazon Web Services (17%).
Domains it loads from
- fonts.gstatic.com
- fonts.googleapis.com
- www.google.com
- www.gstatic.com
- fundingchoicesmessages.google.com
- accounts.google.com
- ajax.googleapis.com
- jnn-pa.googleapis.com
- adservice.google.com
- lh3.googleusercontent.com
- imasdk.googleapis.com
- storage.googleapis.com
- www.recaptcha.net
- news.google.com
- cse.google.com
- clients1.google.com
- play.google.com
- firebaseinstallations.googleapis.com
- apis.google.com
- maps.googleapis.com
- firebaseremoteconfig.googleapis.com
- csi.gstatic.com
- translate.google.com
- translate.googleapis.com
- csp.withgoogle.com
Cookies
- _gcl_au336 sites
- FCCDCF141 sites
- receive-cookie-deprecation136 sites
- __Secure-YNID113 sites
- g_state92 sites
- IDE82 sites
- test_cookie54 sites
- __eoi33 sites
- _GRECAPTCHA16 sites
- sid14 sites
- ID9 sites
- NID9 sites
- FPGSID8 sites
- FCNEC7 sites
- GCLB3 sites
Sites that load Google
The highest-ranked 30 of 1,127 sites.
- linkedin.com0 tracking companies
- tiktok.com0 tracking companies
- spotify.com1 tracking company
- vimeo.com0 tracking companies
- sentry.io1 tracking company
- wordpress.com0 tracking companies
- yuga.com5 tracking companies
- dropbox.com0 tracking companies
- nytimes.com6 tracking companies
- discord.com2 tracking companies
Show 20 more sites
- paypal.com1 tracking company
- applovin.com8 tracking companies
- soundcloud.com7 tracking companies
- creativecommons.org2 tracking companies
- duckdns.org2 tracking companies
- pki.goog1 tracking company
- medium.com2 tracking companies
- cnn.com5 tracking companies
- android.com1 tracking company
- ailawandorder.com1 tracking company
- forbes.com2 tracking companies
- ipify.org4 tracking companies
- twitch.tv1 tracking company
- canva.com1 tracking company
- hubspot.com1 tracking company
- who.int3 tracking companies
- namecheap.com4 tracking companies
- dnsmadeeasy.com1 tracking company
- tinyurl.com2 tracking companies
- harvard.edu4 tracking companies
Understanding this page
- What the tracker categories mean
What "advertising," "analytics," "social," "consent" and the rest actually mean for a company or a cookie, and how CookieTosser decides which one applies.
- First-party vs third-party cookies (and why "first-party" still tracks you)
What the distinction actually means technically, why browsers only block one of the two, and how CNAME cloaking, server-side tagging and cookies like _ga let sites keep tracking under their own domain.
- How to block or limit trackers
Browser privacy settings, content blockers, Global Privacy Control and clearing cookies compared honestly — what each one actually stops, what it doesn't, and what it costs you in return.