What does last.fm track?

Before any consent, last.fm loaded 8 tracking companies and set 8 advertising or analytics cookies.

That's more tracking companies than 89% of the 2,450 sites we scanned.

Scanned October 2, 2026 from Germany, loading www.last.fm once and clicking nothing. How we scan

Tracking companies: 8
Tracking cookies: 8
Third-party hosts: 24
Cookies in total: 21

Consent banner

The page loaded IAB TCF (unidentified platform), a consent management platform. Everything below was recorded before anyone answered it. 8 tracking companies still loaded while it was unanswered.

Companies contacted before consent

6 of the 16 companies it contacted before consent were advertising companies.

Google Ads
securepubads.g.doubleclick.net
3 requestsAdvertising
Freestar
a.pub.network
2 requestsAdvertising
Amazon Advertising
aax.amazon-adsystem.com
1 requestAdvertising
Criteo
gum.criteo.com
1 requestAdvertising
The Trade Desk
match.adsrvr.org
1 requestAdvertising
Media.net
contextual.media.net
1 requestAdvertising
YouTube
www.youtube-nocookie.com, www.youtube.com
12 requestsSocial media
Google Analytics
www.googletagmanager.com, region1.google-analytics.com
4 requestsAnalytics

Other third parties (content delivery, consent, functional, unclassified)

castlereach.com
castlereach.com
7 requestsUnclassified
snigelweb.com
cdn.snigelweb.com, adengine.snigelweb.com, scripts.snigelweb.com
5 requestsUnclassified
anonymised.io
cdn1.anonymised.io, static.anonymised.io
3 requestsUnclassified
getadmiral.com
images.getadmiral.com
2 requestsUnclassified
anonm.io
static.anonm.io
1 requestUnclassified
Google
fonts.googleapis.com, fonts.gstatic.com, www.google.com, jnn-pa.googleapis.com
12 requestsFunctional
Cloudflare
cdnjs.cloudflare.com
2 requestsContent delivery
jsDelivr
cdn.jsdelivr.net
1 requestContent delivery

Cookies set before consent

The longest-lived tracking cookie it set was _ga, from Google Analytics, lasting about 13 months.

Cookie	Purpose	Set by	Lasts
__Secure-ROLLOUT_TOKEN	Advertising	youtube.com (third party)	6 months
_sharedID	Advertising	last.fm	12 months
_sharedID_cst	Advertising	last.fm	12 months
sessionid	Advertising	last.fm	12 months
VISITOR_INFO1_LIVE	Advertising	youtube.com (third party)	6 months
VISITOR_PRIVACY_METADATA	Advertising	youtube.com (third party)	6 months
_ga	Analytics	last.fm	13 months
_ga_JSW4CH2WD0	Analytics	last.fm	13 months
_awl	Unclassified	last.fm	13 months
_sharedID_last	Unclassified	last.fm	12 months
3pc_test	Unclassified	static.anonm.io (third party)	Under a day
lfmanon	Unclassified	www.last.fm	Session
lfmjs	Unclassified	www.last.fm	3 months
lpfrmo	Unclassified	last.fm	Under a day
not_first_visit	Unclassified	www.last.fm	Session
session_depth	Unclassified	www.last.fm	Under a day
X-UA-Country-Code	Unclassified	www.last.fm	Under a day
X-UA-Device-Type	Unclassified	www.last.fm	Under a day
__cf_bm	Functional	snigelweb.com (third party)	Under a day
__Secure-YNID	Functional	youtube.com (third party)	6 months
YSC	Functional	youtube.com (third party)	Session

The page also wrote 9 keys to local storage, which works like a cookie but isn't sent with requests.

Understanding this page

How to see which cookies and trackers a website loads
A hands-on walkthrough for checking what a site sets before you've clicked anything, using Chrome and Firefox's built-in tools, plus how CookieTosser automates the same check every month.
What counts as valid cookie consent in the EU
The rules that actually govern cookie banners — the ePrivacy Directive, the GDPR consent standard, the Planet49 ruling, the strictly-necessary exemption, and what "reject" has to offer compared with "accept.
Consent management platforms explained
What a CMP banner is actually doing behind the scenes, how the IAB's TCF standard and Google's Consent Mode v2 fit in, and why a banner being present is no guarantee that nothing loads before you answer it.