What does npr.org track?
Before any consent, npr.org loaded 9 tracking companies and set 3 advertising or analytics cookies.
That's more tracking companies than 91% of the 2,450 sites we scanned.
Scanned October 2, 2026 from Germany, loading www.npr.org once and clicking nothing. How we scan
- Tracking companies
- 9
- Tracking cookies
- 3
- Third-party hosts
- 34
- Cookies in total
- 15
Consent banner
The page loaded OneTrust, a consent management platform. Everything below was recorded before anyone answered it. 9 tracking companies still loaded while it was unanswered.
Companies contacted before consent
7 of the 17 companies it contacted before consent were advertising companies.
- Google Ads7 requestsAdvertising
securepubads.g.doubleclick.net, 6635101.fls.doubleclick.net, s0.2mdn.net, pagead2.googlesyndication.com
- Amazon Advertising2 requestsAdvertising
c.amazon-adsystem.com
- Permutive1 requestAdvertising
api.permutive.com
- LiveRamp1 requestAdvertising
api.rlcdn.com
- Lotame1 requestAdvertising
id.crwdcntrl.net
- The Trade Desk1 requestAdvertising
match.adsrvr.org
- Criteo1 requestAdvertising
gum.criteo.com
- Crazy Egg4 requestsAnalytics
script.crazyegg.com
- Google Analytics2 requestsAnalytics
www.googletagmanager.com
Other third parties (content delivery, consent, functional, unclassified)
- brightspotcdn.com33 requestsUnclassified
npr.brightspotcdn.com
- ay.delivery6 requestsUnclassified
cpftuhdzdstc5rz8x.ay.delivery, event.ay.delivery
- OneTrust16 requestsConsent banner
cdn.cookielaw.org, geolocation.onetrust.com
- Google11 requestsFunctional
www.gstatic.com, www.recaptcha.net, imasdk.googleapis.com, www.google.com
- JW Player10 requestsFunctional
ssl.p.jwpcdn.com, videos-cloudfront-usp.jwpsrv.com, entitlements.jwplayer.com, cdn.jwplayer.com
- Stripe6 requestsFunctional
js.stripe.com, m.stripe.network, m.stripe.com
- Piano4 requestsFunctional
c2.piano.io, cdn.piano.io, buy.tinypass.com
- Akamai1 requestContent delivery
s.go-mpulse.net
Cookies set before consent
The longest-lived tracking cookie it set was _ce.s, from Crazy Egg, lasting about 12 months.
| Cookie | Purpose | Set by | Lasts |
|---|---|---|---|
| _lr_env_src_ats | Advertising | www.npr.org | 30 days |
| _lr_retry_request | Advertising | www.npr.org | Under a day |
| _ce.s | Analytics | npr.org | 12 months |
| __cf_bm | Functional | piano.io (third party) | Under a day |
| __tbc | Functional | npr.org | 13 months |
| _pctx | Functional | npr.org | 13 months |
| _pprv | Functional | npr.org | 13 months |
| m | Functional | m.stripe.com (third party) | 13 months |
| OptanonConsent | Functional | npr.org | 12 months |
| test_cookie | Functional | doubleclick.net (third party) | Under a day |
| usprivacy | Functional | www.npr.org | 12 months |
| xbc | Functional | npr.org | 13 months |
| bm_lso | Necessary | www.npr.org | 30 days |
| bm_s | Necessary | npr.org | 31 days |
| bm_so | Necessary | npr.org | 1 day |
The page also wrote 9 keys to local storage, which works like a cookie but isn't sent with requests.
Understanding this page
- How to see which cookies and trackers a website loads
A hands-on walkthrough for checking what a site sets before you've clicked anything, using Chrome and Firefox's built-in tools, plus how CookieTosser automates the same check every month.
- What counts as valid cookie consent in the EU
The rules that actually govern cookie banners — the ePrivacy Directive, the GDPR consent standard, the Planet49 ruling, the strictly-necessary exemption, and what "reject" has to offer compared with "accept.
- Consent management platforms explained
What a CMP banner is actually doing behind the scenes, how the IAB's TCF standard and Google's Consent Mode v2 fit in, and why a banner being present is no guarantee that nothing loads before you answer it.