Grey Zone · Episode 3 — Trackers
The Grey Zone Index
How many advertising and audience-measurement companies a website contacts before you touch the cookie banner. Not after you accept. Not after you refuse. Before you are asked.
Captured 10 August 2026 · from Finland · first ~10 seconds of load, before the cookie banner was touched
One company, 6 of the 20 sites
Google appears on more of this sample than any other company — on 6 sites, before consent. No other company appears on more than 2. That is the finding, more than any single site's number.
The twenty
Sorted worst first. “Ignored” is the count of requests thrown out as the site doing its job — its own CDN, fonts, the consent banner, payments, anti-bot. Those are not held against anyone. Every site name links to its raw capture file.
| # | Site | Requests | Domains | Companies | Ignored |
|---|---|---|---|---|---|
| 1 | www.aljazeera.com Google, Freestar, Amplitude, Chartbeat | 24 | 8 | 4 | 28 |
| 2 | www.foxnews.com Braze, True Anthem, Amazon, Knotch, Adobe, Pix | 19 | 9 | 6 | 46 |
| Fox's own identity-graph hosts (prod.idgraph.dt.fox, loki-ingest.fox.com) are first-party and therefore not counted here. | |||||
| 3 | www.bbc.com Optimizely, Dotmetrics, Chartbeat, Google | 14 | 5 | 4 | 96 |
| 4 | www.actvli.com Google | 11 | 6 | 1 | 7 |
| Our own site, left in the sample. 11 requests to Google ad and analytics endpoints before consent. | |||||
| 5 | www.zalando.fi Google | 8 | 3 | 1 | 79 |
| 6 | www.amnesty.org Zoho, Google | 6 | 3 | 2 | 10 |
| The 6 counted here are Zoho and Google. Not counted, and arguably the more interesting one: a Stripe beacon sent a full browser fingerprint before consent — operating system, language, installed plugins, screen geometry and a hash. Stripe is ignored under the fairness rule as a payment provider, which is exactly where that rule is most generous. | |||||
| 7 | yle.fi AudienceProject, Kilkaya | 5 | 2 | 2 | 31 |
| 8 | um.dk· Danish Ministry of Foreign Affairs Silktide | 4 | 1 | 1 | 23 |
| 9 | www.amazon.de Amazon | 3 | 1 | 1 | 294 |
| All three counted requests go to amazon-adsystem.com, which Amazon owns. By company this is arguably a zero; the domain rule is applied identically to all twenty sites. | |||||
| 10 | www.nordea.fi· Bank Tealium | 3 | 1 | 1 | 1 |
| 11 | www.anthropic.com HubSpot | 2 | 1 | 1 | 42 |
| 12 | www.indiehackers.com Google | 2 | 2 | 1 | 58 |
| 13 | www.sitra.fi· Finnish innovation fund Matomo | 2 | 1 | 1 | 6 |
| 14 | github.com | 0 | 0 | 0 | 154 |
| 15 | www.ebay.com | 0 | 0 | 0 | 69 |
| Zero only because PerimeterX anti-scraping (perfdrive.com) is treated as functional. Same call as LinkedIn. | |||||
| 16 | www.facebook.com | 0 | 0 | 0 | 22 |
| 17 | www.hus.fi· Helsinki University Hospital | 0 | 0 | 0 | 5 |
| 18 | www.linkedin.com | 0 | 0 | 0 | 34 |
| Zero only because PerimeterX anti-scraping (protechts.net) is treated as functional. It is genuinely security and genuinely fingerprinting: two POSTs totalling roughly 21 KB of encoded device data went out before the banner was touched. The capture file is published so this call can be argued with. | |||||
| 19 | www.nhs.uk· NHS | 0 | 0 | 0 | 0 |
| Evidenced by screenshot, not HAR. The export ran with the third-party filter active and there was nothing left to export — the Network panel read 0 / 13 requests, all of them first-party. | |||||
| 20 | www.temu.com | 0 | 0 | 0 | 175 |
Who the companies are
How many of the 20 sites each company was reached from, before consent.
- Google6 sites
- Chartbeat2 sites
- Amazon2 sites
- Amplitude1 site
- Freestar1 site
- Adobe1 site
- Braze1 site
- Knotch1 site
- Pix1 site
- True Anthem1 site
- Dotmetrics1 site
- Optimizely1 site
- Zoho1 site
- AudienceProject1 site
- Kilkaya1 site
- Silktide1 site
- Tealium1 site
- HubSpot1 site
- Matomo1 site
The raw capture files
Every site name in the table above downloads that site's HAR file — the complete record of what the browser did, exported from Chrome DevTools. Drag one back into the Network tab to inspect it, or run the counting script over it and check our arithmetic. They reproduce every figure on this page exactly; that was verified after scrubbing rather than assumed.
What was changed before publishing them
Response bodies were removed — they are other people's copyrighted JavaScript and 94% of the file size, and nothing in the analysis reads them. API keys sent to the browser were replaced with a marker, keeping the header name, because that a site ships an API key before you consent is part of the finding while a working key is someone else's problem to have abused.
URLs, query strings, request headers and timings are untouched. Redacting those would leave you taking the counts on trust, which is the opposite of the point. Full notes on what was changed and why.
How this was measured
The rule that makes it valid
Measurement stopped the instant the cookie banner was touched. No clicking, no scrolling, no “continue to site”. Everything counted here happened before any consent was given or refused. Each site was loaded in a fresh Chrome profile — no cookies, no storage, no memory of a previous visit.
What counts, and what does not
A host is ignored if it is the site's own infrastructure, or if it exists to deliver the thing you asked for — assets, fonts, the consent banner itself, payments, login, anti-bot. A host is counted if data goes out to it for advertising, audience measurement or profiling, regardless of who owns it.
Calls were made from full URLs, not hostnames. www.google.com serving a CAPTCHA and www.google.com serving an ad-conversion ping are the same hostname and opposite verdicts.
Domains and companies are counted separately
The domain count is mechanical and reproducible. The company count is a judgement — Google alone ships six domains, so a site running nothing but Google scores 6 on one measure and 1 on the other. Both are published side by side so the grouping does not have to be taken on trust.
What this data does not yet show
- No cookie or storage counts. Every measurement here is network requests going out. What gets written onto the device before consent is a separate and arguably sharper question, and it has no data behind it yet. It is coming.
- Roughly ten seconds per site. A live news page never finishes loading — Al Jazeera made 113 requests at ten seconds and 1,092 at ninety. Every figure here is therefore conservative.
- Ad auctions vary between runs. Counts on ad-heavy sites genuinely differ load to load. Treat single-digit differences between sites as noise.
- One sample, one location, one date. Captured from Finland on 10 August 2026. Results elsewhere, especially outside the EU, are likely to be worse rather than better.
Our own site is in the sample
www.actvli.com is row 4. Eleven requests to Google advertising and analytics endpoints before consent. Removing it and hoping nobody checked was the other option. It is in the table for the same reason every other number in it should be believed.
Check your own, in about thirty seconds
- Open the site in a private window. Press F12 for developer tools, then the Network tab.
- Reload the page and do not touch the banner.
- Type
-domain:*theirdomain.cominto the filter box. What is left is everyone else your browser just talked to.
Check the places you assume are fine. Not because they will be worse — because otherwise you are guessing.
Two payloads are worth opening yourself: amnesty.org's Stripe beacon, which sent a browser fingerprint before consent, and linkedin.com's, which sent roughly 21 KB of encoded device data to an anti-scraping vendor while scoring zero on this page. That second one is the weakest call in the whole dataset, and the file is there so you can argue with it.
Want a specific site checked in a future episode? Send it to us. For scam and fraud risk on a domain rather than tracking, use the RiskScope scanner or read the blog.