An analysis of cookie pop-ups on the 10K most popular websites shows that dozens share data with 1,000+ companies, and thousands share data with 100+ companies
Cookie pop-ups now show the number of “partners” that websites may share data with. Here's how many of these third-party companies …
Context & Ripple Effects
Earlier coverage found that GDPR-era pages loaded fewer cookies on average, yet studies also found consent forms often fell short of informed-consent standards through designs such as pre-ticked boxes or obscured refusal choices. The new partner counts add visibility into the scale of sharing that can sit behind those choices, rather than establishing that consent flows have become more meaningful.
The finding also extends prior measurement of tracking intensity across popular sites, including a comparison of cookie loads across political news outlets. It shifts attention from how many cookies a page places to how broadly data may travel through publisher and ad-tech partner networks.
First-order effects
- Visitors to the affected sites can see that accepting a cookie prompt may authorize sharing with hundreds—or, for dozens of sites, more than 1,000—listed partners.
- Publishers and their advertising-technology partners face a more legible public disclosure of the breadth of their data-sharing arrangements.
Second-order effects
- The disclosures give privacy advocates, regulators, and users a clearer basis to scrutinize whether consent interfaces adequately explain downstream sharing, echoing concerns in earlier research on non-compliant consent design.
- Publishers with especially long partner lists may face pressure to justify, consolidate, or more clearly explain those relationships; intermediaries that rely on broad publisher distribution are most exposed to that scrutiny.
Third-order effects
- If partner-count disclosures become a standard feature of consent flows, privacy competition may increasingly turn on the size and explainability of a site's data-sharing network—not only on the presence of cookies.
- The pattern underscores a persistent gap between reducing visible tracking artifacts and limiting downstream data circulation: earlier GDPR-era cookie reductions did not by themselves resolve the quality of consent or the scale of partner networks.
The trend: Cookie consent is evolving from a binary banner into a disclosure point for the increasingly complex networks through which publishers monetize audience data.