.org: a small page load, and almost all of it arrives early

Three companies, fourteen requests, and nothing after that

The median .org site in this index contacted 3 separate companies over 14 requests, with 1 of those companies classified as tracking against the index's vendor catalogue. Ordered against the other eight top-level domains here, nothing is lighter than .org on companies contacted or on request volume: .de reports the same 3 companies and the same 14 requests, and the other seven endings are heavier on both.

The figure that finishes the picture is the median number of companies arriving after the consent window has closed: 0. Whatever a .org page is going to fetch from a third party, the median page has already fetched it by the time a visitor could have answered a banner. There is no second wave.

241 of 250 made contact before a banner could have been answered

241 of the 250 sites — 96.4% — contacted a company inside the opening window, the stretch before any banner on the page could have been read and answered. Among the nine top-level domains in this index that share ranks 3rd, with rank 1 the highest.

The median site's first outbound contact landed at 575 ms. The fastest in the group was at 82 ms, which is roughly the time it takes a page to parse its own head element. That combination — a light load that is nonetheless early — is the specific shape of .org in this corpus. Nine sites out of 250 made no early contact at all.

Fewer than a third carry a consent tool at all

Consent software was detected on 79 of the 250 sites, so roughly two thirds of the .org sites here showed no banner for the crawler to find. Among the 79, OneTrust was seen alongside on 40 sites, an IAB TCF framework banner on 16, Osano on 9, Cookiebot on 8, Usercentrics on 3 and Klaro on 2. A single site can run more than one of these, so those counts are sightings rather than slices of the 79.

The absence of a banner is not by itself remarkable. A site with no cookies to ask about and no advertising to sell has nothing to put in one. But it does mean that for most of this group, the question of what arrives before consent has no banner to be measured against — only the arrival time.

These are mostly infrastructure, not charities

The .org sites this crawl reached skew heavily towards the plumbing of the web rather than towards non-profits. wordpress.org contacted 2 companies, both inside the window, first contact at 495 ms and no banner detected. mozilla.org: 1 company, inside the window, at 1,253 ms. apache.org: 1 at 746 ms. creativecommons.org: 1 at 256 ms. doi.org, the resolver behind academic citations: 3 companies, all 3 inside the window, at 265 ms.

Others are not sites in the ordinary sense at all. ampproject.org, lencr.org, duckdns.org and adsrvr.org are service endpoints that a browser reaches on the way to somewhere else, each contacting a single-digit number of companies. un.org reached 3, all inside the window, at 1,895 ms. cookielaw.org is the only one of the twelve where a banner was detected — OneTrust — with 2 companies contacted, both inside the window, at 597 ms.

The outlier is ntp.org, the time-synchronisation project: 4 companies contacted, none of them inside the window, with first contact at 2,085 ms. It is the one site among these twelve where the page waited.

What a three-company page still means

Three companies is a small number in this corpus, and it is worth being precise about what that does and does not settle. The measurement records how many distinct companies a page contacted and when the first of them was reached. It does not record what any of them received, and a single analytics endpoint reached at 82 ms can carry more about a visitor than a dozen font and image hosts reached later.

So .org's position here is narrow but real: of the nine top-level domains measured, it is one of the lightest, and it is also one of the earliest. Those two properties are usually assumed to travel together in the other direction. If you want to run the same measurement against a single .org page yourself, MurmStack does it in the browser.