Google Fonts / APIs

Wide reach, thin pages

The interesting part is what those 288 sites look like once you are on them. On median companies contacted, this set ranks 88th of the 88 companies in the index. On median third-party requests, 88th of 88. On median trackers, 88th of 88. The figures behind the three ranks are 3 companies, 8 requests and 0 trackers. Eight third-party requests is not far above what a page with a single outside dependency would make. Reach and weight point in opposite directions here about as sharply as they can: tenth of 88 for how many sites carry it, last of 88 for what those sites do.

Nothing dominant travels with it

The strongest co-presence across the 288 is Cloudflare, on 44 of them, 15.3 percent. Behind it: Yandex Metrica and yandex.com on 30 each, 10.4 percent; OneTrust on 26, 9 percent; jsDelivr on 23, 8 percent; adobedtm.com on 20, 6.9 percent; trustarc.com and demdex.net on 12 each, 4.2 percent; Cloudflare Analytics and BootstrapCDN on 11 each, 3.8 percent. Nothing reaches a fifth of the set. Sites that fetch a typeface from Google share almost nothing else with one another, which is the signature of a dependency that is close to universal rather than characteristic of one kind of publisher.

Most of these sites have no banner at all

45 of the 288 sites carried a recognisable consent tool, roughly one in six. OneTrust was seen on 25, the IAB TCF signal on 8, Osano on 7, CookieYes on 2, and Usercentrics and Cookiebot on 1 each, counted as sightings rather than shares because a site can carry more than one. Meanwhile 274 of the 288, or 95.1 percent, were sites where at least one company was contacted before a banner window could have closed, a figure that ranks 31st of 88. On most pages in this set there was no banner to answer in the first place.

The range across the 288

googledomains.com registered a single company; cloudflare-dns.com registered 2; vimeo.com, cloudflare.net, ieee.org and yieldmo.com registered 4 apiece; tinyurl.com and newrelic.com 5. At the far end foxnews.com registered 17 with 15 of them inside the window, and forbes.com 10, all inside. flickr.com registered 8 running Osano. wiley.com, also running Osano, was the latest of these examples to begin at 1,092 milliseconds, while newrelic.com began earliest at 238. Median first contact across the whole group was 548 milliseconds, 74th of 88, and the earliest recorded anywhere was 64 milliseconds. At the median no company is contacted after the window closes.

Why a typeface counts as a third party

When a page asks your browser to fetch a font from Google's servers, your browser opens a connection to a domain other than the one you typed, and that request carries your IP address and the address of the page asking for it, exactly as any other cross-domain request does. That is why it is counted here alongside analytics calls and advertising beacons. Counting it is not a claim about what is done with it, and this index draws the distinction explicitly: fonts and APIs are recorded as contact and are not in the tracking classification. A site that copies the font files onto its own server makes no such request and would not appear in this set at all. The full method is at /consent-gap, and MurmStack performs the same measurement on a page while you are reading it.

Seen on the same pages

Companies most often contacted by the same sites. Co-presence only — the crawl records what arrived, not who called whom.

• CloudflareTogether on 44 of these sites
• Yandex MetricaTogether on 30 of these sites
• yandex.comTogether on 30 of these sites
• OneTrustTogether on 26 of these sites
• jsDelivrTogether on 23 of these sites
• adobedtm.comTogether on 20 of these sites
• trustarc.comTogether on 12 of these sites
• demdex.netTogether on 12 of these sites