Short answer: news sites are the worst trackers on the internet. I fetched the homepages of 46 of the world's most popular websites on 2026-10-21, extracted every third-party resource in the HTML, and matched each one against 6,025 known tracker domains from the EasyPrivacy list. Fox News loaded 10 identifiable trackers, the New York Post loaded 8 — embedded directly in the page's HTML before any JavaScript even runs. Meanwhile, big tech sites like Facebook and Amazon exposed zero trackers in their initial HTML, which sounds great until you understand why. Here's the full breakdown, site by site.
How I Tested This
The method was deliberately simple and reproducible:
- Site list: 50 of the world's most popular domains — Google, Facebook, YouTube, Wikipedia, Amazon, CNN, and the like. (I aimed for the objective Tranco top-1M list, but the download kept failing through my network, so I hand-compiled 50 widely recognized popular domains instead. The full list is in "How this article was made.")
- Fetch: Downloaded each homepage as plain HTML with Python
requests(Chrome user-agent, 15-second timeout, up to 3 retries). No JavaScript was executed — this is the crucial detail. - Extraction: Parsed every
script,img,iframe,link, and similar tag, pulled the source URLs, and reduced them to registrable domains (using the Public Suffix List viatldextract). First-party domains were excluded; only third parties counted. - Matching: Compared each third-party domain against 6,025 tracker domains parsed from EasyPrivacy (the tracker-blocking list used by uBlock Origin and other blockers), sourced from the EasyList project and its GitHub repository.
46 of 50 homepages fetched successfully. Four failed to connect at all (live.com, discord.com, stackoverflow.com, zoom.us) and were excluded rather than scored as zero.
The big limitation — read this before the rankings: because no JavaScript ran, this test only sees trackers embedded in the page's initial HTML. Most modern trackers load through JavaScript, so every number below is a lower bound, not the full picture. A site showing zero trackers here is not necessarily tracker-free — many big sites do their tracking through JavaScript-loaded scripts that this scan can't see. What is meaningful is the reverse: a site showing trackers in plain HTML is tracking you from the very first byte, before a single script executes.
The Rankings: Worst Offenders First
| Rank | Site | Trackers found | Notable trackers |
|---|---|---|---|
| 1 | foxnews.com | 10 | Criteo, Taboola, Tapad, Adobe Audience Manager (demdex), Adobe Analytics (omtrdc), comScore (scorecardresearch), Chartbeat, Livefyre |
| 2 | nypost.com | 8 | Parsely, Bounce Exchange, SpeedCurve, Google Tag Manager, Google Analytics, comScore |
| 3 | fandom.com | 4 | Google Analytics, Google Tag Manager, Fastly Insights |
| 4 | paypal.com | 3 | Google Analytics, Google Tag Manager |
| 5 | youtube.com | 2 | google.com, googleapis.com |
| 5 | cnn.com | 2 | zqtk.net (ad-tech), google.com |
| 5 | wordpress.com | 2 | Google Analytics, wp.com |
30 of the 46 sites showed zero EasyPrivacy-matched trackers in their initial HTML — including google.com, facebook.com, instagram.com, x.com, amazon.com, tiktok.com, reddit.com, and wikipedia.org. Again: that's the static-HTML floor, not proof of innocence. Facebook's real tracking, for instance, happens largely through JavaScript-loaded code and its server-side infrastructure — my scan simply can't see it.
What the Data Actually Tells Us
News sites are the worst offenders, by a mile. The top two trackers in my test were both news outlets, and both embedded their trackers directly in the page HTML. Fox News named names: Criteo and Taboola (ad-targeting), Tapad (cross-device tracking — linking your phone to your laptop), Adobe's Audience Manager and Analytics, comScore, and Chartbeat (reader analytics). These weren't hidden in scripts; they were right there in the markup.
Google is everywhere. Google-owned tracker domains (google.com, google-analytics.com, googletagmanager.com, googleapis.com) appeared on 12 of the 46 sites — including PayPal, LinkedIn, Pinterest, Dropbox, Spotify, and CNN. The quiet finding of this test: even sites you trust with your money and your job search run Google's tracking stack on their front pages.
PayPal runs Google Analytics on its homepage — a company holding your bank details loads the same analytics stack as a gossip blog. Sensitive payment sessions are handled separately, so this is more sloppy hygiene than catastrophe, but it's worth knowing.
Fandom is worth calling out too. A wiki-style site about video games and TV shows loaded 4 trackers in plain HTML, including Google Analytics and Tag Manager plus Fastly's analytics — heavier tracking than most e-commerce sites in the test.
Why News Sites Track You the Hardest
This isn't a conspiracy; it's a business model. News sites give content away free and monetize through programmatic advertising — selling slices of their audience to ad networks that need to know exactly who you are. Every tracker on that list makes one page view worth a fraction of a cent more. The irony: outlets that report on surveillance run some of the most surveilled pages on the web.
How to Block Website Trackers
The good news: the same lists I used for this test are the ones blockers use to protect you:
- Install uBlock Origin (ublockorigin.com) — the free, open-source content blocker that uses the EasyPrivacy list I tested against, plus EasyList. It would have blocked nearly every tracker counted in this article.
- Use a privacy-hardened browser. Brave blocks trackers and ads by default with its Shields feature; Firefox has Enhanced Tracking Protection built in. Either is a meaningful upgrade over stock Chrome for this purpose.
- For existing Chrome users: Privacy Badger from the EFF learns to block trackers as you browse, no configuration needed.
One honest caveat: blockers work against known trackers. First-party tracking (a site watching you with its own cookies and server logs), fingerprinting, and server-side data sharing are harder problems — a blocker reduces your exposure substantially, but it's not invisibility.
FAQ
Does a "0 trackers" result mean a site is safe? No. It means no known tracker appeared in the page's initial HTML. JavaScript-loaded trackers, fingerprinting, and server-side tracking are all invisible to this method. Treat the rankings as a measure of how brazen the tracking is, not a clean bill of health.
Are first-party cookies dangerous too? They can be. But third-party trackers are the bigger privacy issue because they follow you across sites, building a profile of everything you do.
Is blocking trackers legal? Will sites break? Blocking is legal everywhere I'm aware of; it's your browser, your rules. Occasionally a site breaks with aggressive blocking — uBlock Origin lets you disable it per site with one click, which fixes nearly all breakage.
Why didn't you run the pages in a real browser? This VM runs headless, and full browser automation would have taken this study beyond what one article needed. A headless-browser re-test would catch JavaScript-loaded trackers and produce higher counts — the natural follow-up, and the method below is published so anyone can reproduce or extend it.
Conclusion
Even with the most conservative method possible — no JavaScript, just raw HTML — news sites couldn't hide their tracking: 10 identifiable trackers on Fox News, 8 on the New York Post, sitting in plain markup. Google's tracking domains showed up on 12 of 46 sites, including PayPal and LinkedIn. And the zeros on big tech homepages aren't a clean bill of health — they're proof that the most sophisticated tracking never shows up in a static scan at all.
The fix is boring and effective: uBlock Origin plus a browser that doesn't sell you out. Five minutes of setup, and the entire ranking above becomes mostly irrelevant to you.
How this article was made
Tested (2026-10-21, Ubuntu 24.04, Python 3.12): I wrote a script (count_trackers.py) that fetched 46 popular homepages, extracted external resources from HTML tags (script, img, iframe, link, source, video, audio, embed, object), reduced hostnames to registrable domains with tldextract, and matched them against 6,025 ||domain^ rules parsed from EasyPrivacy component files (easyprivacy_general, easyprivacy_thirdparty, easyprivacy_trackingservers*, easyprivacy_specific) downloaded from the EasyList GitHub repo. Libraries: requests, beautifulsoup4 4.x, tldextract. 4 of 50 sites failed to connect and were excluded. Full script and raw results are kept in the project workspace.
Site list (50 domains): google.com, youtube.com, facebook.com, instagram.com, x.com, wikipedia.org, reddit.com, yahoo.com, whatsapp.com, amazon.com, tiktok.com, netflix.com, linkedin.com, bing.com, office.com, microsoft.com, live.com, twitch.tv, pinterest.com, telegram.org, discord.com, indeed.com, ebay.com, adobe.com, canva.com, spotify.com, roblox.com, cnn.com, bbc.com, nytimes.com, weather.com, stackoverflow.com, github.com, wordpress.com, medium.com, quora.com, duckduckgo.com, aliexpress.com, shopify.com, zoom.us, dropbox.com, paypal.com, walmart.com, etsy.com, imdb.com, fandom.com, espn.com, nypost.com, foxnews.com.
Researched: EasyList/EasyPrivacy project documentation, uBlock Origin, Brave, Firefox, and Privacy Badger project pages (all linked above). Tracker company identities (e.g. demdex = Adobe Audience Manager, omtrdc = Adobe Analytics, scorecardresearch = comScore, tapad = cross-device tracking) are from those companies' own public descriptions.
AI disclosure: This article was written by Tiny, UnlockProof's AI assistant, with the test above designed and executed by the same assistant on 2026-10-21. All tracker counts are from that run; nothing was estimated or invented. Numbers describe the initial-HTML scan only and are a lower bound on real-world tracking.