Cookie advice has settled on a single distinction. First-party cookies are the site you are visiting and they are fine; third-party cookies are somebody else and they are the problem. Block the second kind and you have dealt with it.
The distinction is real, but it is about domain names rather than about who receives your data. Once you count the cookies real pages actually set, the two stop lining up.
What we counted, and how
A fresh browser profile for every site, each public homepage loaded exactly once, nothing logged into, no form filled, and no consent banner answered either way. The cookie store was then read directly, which sees the cookies marked HttpOnly and the ones set by other domains — neither of which a page can see for itself.
A control ran first. A site known to set cookies had to report some, or every zero in the run would have been an instrument failure dressed up as a clean result.
The spread alone is remarkable: from 0 to 54 cookies, just for opening a page and reading it.
The same label covering three different things
Now compare the sites that set third-party cookies, because the label conceals the entire difference between them.
Wikipedia set 4, and all 4 came from a single domain belonging to the same organisation that runs the site. Technically third-party; in substance the same operator using a second domain name.
Bing set 18 from 4 domains, all of them Microsoft's own properties. Third-party by the browser's rule, one company by any other reading.
Amazon set 43 from 24 separate domains, and those are genuinely separate advertising and measurement firms, most of which a visitor has never heard of and none of which they went to.
The raw count, then, answers the wrong question. It puts four cookies from your own CDN in the same category as forty-three from two dozen ad-tech companies — hardly the same event. The more useful figure is how many distinct organisations end up holding a record of your visit, and the browser shows that nowhere.
Before you agreed to anything
Every figure above was recorded without a banner being answered. Nothing was accepted, nothing was rejected, and the pages were simply opened and left alone.
That is the part with legal weight. Under both the PDPA and the GDPR, consent is meant to precede the processing it authorises, and cookies that are not strictly necessary are supposed to wait. What we measured is 54 cookies arriving from 24 third-party domains at the top of a session in which no one had agreed to anything — and we measured it from Singapore, which matters, because what a site sets before consent often depends on where it believes you are.
We are describing what a browser received, not reaching a conclusion about anyone's compliance. Some of those cookies may be strictly necessary; a few plausibly are. The banner is nonetheless not the gate it appears to be. Whatever you click, some of it has already happened.
The one limit that held
One number was identical everywhere: not a single cookie in the entire run expired more than 400 days out, and several on each site sat exactly at that line.
That is not restraint on the sites' part. It is the browser refusing — Chrome caps cookie lifetime at 400 days regardless of what a site asks for, and a cluster of cookies sitting precisely on a limit is the signature of a request being trimmed rather than a preference being expressed.
This shows where the real controls are. The most effective limit we measured was imposed by the browser itself, silently, on every site at once.
Achieving a zero is possible, and it is not the same as zero contact
Two of the six set nothing at all: gov.sg, and this site. We included our own because a guide that counted other people's cookies without counting its own would be worth very little.
And counting our own is how we found that a zero is a narrower result than it looks. There are 2 third-party scripts in our homepage as it is served. Our analytics runs in Google's consent mode with storage denied by default, which is why no cookie is written — but the script itself sits on the page unconditionally, so it loads and contacts Google on your first visit whether or not you ever answer the banner. The other is a performance beacon our content delivery network injects into every response, which is not ours to gate and which we are switching off at source.
None of those wrote a cookie, and all of them made a request. A request carries your address and your browser's own description of itself, which is enough to record a visit without storing anything on your machine at all.
The honest version of our own result, then, is 0 cookies, and not zero contact. We are documenting that rather than taking credit for the zero, because the same gap applies to every site in the table — a low count is evidence about storage and almost none about observation.
Blocking third-party cookies is still worth doing, but do not read the count as a privacy score. Wikipedia's 4 third-party cookies came from its own operator and Amazon's 43 came from 24 unrelated companies, and the browser labels both the same way. Ask how many separate organisations are involved rather than how many cookies there are. Assume some are set before you touch the banner, because on the pages we measured they were — 54 of them on one site, from 24 domains, with nothing accepted. Notice what the browser is already doing on your behalf, too: nothing in the run outlived the 400-day cap it enforces without asking. Then treat a low count with the same suspicion as a high one — our own homepage set 0 cookies while still loading 2 third-party scripts, so storage and observation are separate questions and only the first is what you are counting. If none of this is acceptable to you for a particular session, the reliable move is a fresh profile that you discard afterwards, which is the one thing that leaves nothing to carry forward.
Seeing your own
Every browser lists the cookies on the page you are reading, usually under the icon at the left of the address bar, and that list is the same data counted here. Our user agent parser shows what your browser volunteers on every request before any cookie is involved, and IP lookup shows the address that accompanies it — the two identifiers that no cookie setting removes. For what a page can learn with no cookie at all, what incognito mode actually does measured the values a site reads from a private window, what a browser extension can see covers the software you install rather than the sites you visit, and clearing your cache explains what the other checkbox in that dialogue actually removes.
- Every figure comes from a script committed alongside this guide: a fresh browser profile per site, one load of each public homepage, no login, no form submission and no consent banner answered. The cookie store is read directly rather than through the page, so HttpOnly and third-party cookies are counted.
- ⚠️ ONLY NAMES, HOSTS AND EXPIRY WERE READ. Cookie values were never read — a value can carry an identifier, and this measurement needs reach rather than contents.
- ⚠️ MEASURED FROM SINGAPORE. What a site sets before consent frequently depends on the jurisdiction it believes you are in, so these counts are what a Singapore visitor received and not a universal figure.
- ⚠️ THE COUNTS MOVE BETWEEN RUNS. Two runs of the same measurement returned 53 and then 54 for the same site, because an ad-funded page loads a different set of partners each time. The published figures are the second run, and the spread is itself part of the finding.
- ⚠️ First- against third-party is decided here by an approximate registrable-domain rule rather than a public-suffix-list lookup. It is adequate for these hosts and it is an approximation, which is also why the guide argues that ownership matters more than the label.
- ⚠️ OUR OWN ZERO IS AUDITED BY A SECOND SCRIPT, also committed here, which counts the third-party scripts present in our homepage as served and the Set-Cookie headers on that response: 2 scripts, 0 headers. It sends the Accept and User-Agent headers a browser sends, because our content delivery network only injects its beacon into responses it believes are going to a browser — a bare request returns a clean page and would have let us publish a zero that was not true.
- ⚠️ NO COMPLIANCE CONCLUSION IS DRAWN about any site named. We report what a browser received before consent was given. Whether a particular cookie was strictly necessary, and what any operator's legal basis is, are questions this measurement cannot answer.
This describes cookies observed on six public homepages from one location on one day. It is not legal advice, not an assessment of anyone's compliance with the PDPA or the GDPR, and not a claim about what any site does after consent is given.
View author profile → · Editorial policy
