618 Cookies Before You've Even Said No

Someone on r/privacy ran an experiment this week that’s been rattling around my head since I read it. They loaded a single AP News article, nothing exotic, just a news story, and checked what their browser had picked up before they’d even clicked “accept” or “reject” on the cookie banner. The answer: 618 cookies, from 163 different companies.

Six hundred and eighteen. For one article. Before consent was given either way.

I’ve worked in IT long enough to know how this happens technically. Real-time bidding, header bidding, a dozen ad exchanges all auctioning off your eyeballs in the time it takes the page to render, each one dropping its own little breadcrumb trail along the way. It’s not a bug, it’s the business model working exactly as designed. The cookie banner sitting on top of all that is basically a fig leaf, there to make the process look consensual while the actual data collection has already happened in the background. By the time you’ve decided whether to click “manage preferences,” the preferences have already been managed for you.

What got me more than the number itself was the comment thread underneath it, which veered into browser market share and turned into something more interesting than the original post. Chrome sits at something like two-thirds of the desktop market, Edge mops up most of the rest, and between them Chromium-based browsers account for the vast majority of what people use to access the internet. Firefox, which still ships with reasonable cross-site tracking protection out of the box, is sitting under three percent. One commenter asked the obvious question: why would anyone go out of their way to install a third-party browser just to end up on Chrome again? The answers were depressingly sensible. Schools standardised on Chromebooks and Google Docs a decade ago, so an entire generation grew up with “the internet” and “the Google icon” meaning the same thing. Workplaces build internal tools that only render properly in Chrome and nag you every time you turn up in anything else. Google’s own services gently but constantly suggest you’d be happier if you just used their browser too. None of this is an accident, and none of it requires anyone to be stupid or lazy. It’s just friction, applied patiently, over years, until the path of least resistance leads to the same place every time.

I had my own small version of this a few months back, trying to get my daughter to use a decent ad blocker on her laptop instead of the raw Chrome install she’d had since year nine. She’s a sharp kid, she gets why tracking is bad, she’s not naive about any of it. But every tutorial for her school portal says “works best in Chrome,” every group assignment link assumes Chrome, and eventually she just stopped fighting it because the alternative was being the one person in the group chat who couldn’t open the shared doc properly. That’s the whole trick, really. You don’t need to convince anyone that surveillance advertising is fine. You just need to make the alternative mildly inconvenient, often enough, for long enough, that people stop bothering.

I don’t think the answer is blaming individuals for not running LibreWolf with seventeen extensions configured just so. I use a hardened Firefox most of the time and I still end up in Chrome for the odd work tool that refuses to behave anywhere else, so I’m not going to pretend I’ve solved this at home either. What strikes me is how much of this problem is structural rather than personal. Nobody chose, in any meaningful sense, to have 163 companies profiling them off a single news article. The system was built that way quietly, by default, and the opt-out mechanism we’re all given is cosmetic. That’s not a consumer choice problem, it’s a regulation problem, and the EU’s attempts at enforcement, patchy as they are, at least gesture at the right target.

I don’t have a tidy ending for this one. I’ll keep using Firefox at home, keep losing the fight on the devices I don’t control, and keep being mildly amazed that an industry built on knowing everything about us still can’t be bothered asking first.