Website Third-Party Tools Study

Key takeaways

1. Of 568 working homepages among the 1,000 most-visited domains, 301 (53%) load Google Tag Manager or its gtag.js tag, the most common outside tool, and 40% send data to Google Analytics. See details
2. 45% load at least one advertising tag: Google's ad tags on 42%, the Meta Pixel on 22%, LinkedIn's on 19% and Microsoft's on 17%, all on a visit that never clicked a cookie banner. See details
3. Microsoft Clarity, which is free, runs on 55 homepages (10%), about 3 times as many as Hotjar (17); 38 of them also load Microsoft's ad tag, which can switch Clarity on. See details
4. Only 39 homepages (7%) load a third-party chat widget; Qualified, a sales-chat tool, is the most common (16). 11 show a button to open an AI assistant. See details
5. A quarter (25%) load a cookie-consent platform, OneTrust on 106 of them. See details
6. The median homepage contacts 8 other domains in its first 10 seconds; 51 contact more than 50, led by Weather.com, Yahoo and AOL, while Wikipedia, Apple, Google and GitHub contact almost none. See details

Which outside tools do top websites load?

Google's, above all, plus a long tail. We opened the homepage of each of the 1,000 most-visited domains on the Tranco list in a desktop browser, never clicked a cookie banner or anything else, and recorded every domain the page loaded something from in its first 10 seconds. Of the 568 working homepages, 56% loaded a tag manager or the Google tag, 51% an analytics tool and 45% an advertising tag. Of the 413 that loaded any tool on our list, 357 (86%) loaded at least one of Google's.

How many websites use Google Tag Manager?

At most 301 of 568 (53%), and its script is the single most common outside tool on top homepages. That is how many loaded a script from googletagmanager.com, which serves both Tag Manager containers and the gtag.js Google tag that installs Google Analytics or Google Ads without Tag Manager. Of the 164 homepages whose loader we could read in the server HTML, 145 used a Tag Manager container and 19 only gtag.js. Adobe's tag manager ran on 46 and Tealium's on 16. A tag manager loads other tools on the site's behalf, so many of the analytics and ad tags below arrive through it.

Which analytics tools do top websites use?

Google Analytics leads: 227 homepages (40%) sent it data directly. Cloudflare Web Analytics ran on 68, Yandex Metrica on 19, Adobe Analytics on 23 and Amplitude on 21. Sites that route analytics through their own domain don't show up as an outside request, so these are floors.

How many websites load ad pixels?

254 of 568 (45%) loaded at least one advertising tag. Google's ad tags led (238), then the Meta Pixel (125, 22%), LinkedIn's Insight Tag (106), Microsoft's UET for Bing ads (94), Reddit's pixel (80), X's pixel (53), Amazon's ad tags (52), Criteo (48) and TikTok's pixel (34). All of them loaded on a visit from the U.S. that never touched a cookie banner.

Which session-replay tools do websites use?

Microsoft's free tool leads by a distance. Microsoft Clarity ran on 55 homepages (10%) (free to use), about 3 times as many as Hotjar (17); Contentsquare ran on 15 and FullStory on 9. Together, session-replay and heatmap tools ran on 97 homepages (17%). Not every Clarity install is a separate choice: 38 of the 55 homepages also loaded Microsoft's UET tag for Bing ads, which can send data to Clarity once that option is on (Microsoft: UET and Clarity integration).

How many websites use a cookie-consent platform?

A quarter: 144 homepages (25%) loaded one. OneTrust dominates with 106; TrustArc ran on 15, Cookiebot on 10 and Usercentrics on 10. A site can also build its own banner, which this count misses.

How many websites have a chat widget?

Few. 39 of 568 homepages (7%) loaded a known third-party chat widget. The most common was Qualified (16), a sales-chat tool, here mostly on business-software sites, then Intercom (5), Salesforce (5), LivePerson (4) and HubSpot chat (2). 11 homepages had a button labelled to open an AI assistant or an "Ask AI" chat, among them NVIDIA, Adobe's developer site, Time, Statista and DuckDuckGo; we read every matching button by hand and left out product names such as Copilot.

How many outside domains does a homepage contact?

A median of 8 in the first 10 seconds, with half between 3 and 22; the median homepage made about 134 requests in that time. News and ad-funded sites load the most: Weather.com (261), Yahoo (248) and AOL (237) lead, and 51 homepages contacted more than 50 domains. At the other end, 37 contacted none, among them Wikipedia, and Apple, Google and GitHub contacted one or two.

"Other domains" includes a company's own domains under another name, such as a content delivery network, so the count overstates true third parties a little. Google Fonts, served from Google's domains, loaded on 138 homepages (24%).

Every tool we looked for

What this means for your website

• A tag manager is the norm. 53% of the biggest sites load Google Tag Manager or its gtag.js tag, which keep the other tags in one place.
• Every tag adds requests. The median top homepage already talks to 8 other domains; check what each tag costs before adding another.
• Free session replay leads. Microsoft Clarity, which Microsoft offers free, is the most used tool of its kind on top sites.
• Chat widgets are rare on homepages. Only 7% of the biggest sites load one on the front page.

Mark Studios builds websites, handles website SEO and builds AI chat agents for businesses.

How we ran the study

Sites. The 579 working homepages found among the 1,000 highest-ranked domains on the Tranco list ZJ8PG in our homepage video study, a list built for research (Le Pochat et al., NDSS 2019). On this visit 11 failed to load or answered with an error or a bot check, leaving 568.

Crawl. On October 29, 2026 we opened each homepage in headless Chromium driven by Playwright at a desktop size of 1366 x 900, from the U.S., waited six seconds, scrolled three screens and waited two more, and recorded the host of every request the page made. We clicked nothing, so no cookie banner was accepted or refused. A tool counts when the page contacted one of its own hosts (for example googletagmanager.com, connect.facebook.net or clarity.ms); a maker's own homepages don't count for its tools, so Microsoft's sites don't count for Clarity, Google's for Google's tags or Amazon's for Amazon Ads. Google Analytics' advertising features send hits to stats.g.doubleclick.net, a host Google lists for Analytics rather than for Ads tags (Google: Tag Manager and CSP), so that host counts toward Google Analytics, not ad tags. We also read every button on the page for labels such as "Ask AI".

Checking the crawl. We fetched a random 25 homepages again with a plain HTTP client and looked for each tool's loader in the HTML: 22 answered, and of the 12 times a tool's loader appeared in the HTML, 9 had also been seen as a request. The other 3 were a consent tool served from the site's own domain (twice) and an ad pixel that had not fired within 10 seconds: the method misses tools rather than inventing them, so the shares are floors. We also screenshotted 25 homepages after the same wait: on 4 of the 7 where a chat widget was detected the chat button was visible, 0 of the 10 where nothing was detected showed one, and the other 8 had matched only on a button label, which we read by hand as described above. The other 3 had loaded a widget whose button wasn't showing yet, and on two of the four visible ones Qualified's widget opened as an "AI assistant". The screenshots also showed chats built in-house that no vendor list catches, such as Xbox's "Need help? Let's chat" bubble and Dell's AI shopping assistant, so chat is undercounted too. None of the sites or tool makers reviewed or endorsed this study.

Part of a series. The same top-1,000 domains feed six studies, each from its own visit: homepage video, social media links, homepage SEO, third-party tools, AI crawlers in robots.txt and fonts.

Limitations

• The first 10 seconds, with no clicks. Tools that load later, after scrolling further or after consent, are missed.
• Known hosts only. Tools served through a site's own domain (server-side tagging, first-party proxies) are invisible to this method, so every share here is a floor.
• Homepages only, desktop, from the U.S. Sites load different tags by country and on other pages.
• Domains, not companies. One company can appear several times.

How to cite this study

Link to the section you use, for example https://www.markstudios.com/research/website-third-party-tools-study#advertising. To cite the study as a whole:

Mark Studios. "Website Third-Party Tools Study." Published Oct 29, 2026. https://www.markstudios.com/research/website-third-party-tools-study

@misc{markstudios_website_third_party_tools_study_2026,
  author = {{Mark Studios}},
  title = {{Website Third-Party Tools Study}},
  year = {2026},
  month = oct,
  url = {https://www.markstudios.com/research/website-third-party-tools-study},
  note = {Last verified 2026-10-29}
}

Our measurements and the CSV are free to reuse under CC BY 4.0 with a link to this page.

Sources

Download the per-site results (CSV)

Widely quoted video statistics on other topics are traced to their origin, with a verdict on each, in our research fact-check.

1. Tranco, Tranco list ZJ8PG (generated October 28, 2026; ranks aggregated from Chrome UX Report, Farsight, Majestic, Cloudflare Radar and Cisco Umbrella, September 29 to October 28, 2026). Accessed 2026-10-29.
2. NDSS Symposium, Le Pochat et al., Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation (NDSS 2019). Accessed 2026-10-29.
3. Microsoft, Playwright browser automation. Accessed 2026-10-29.
4. Microsoft, Microsoft Clarity ("Free forever"). Accessed 2026-10-29.
5. Microsoft Learn, UET and Clarity integration. Accessed 2026-10-29.
6. Google for Developers, Use Tag Manager with a Content Security Policy. Accessed 2026-10-29.

Update policy and change log

We plan to rerun the crawl every six months with the homepage video study. Corrections go to contact@markstudios.com.

• Oct 29, 2026: First published: 574 homepages among the 1,000 most-visited domains.
• Oct 29, 2026, corrected the same evening: 6 bot-check pages that had been counted as homepages were removed (574 to 568); hits to stats.g.doubleclick.net now count as Google Analytics, not ad tags; a maker's own homepages no longer count for its tools; the googletagmanager.com count is labelled Google Tag Manager or gtag.js; the screenshot check is reported in full.