Skip to content

Commit 93aaa97

Browse files
yohhaanyohhaan
committed
Add published links to charts
1 parent 3d45382 commit 93aaa97

1 file changed

Lines changed: 21 additions & 22 deletions

File tree

‎src/content/en/2025/cookies.md‎

Lines changed: 21 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,16 @@ doi: ...TODO
2525

2626
[Cookies](https://developer.mozilla.org/docs/Web/HTTP/Cookies) allow websites to save data and maintain state information across HTTP requests, a stateless protocol. Web applications use cookies for several purposes, like authentication, fraud prevention and security, or remembering preferences and user choices, etc. However, ever since their introduction in the mid-1990s, cookies have also played a dominant role in online tracking of web users.
2727

28-
Over the years, browser vendors such as Brave, Firefox, and Safari have imposed restrictions, partitioned, and removed third-party cookies. If initially Google Chrome appeared to follow in these steps by announcing <a hreflang="en" href="https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html">plans to block all third-party cookies</a>, several delays and postponements later, Google eventually decided to <a hreflang="en" href="https://privacysandbox.com/news/update-on-plans-for-privacy-sandbox-technologies/">maintain their current approach in Chrome</a>.
28+
Over the years, browser vendors such as Brave, Firefox, and Safari have imposed restrictions, partitioned, and removed third-party cookies. While Chrome initially appeared to follow in these same steps by announcing <a hreflang="en" href="https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html">plans to block all third-party cookies</a>, several delays and postponements later, Google eventually decided to <a hreflang="en" href="https://privacysandbox.com/news/update-on-plans-for-privacy-sandbox-technologies/">maintain their current approach in Chrome</a>. As a result, cookies—the focus of this 2025 Web Almanac Chapter—remain an essential component in today's web landscape.
2929

30-
As a result, cookies—the focus of this 2025 Web Almanac Chapter—remain an essential component in today's web landscape. Next, we measure and report on the prevalence and structure of web cookies encountered on the webpages visited by the HTTP Archive crawl of July 2025. The majority of the results that follow, except when mentioned otherwise, are for the top one million (top 1M) most popular websites according to their rank in Chrome User Experience report (i.e., CrUX rank). We also report for both desktop and mobile devices; although, in practice for the results we look at, we do not observe any significant difference between the two types of devices.
30+
In the chapter below, we measure and report on the prevalence and structure of web cookies encountered on the webpages visited by the HTTP Archive crawl of July 2025. The majority of these results, except when mentioned otherwise, are for the top one million (top 1M) most popular websites according to their rank in the Chrome User Experience report (i.e., CrUX rank). Results are also shown for both desktop and mobile devices; although, in practice for our results we rarely any significant difference between the two types of devices.
3131

3232
## Background
3333

34-
To avoid repetitions and overlap with concepts and definitions already explained in the 2024 Cookies chapter, we refer interested readers to last year's [Definitions section](../2024/cookies#definitions) for an overview of the different types of cookies and the privacy and security risks they can pose.
34+
To avoid repetitions and overlap with concepts and definitions already explained in the 2024 Cookies chapter, we refer interested readers to last year's [Definitions section](../2024/cookies#definitions) for (a) an overview of the different types of cookies and (b) the privacy and security risks they can pose.
3535

3636
{# TODO check that previous link to 2024 is correct #}
3737

38-
{# TODO add links to all charts below #}
3938
{# TODO ask if queries should be uploaded for 2025, although we reused the ones from 2024 #}
4039
{# TODO resolves all todos left in document #}
4140

@@ -45,7 +44,7 @@ To avoid repetitions and overlap with concepts and definitions already explained
4544
image="first-and-third-party-prevalence.png",
4645
caption="First- and third-party prevalence.",
4746
description="Bar chart showing the prevalence of first- and third-party cookies on desktop and mobile clients. On desktop: 41% first- and 59% third-party cookies. On mobile: 40% first- and 60% third-party.",
48-
chart_url="TODO",
47+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=133146154&format=interactive",
4948
sheets_gid="1982273020",
5049
sql_file="prevalence_type_attributes_per_rank.sql"
5150
)
@@ -57,7 +56,7 @@ The overall prevalence of first- and third-party cookies on the top 1M most popu
5756
image="first-and-third-party-prevalence-by-rank-desktop.png",
5857
caption="First- and third-party prevalence of cookies by rank on desktop clients.",
5958
description="Bar chart showing the prevalence of first- and third-party cookies on desktop clients according to the popularity of the website. We see that more popular websites set significantly more third-party cookies. For the top 1k most popular websites on desktop clients, 78% of cookies set are third-party, while for the top 1M websites, 59% of cookies are third-party.",
60-
chart_url="TODO",
59+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=1437171045&format=interactive",
6160
sheets_gid="1982273020",
6261
sql_file="prevalence_type_attributes_per_rank.sql"
6362
)
@@ -67,7 +66,7 @@ The overall prevalence of first- and third-party cookies on the top 1M most popu
6766
image="first-and-third-party-prevalence.png-by-rank-mobile.png",
6867
caption="First- and third-party prevalence of cookies by rank on mobile clients.",
6968
description="Bar chart showing the prevalence of first- and third-party cookies on mobile clients according to the popularity of the website. We see that more popular websites set significantly more third-party cookies. For the top 1k most popular websites on desktop clients, 78% of cookies set are third-party, while for the top 1M websites, 60% of cookies are third-party.",
70-
chart_url="TODO",
69+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=76250674&format=interactive",
7170
sheets_gid="1982273020",
7271
sql_file="prevalence_type_attributes_per_rank.sql"
7372
)
@@ -81,7 +80,7 @@ We observe from [Figure 2](#fig-2) and [Figure 3](#fig-3) that the most visited
8180
image="cookies-attributes-overview-desktop.png",
8281
caption="An overview of cookie attributes for desktop clients.",
8382
description="This figures gives an overview of how cookie attributes are used for desktop clients for both first- and third-party cookies. 100% of third-party cookies include the `SameSite` and `Secure` attributes. Only 1% of first-party cookies and 10% of third-party cookies use `Partioned`. 19% of first-party cookies set their `Session` attribute, while this is the case for only 7% of third-party cookies. Finally, 12% of first-party cookies and 28% of third-party cookies use the `HttpOnly` attribute.",
84-
chart_url="TODO",
83+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=1053912620&format=interactive",
8584
sheets_gid="1982273020",
8685
sql_file="prevalence_attributes_per_type.sql"
8786
)
@@ -91,7 +90,7 @@ We observe from [Figure 2](#fig-2) and [Figure 3](#fig-3) that the most visited
9190
image="cookies-attributes-overview-mobile.png",
9291
caption="An overview of cookie attributes for mobile clients.",
9392
description="This figures gives an overview of how cookie attributes are used for mobile clients for both first- and third-party cookies. We observe the exact same results as for desktop clients. 100% of third-party cookies include the `SameSite` and `Secure` attributes. Only 1% of first-party cookies and 9% of third-party cookies use `Partioned`. 19% of first-party cookies set their `Session` attribute, while this is the case for only TODO% of third-party cookies. Finally, 12% of first-party cookies and 26% of third-party cookies use the `HttpOnly` attribute.",
94-
chart_url="TODO",
93+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=435743769&format=interactive",
9594
sheets_gid="1982273020",
9695
sql_file="prevalence_attributes_per_type.sql"
9796
)
@@ -109,7 +108,7 @@ On [compatible browsers](https://developer.mozilla.org/docs/Web/Privacy/Privacy_
109108
image="top-third-party-CHIPS.png",
110109
caption="Top partitioned cookies (CHIPS) in third-party context.",
111110
description="A chart showing the top third-party domains setting partitioned cookies. The top partitioned cookies in third-party context are `cf_clearance` set by Cloudflare and is used for anti-bot challenge.",
112-
chart_url="TODO",
111+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=1834436287&format=interactive",
113112
sheets_gid="581303793",
114113
sql_file ="CHIPS_top_20_third_party_cookies.sql"
115114
)
@@ -123,7 +122,7 @@ So, in the past year YouTube appears to have altered how these cookies were set
123122
image="top-first-party-CHIPS.png",
124123
caption="Top partitioned cookies (CHIPS) in first-party context.",
125124
description="A chart showing the top first-party partitioned cookies. The top cookie `cf_clearance` is set by Cloudflare on about 92% of pages, and indicates that the user has successfully completed bot detection.",
126-
chart_url="TODO",
125+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=1232746047&format=interactive",
127126
sheets_gid="581303793",
128127
sql_file="CHIPS_top_20_first_party_cookies.sql"
129128
)
@@ -172,7 +171,7 @@ To learn more about the `SameSite` attribute, see the following references:
172171
image="same-site-desktop.png",
173172
caption="`SameSite` attribute for cookies on desktop client.",
174173
description="Shows the prevalence of the `SameSite` attribute and its value for both first-party and third-party cookies on desktop clients. 3.31% of first-party cookies set the `SameSite` attribute to `Strict`, 19.23% use `SameSite=Lax` (which is the default), 11.21% set the value to `None` and 66.24% do not specify the value of `SameSite`. Nearly 100% of third-party cookies set the `SameSite` attribute to `None`, in order for these cookies to be sent in a cross-site context.",
175-
chart_url="TODO",
174+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=42361140&format=interactive",
176175
sheets_gid="1982273020",
177176
sql_file="prevalence_attributes_per_type.sql"
178177
)
@@ -182,7 +181,7 @@ To learn more about the `SameSite` attribute, see the following references:
182181
image="same-site-mobile.png",
183182
caption="`SameSite` attribute for cookies on mobile client.",
184183
description="Shows the prevalence of the `SameSite` attribute and its value for both first-party and third-party cookies on mobile clients. We see very similar results as for desktop clients. 3.11% of first-party cookies set the `SameSite` attribute to `Strict`, 19.46% use `SameSite=Lax` (which is the default), 11.28% set the value to None and 66.15% do not specify the value of `SameSite`. Nearly 100% of third-party cookies set the `SameSite` attribute to `None`, in order for these cookies to be sent in a cross-site context.",
185-
chart_url="TODO",
184+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=413420306&format=interactive",
186185
sheets_gid="1982273020",
187186
sql_file="prevalence_attributes_per_type.sql"
188187
)
@@ -203,7 +202,7 @@ For first-party cookies, about 87% of them have the `SameSite=Lax` (20% explicit
203202
image="cookie-prefixes-desktop.png",
204203
caption="Cookie prefixes observed on desktop pages.",
205204
description="Shows the observed cookies prefixes used on desktop pages. We see that 0.032% of first-party cookies and only 0.001% of third-party cookies include `__Host-`. Similarly, 0.03% of first-party cookies and 0.001% of third-party cookies include `__Secure-`. ",
206-
chart_url="TODO",
205+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=908965565&format=interactive",
207206
sheets_gid="1982273020",
208207
sql_file="prevalence_attributes_per_type.sql"
209208
)
@@ -213,7 +212,7 @@ For first-party cookies, about 87% of them have the `SameSite=Lax` (20% explicit
213212
image="cookie-prefixes-mobile.png",
214213
caption="Cookie prefixes observed on mobile pages.",
215214
description="Shows the observed cookies prefixes used on mobile pages. We observe very similar results to the cookies prefixes used on desktop pages. We see that 0.031% of first-party cookies and only 0.001% of third-party cookies include `__Host-`. Similarly, 0.03% of first-party cookies and 0.001% of third-party cookies include `__Secure-`. ",
216-
chart_url="TODO",
215+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=1209286948&format=interactive",
217216
sheets_gid="1982273020",
218217
sql_file="prevalence_attributes_per_type.sql"
219218
)
@@ -232,7 +231,7 @@ For first-party cookies, about 87% of them have the `SameSite=Lax` (20% explicit
232231
image="top-first-party-cookies-set.png",
233232
caption="Top first-party cookies set.",
234233
description="The chart shows the most widely-set first-party cookies. Google Analytics sets the `_ga` and `_gcl_au` cookies, which are used for website statistics, analytics reports, and targeted advertising, on more than 60% and 25% of websites, respectively, for both mobile and desktop clients.",
235-
chart_url="TODO",
234+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=219782191&format=interactive",
236235
sheets_gid="503090386",
237236
sql_file="top_20_first_party_cookies.sql"
238237
)
@@ -244,7 +243,7 @@ For first-party cookies, about 87% of them have the `SameSite=Lax` (20% explicit
244243
image="top-third-party-cookies-set.png",
245244
caption="Top third-party cookies and domains that set them.",
246245
description="The chart shows the most widely-set third-party cookies. DoubleClick sets third-party advertising cookies on a little over 35% of pages. Microsoft also sets advertising cookies on 23% of pages. All top 10 domains setting third-party cookies are related to tracking and advertising.",
247-
chart_url="TODO",
246+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=232078905&format=interactive",
248247
sheets_gid="503090386",
249248
sql_file="top_20_third_party_cookies.sql"
250249
)
@@ -256,7 +255,7 @@ For first-party cookies, about 87% of them have the `SameSite=Lax` (20% explicit
256255
image="top-cookie-domains.png",
257256
caption="Top registrable domains setting cookies.",
258257
description="The chart shows the most common domains that set cookies on the web. Google's owned advertising platform DoubleClick sets cookies on more than 33% of the top 1M websites while others in this top 10 domains are at about 5% to 15%.",
259-
chart_url="TODO",
258+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=483296297&format=interactive",
260259
sheets_gid="503090386",
261260
sql_file="top_20_domains_setting_cookies.sql"
262261
)
@@ -389,7 +388,7 @@ For first-party cookies, about 87% of them have the `SameSite=Lax` (20% explicit
389388
image="number-cookies-cdf-desktop.png",
390389
caption="Number of cookies per website (cdf) for desktop pages.",
391390
description="The graph shows the cumulative distribution function for the number of cookies set on desktop pages. We see that more websites have a number of first-party cookies that is closer to the maximum of first-party cookies observed, than for third-party cookies.",
392-
chart_url="TODO",
391+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=160162622&format=interactive",
393392
sheets_gid="1535389309",
394393
sql_file="nb_cookies_cdf.sql"
395394
)
@@ -399,7 +398,7 @@ For first-party cookies, about 87% of them have the `SameSite=Lax` (20% explicit
399398
image="number-cookies-cdf-mobile.png",
400399
caption="Number of cookies per website (cdf) for mobile pages.",
401400
description="The graph shows the cumulative distribution function for the number of cookies set on mobile pages. We see that more websites have a number of first-party cookies that is closer to the maximum of first-party cookies observed, than for third-party cookies. Additionally, we observe very similar results for both desktop and mobile websites.",
402-
chart_url="TODO",
401+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=569578852&format=interactive",
403402
sheets_gid="1448286433",
404403
sql_file="nb_cookies_cdf.sql"
405404
)
@@ -536,7 +535,7 @@ Most cookies used for tracking have a size greater than <a hreflang="en" href="h
536535
image="size-cookies-cdf-desktop-mobile.png",
537536
caption="Size of cookies per website (cdf) for desktop and mobile pages.",
538537
description="The graph shows the cumulative distribution function for the number of cookies set on desktop and mobile pages. We see a very similar distribution for cookies sizes for both desktop and mobile clients.",
539-
chart_url="TODO",
538+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=1496593333&format=interactive",
540539
sheets_gid="1499552173",
541540
sql_file = 'size_cookies_cdf.sql'
542541
)
@@ -669,7 +668,7 @@ Most cookies used for tracking have a size greater than <a hreflang="en" href="h
669668
image="age-cookies-cdf-desktop-mobile.png",
670669
caption="Age of cookies per website (cdf) for desktop and mobile pages.",
671670
description="The graph shows the cumulative distribution function for the age of cookies set on desktop and mobile pages. About 45% of cookies expire after 90 days. We find the same results for both mobile and desktop clients. Additionally, 50% of cookies have a lifespan of maximum just below 1 year, while the other half remain stored in the browser for longer than a year. We see a somewhat similar distribution for cookies sizes for both desktop and mobile clients.",
672-
chart_url="TODO",
671+
chart_url="https://docs.google.com/spreadsheets/d/e/2PACX-1vSzdHAn-vwJ-Z05NYWZrImgKaX0q5D-jgWay8FD9lMDj2jr3cEjozE083JOSi6cZZX37vVD2TjEKw28/pubchart?oid=1741245502&format=interactive",
673672
sheets_gid="718820729",
674673
sql_file="age_expires_cookies_cdf.sql"
675674
)

0 commit comments

Comments
 (0)