The median website sets 9 cookies, according to the HTTP Archive’s Web Almanac 2025, which crawled the top 1 million websites by Chrome User Experience Report ranking in July 2025. That figure is a median, not a mean, and it hides a long tail: a typical top-10% site loads 44 or more cookies, and the heaviest 1% of sites carry past 395. First-party and third-party cookies split close to evenly at the median, but third-party tracking cookies take over as a site’s popularity grows.
How many cookies does the average website actually set?
Nine, at the median, whether a visitor loads the site on desktop or mobile. That number comes from the HTTP Archive’s Web Almanac, an annual measurement project that crawls the top 1 million websites ranked by Chrome User Experience Report popularity and logs every cookie set during the page load. In the July 2025 crawl, desktop pages set a median of 9 cookies total (7 first-party, 7 third-party), and mobile pages also landed at 9 (6 first-party, 4 third-party).
The word “average” in the question this article answers is doing a lot of work. A mean would be pulled far higher by a small number of cookie-heavy sites, so the Web Almanac reports a median, the middle value across the full 1-million-site sample, which is the more honest number for describing what a typical visit looks like.
Figure 1: Roughly how the 1-million-site sample splits around the median cookie count. Source: HTTP Archive Web Almanac, July 2025 crawl.
The one-sentence version: half of all sites set 9 cookies or fewer, and the other half climb from there, some of them steeply.
How skewed is the distribution above the median?
Sharply. The Web Almanac publishes a full percentile breakdown, not just the median, and the climb from the middle of the distribution to the tail is the real story for anyone auditing a site’s cookie footprint. On desktop, the 25th percentile site sets 4 cookies, the median sits at 9, the 75th percentile jumps to 23, the 90th percentile reaches 44, and the 99th percentile hits 395.
| Percentile | First-party | Third-party | Total |
|---|---|---|---|
| p25 | 3 | 2 | 4 |
| p50 (median) | 7 | 7 | 9 |
| p75 | 13 | 16 | 23 |
| p90 | 22 | 40 | 44 |
| p99 | 45 | 399 | 395 |
Source: HTTP Archive Web Almanac, desktop, July 2025 crawl.
Figure 2: Cookie count climbs slowly through the median and then explodes in the top decile. Source: HTTP Archive Web Almanac, July 2025 crawl.
Below the median, first-party and third-party cookies grow at roughly the same pace. Above it, third-party cookies pull away: at p90, third-party cookies (40) outnumber first-party (22) almost two to one, and by p99 the gap widens to nearly nine to one. A site with an unusually high cookie count is almost always carrying an unusually large stack of third-party ad, analytics, and embed scripts, not an unusually large stack of its own first-party cookies.
Does the count change on mobile versus desktop?
Only slightly, and the difference is concentrated entirely in third-party cookies. The July 2025 crawl found the same total median on both platforms, 9 cookies, but the composition differs: desktop pages split 7 first-party to 7 third-party, while mobile pages split 6 first-party to 4 third-party. Mobile pages load fewer third-party scripts on average, likely a byproduct of leaner mobile layouts and slimmer ad stacks rather than any mobile-specific privacy control.
The gap widens further out in the distribution. At the 90th percentile, desktop sites carry 44 total cookies against 43 on mobile, and at the 99th percentile the two platforms are nearly identical at 395 versus 396. Heavy sites end up equally heavy on both surfaces once a site has committed to a large third-party stack; the platform gap only shows up in the typical, lighter-weight majority of pages. Cookie counts also vary heavily by country, largely because consent laws change how many trackers a site is allowed to load before a visitor responds; see cookie consent rates by country for 2026 for the regional breakdown.
If your site is meaningfully heavier on desktop than mobile, that gap is worth investigating directly rather than assuming it is normal. It usually means a desktop-only ad unit, chat widget, or analytics tag is loading cookies that the mobile build skips.
What share of cookies are first-party versus third-party?
About 40% of cookies across the full 1-million-site sample are first-party, and about 60% are third-party, according to the same July 2025 Web Almanac crawl. That split is not evenly distributed across the web, though. Popularity changes it dramatically: among the top 1,000 most-visited sites, the third-party share climbs to 78%, against 22% first-party.
Figure 3: The most popular sites carry a much heavier third-party load than the median site. Source: HTTP Archive Web Almanac, July 2025 crawl.
The pattern makes sense once you consider what drives traffic at that scale. The most-visited sites on the web are disproportionately ad-supported publishers, retail marketplaces, and platforms running multiple analytics and advertising integrations at once, and each of those integrations typically adds its own third-party cookie. A small blog with a single analytics tag looks nothing like a top-1,000 news site running a dozen ad exchanges.
For a site owner, this means the honest inventory of “who sets a cookie on my pages” usually runs longer than the cookies your own code sets directly. If you have not audited what your ad tags, embeds, and analytics scripts are adding on your behalf, a cookie policy generator built around that first-party versus third-party split is a faster starting point than trying to reconstruct the list by hand.
Which companies set the most third-party cookies?
A small number of large ad and analytics platforms account for a disproportionate share of the cookies found across the web. In the July 2025 crawl, Google’s DoubleClick advertising infrastructure set a cookie on 33% of the top 1 million websites, and its IDE cookie alone was present on 35% of sites, with the related test_cookie appearing on 25%. Microsoft reached 14% of sites through a combination of bing.com, clarity.ms, and linkedin.com domains.
Figure 4: A handful of ad and analytics platforms show up across a large share of the entire web. Source: HTTP Archive Web Almanac, July 2025 crawl.
The concentration matters for anyone drafting a cookie policy, because it means the third-party disclosures that actually cover most of the web are a short, predictable list dominated by a few advertising and analytics vendors, not hundreds of long-tail trackers unique to each individual site. It also lines up with how few visitors ever get asked about most of these cookies in a meaningful way; see cookie consent accept rates and trends for 2026 for what happens once a banner actually shows up.
How long do these cookies actually last?
Cookies on the modern web are built for the long haul. The median first-party cookie in the July 2025 crawl is set to expire after 365 days, and the median third-party cookie after 360 days, both close to Chrome’s hard cap of 400 days, the maximum lifetime any browser cookie can be assigned since Chrome enforced the limit. Only 19% of first-party cookies and just 7% of third-party cookies are session cookies that expire when the browser closes.
Figure 5: Cookie lifetimes now cluster near the browser-enforced ceiling rather than expiring quickly. Sources: HTTP Archive Web Almanac, 2024 and 2025 crawls.
The practical read is that “the cookie will expire on its own soon” is rarely true. The typical cookie set on a website today, first-party or third-party, is designed to persist for close to a year, which is also why cookie policies need an accurate retention statement rather than a vague one.
Is the number of cookies per site trending up or down?
It ticked down slightly. The 2024 Web Almanac crawl measured a median desktop cookie count of 10, with 7 first-party and 5 third-party. By the July 2025 crawl, the desktop median had settled at 9, with first-party holding steady at 7 and third-party at 7. Mobile held flat at a median of 9 across both years.
Figure 6: As total cookie count rises, the growth is almost entirely on the third-party side. Source: HTTP Archive Web Almanac, July 2025 crawl.
Year-over-year swings this small should be read as noise around a fairly stable norm rather than a clear downward trend. The more consistent finding across both crawls is the shape of the distribution: first-party cookie counts grow modestly from the median to the tail, while third-party cookie counts grow explosively, which is the pattern a site owner should plan a cookie audit around, not the single-digit year-over-year shift in the median.
The Bottom Line
The honest answer to how many cookies the average website sets is 9, and that number has held roughly steady across the last two annual HTTP Archive crawls. What has not held steady is the shape of the distribution around it: a site in the top 10% by cookie count carries 44 or more, and the heaviest 1% carry past 395, almost entirely through third-party ad and analytics cookies rather than first-party ones. Google’s DoubleClick network alone reaches a third of the web. If you run a site with any ads, analytics, or embedded widgets, your actual cookie count is worth checking against these percentiles rather than assumed, and your published cookie policy needs to reflect the third-party vendors doing the setting, not just the cookies your own code writes.
Frequently Asked Questions
How many cookies does the average website set? The median website sets 9 cookies on both desktop and mobile, according to the HTTP Archive’s Web Almanac 2025, which crawled the top 1 million websites by Chrome User Experience Report ranking in July 2025. The 90th percentile site carries 44 cookies, and the top 1% carry 395 or more.
Are most cookies first-party or third-party? Third-party cookies make up about 60% of cookies found across the top 1 million websites, versus 40% first-party, per the HTTP Archive’s July 2025 crawl. On the 1,000 most popular sites, the third-party share rises to 78%.
Which company sets the most third-party cookies? Google, through its DoubleClick advertising infrastructure, sets a cookie on 33% of the top 1 million websites. Its IDE cookie alone appears on 35% of sites, and Microsoft’s bing.com, clarity.ms, and linkedin.com domains together reach 14%.
How long do website cookies last before they expire? The median first-party cookie is set to expire after 365 days and the median third-party cookie after 360 days, per the HTTP Archive’s 2025 crawl. Chrome caps any cookie’s maximum lifetime at 400 days, which is why that number shows up so often as an effective ceiling.
Sources and References
- HTTP Archive. (2025). “Cookies,” Web Almanac 2025. Crawl of the top 1 million websites ranked by Chrome User Experience Report, July 2025.
- HTTP Archive. (2024). “Cookies,” Web Almanac 2024. Crawl of the top 1 million websites, June 2024.
- Chrome Developers. (2024). “Reducing user agent header entropy,” related Chrome cookie expiry policy documentation covering the 400-day maximum age cap.
Note: All figures verified as of August 2026. Cookie counts and third-party vendor share shift as the HTTP Archive publishes each new annual crawl, so headline figures here are refreshed at least twice a year.
