Tracker blocking

The checks on the other pages ask whether a tracker that runs can recognise you. Blocking acts one step earlier: the request to the tracker never leaves the browser, so no cookie is read, no script runs and no fingerprint is taken. It is the most effective protection when it works, and the least predictable, because it depends entirely on a list being right. This area carries of the 100 points.

Two ways to block

Blockers decide what to stop in one of two ways, and the two checks on this page are built to tell them apart.

• Filter lists match the address of each request against patterns. EasyList (ads) and EasyPrivacy (tracking) are the most widely used lists; uBlock Origin, Adblock Plus and Brave's built-in Shields read them^[1]. A rule can name a whole host, or a path that is blocked wherever it is hosted:

  ||google-analytics.com^            a host and all its subdomains
  /pagead/js/adsbygoogle.js          this path on any host
  /fingerprint2.min.js$script        a script by its file name

  The syntax is documented by Adblock Plus and uBlock Origin^[2][3].
• Domain lists block or restrict known tracker hosts and ignore paths. Firefox's Enhanced Tracking Protection and DNS-level blockers work this way. They are robust against renamed files but blind to a tracker served from an unknown or first-party host.

Since 2024, Chrome has moved extensions to Manifest V3, which replaces the blocking request API with declarative rule sets. Chrome 138 (July 2025) was the last version to run Manifest V2 extensions such as the original uBlock Origin^[4]; its successor, uBlock Origin Lite, works entirely from declarative rule sets built from the same lists^[5].

Ad- and tracker-shaped requests

What Bye Spy measures

The test loads twelve harmless files from its own test tracker, named the way advertising and analytics files are named, plus two ordinary files as controls:

Each script is an empty comment served as JavaScript, each image a 1×1 GIF. A file counts as stopped when its error event fires or it has not loaded after eight seconds. If either control fails too, the network to the tracker failed and the check reports Failed rather than crediting a blocker that did nothing.

Why it matters

The test tracker's domain is on no list, so only a blocker that looks at paths can stop these files. That is the realistic case for trackers that rotate domains, self-hosted analytics, and tags served through a site's own domain. A domain-list blocker scores nothing here by design. Its strength shows in the next check.

How it is used in the wild

The same bait idea runs in reverse on many sites: ad-block detection scripts load a file called ads.js, or insert an element with an ad-like class name, and check whether it survived^[6]:

const bait = document.createElement('script');
bait.src = '/ads.js';                       // sets window.adsAllowed = true when it runs
bait.onerror = () => showAdblockWall();
document.head.append(bait);

How it is scored

Safe

All twelve were stopped.

Partly leaks

Some were stopped. The value is the share stopped: 9 of 12 gives 0.75.

Leaks

None were stopped.

Lighter than the real-tracker check: it shows whether name-based blocking is present, while the real-tracker check shows whether real tracking requests are stopped. When the real servers are not tested (the box is unticked), this check carries the whole area, so the score's basis says how many checks it rests on.

Known tracker servers

What Bye Spy measures

Only when you tick the box, the test requests the real script address of 30 widely deployed third parties, in five groups:

Each request is a fetch with mode: 'no-cors', credentials: 'omit', referrerPolicy: 'no-referrer' and cache: 'no-store'. Nothing is executed and the response is opaque, but a request that resolves at all reached the server. A request that fails counts as stopped, and so does one with no answer within eight seconds; the report lists how many timed out. The test page's Content-Security-Policy names exactly these hosts, so the page cannot contact anything else.

Why it matters

These are the scripts that do the tracking described on the other pages. A blocked script cannot set a cookie, read a fingerprint or record a session. Session-recording scripts in particular capture what you type and click on a page; Englehardt, Acar and Narayanan found them on 482 of the 50,000 most popular sites in 2017, and documented passwords and card numbers captured in recordings^[7].

Evidence and prevalence

Nine in ten pages load at least one third party^[8]. In the HTTP Archive's 2024 crawl, classified with WhoTracks.me's tracker database, Google Analytics appeared on 55% of desktop pages, the Google tag on 60%, DoubleClick on 40% and Facebook on 25%; at least one known tracker appeared on 95%^[9]. Ghostery's WhoTracks.me puts Google's trackers on 68.8% of all web traffic^[10].

What reaches these servers can be sensitive. In June 2022, The Markup found the Meta Pixel on the websites of 33 of the top 100 US hospitals, sending details whenever someone clicked to schedule an appointment, and inside the password-protected patient portals of seven health systems^[11].

How it is scored

Safe

All 30 were stopped.

Partly leaks

Some were stopped. The value is the share stopped: 24 of 30 gives 0.8.

Leaks

All 30 were reached.

The heavier of the two blocking checks: it measures blocking against the real tracking infrastructure people meet every day. Counting a timeout as stopped errs towards the browser. A slow network or a server that is down can raise the score, which the report flags with the number of timeouts.

References

1. EasyList. easylist.to
2. Adblock Plus. "How to write filters" cheat sheet. adblockplus.org/filter-cheatsheet
3. uBlock Origin wiki. "Static filter syntax." github.com/gorhill/uBlock/wiki/Static-filter-syntax
4. Chrome for Developers. "Manifest V2 support timeline." developer.chrome.com/docs/extensions/develop/migrate/mv2-deprecation-timeline
5. uBlock Origin Lite. github.com/uBlockOrigin/uBOL-home
6. Clearcode. "How Do Websites Detect Ad Blockers?" clearcode.cc/blog/detect-ad-blockers
7. S. Englehardt, G. Acar, A. Narayanan. "No boundaries: Exfiltration of personal data by session-replay scripts." Freedom to Tinker, Princeton CITP, 15 November 2017. blog.citp.princeton.edu/2017/11/15/…
8. HTTP Archive. Web Almanac 2024, Third Parties chapter. almanac.httparchive.org/en/2024/third-parties
9. HTTP Archive. Web Almanac 2024, Privacy chapter. almanac.httparchive.org/en/2024/privacy
10. Ghostery. WhoTracks.me. ghostery.com/whotracksme
11. T. Feathers, K. Fondrie-Teitler, A. Waller, S. Mattu. "Facebook Is Receiving Sensitive Medical Information from Hospital Websites." The Markup, 16 June 2022. themarkup.org/pixel-hunt/2022/06/16/…