What a free browser game really downloads
We opened 70 popular free web games on seven portals, three times each, and clicked nothing. In the first minute, every Armor Games page contacted between 157 and 162 advertising and tracking companies, and every Coolmath Games page between 142 and 166. On itch.io, Friv and Y8 the typical page contacted one. Each page’s figure is the median of its three loads.
Disclosure: we make MANXLAB, a small set of free browser games with no ads, and our own games are measured here by the same method. That is a reason to check our work, which is why the script and every measurement are published below.
Key findings
- In its first minute, with nothing clicked, every one of the ten Armor Games pages we opened contacted between 157 and 162 advertising and tracking companies, and every Coolmath Games page between 142 and 166, taking each page's median of its three loads.
- Most of that happens at once: within five seconds a typical Coolmath Games page had reached 114 of them and an Armor Games page 102.
- Taking each page's median of its three loads, Armor Games pages made between 6,216 and 6,986 network requests in that minute; Coolmath Games pages made between 2,538 and 7,066. The busiest, Coolmath Games' Chess, made 7,066 in the middle of its three loads.
- Cookies came with them: after a minute a typical Armor Games page held cookies from 187 outside domains, a Coolmath Games page from 163.
- The spread between portals is enormous. On itch.io, Friv and Y8 the typical game page contacted one advertising or tracking company, and on Kizi three.
- On ABCya, which describes itself as games for grades PreK through 6, the typical page contacted 9 advertising and tracking companies, and on every load its requests to Google's ad server asked for non-personalised ads. Google, The Trade Desk, Criteo, OpenX, RTB House, Turn (now Nexxen) and Yahoo were present on every ABCya, Armor Games and Coolmath Games page we opened.
- Google's advertising or analytics domains were present on all 70 portal game pages we measured.
- Across the 70 portal games we counted 203 advertising and tracking companies in the first minute, as the public company list we use names them. That list names a few companies more than once, so the number of distinct companies is slightly lower.
- In the 28 September snapshot, our games contacted no advertising or tracking company in our classification and set no cookies. Each made two requests to Cloudflare's analytics beacon, which the company list we use does not class as tracking but the EasyPrivacy block list does. Riviera Rush also loaded Google Fonts at that time; the site now serves its fonts from its own files, so that Google request is gone. The published data remains a record of the measured snapshot.
Every portal, side by side
Each figure is the median of the portal's games, and each game's figure is the median of three loads. Nothing was clicked: no consent prompt, no play button, no ad.
| Portal | Ad & tracking companies | Outside cookie domains | Requests | MB received |
|---|---|---|---|---|
| Armor Games | 158.5 | 187 | 6,763.5 | 8.9 |
| Coolmath Games | 147 | 163 | 2,997 | 13.3 |
| ABCya | 9 | 11 | 157 | 4.9 |
| Kizi | 3 | 1 | 59 | 1.0 |
| Y8 | 1 | 1.5 | 189 | 3.4 |
| itch.io | 1 | 0 | 61 | 4.2 |
| Friv | 1 | 1 | 89 | 7.7 |
| MANXLAB (ours) | 0 | 0 | 11 | 0.2 |
Figures are medians, so some end in .5. Ranges for every column, per game and per load, are in the games and runs files. By the standard of the ad-blocker lists, MANXLAB’s first column would be 1, not 0: see our own site.
It starts at once
Most of the contacts happen before a player could reasonably have done anything. Five seconds after the page opened, a Coolmath Games page had already reached 114 advertising and tracking companies, and an Armor Games page 102. On Armor Games the count kept climbing for half a minute as ad slots refreshed.
Cookies in the first minute
After one minute, a typical Armor Games page held cookies set by 187 outside domains, and a Coolmath Games page by 163. Much of this traffic has the shape of what the ad industry calls “cookie syncing”, companies passing their identifiers for a visitor to one another, often through tiny image requests. Our method records the addresses requested, not the data sent in them or the responses. Nothing was clicked, so no consent was given to anything. Kizi and Y8 both load a consent manager; we did not test what changes once a visitor answers one.
Who they are
Google’s advertising or analytics domains appeared on all 70 portal game pages. Google, The Trade Desk, Criteo, OpenX, RTB House, Turn (now Nexxen) and Yahoo, all advertising-technology companies, appeared on every one of the 30 ABCya, Armor Games and Coolmath Games pages. Across the 70 portal games we counted 203 advertising and tracking companies in the first minute, as the public company list names them. On every ABCya load, every request to Google’s ad server asked for non-personalised ads (npa=1): 33 requests across 30 loads of 10 pages. Three of those requests also carried the child-directed flag (tfcd=1). All three were on one page, Break the Bank Counting, one in each of its three loads. The full list, per page and per load, is in domains.csv.
What this does not show
- It is not a finding that any site broke a law. We measured what loaded; we did not assess consent, contracts, or how any company used the data.
- Contacting a company is not the same as targeting. Our method sees requests, not what was inside them, so it cannot tell a personalised ad from a contextual one.
- Audiences differ. ABCya describes itself as games for grades PreK through 6. Coolmath Games says it is designed for users aged 13 and older and points younger children to Coolmath4Kids. We name each site’s own description rather than label its audience ourselves.
- The company counts are approximate, in both directions. A company counts as advertising or tracking only if a public list says so. Several ad companies on Armor Games and Coolmath Games are missing from that list, so they count as outside domains but not as advertising, which lowers the count. The same list names some companies more than once, which raises it: LiveRamp appears under two names; Turn, Tremor Video and Unruly are listed separately although all are now part of Nexxen; Rubicon Project and SpotX are listed separately although both are now part of Magnite. It also assigns
liadm.comandcompany-target.comto IPONWEB, where LiveIntent and Demandbase each document the domain as their own. We used the list as published and have not rebuilt it. Merging the two LiveRamp names alone gives 202 companies and an Armor Games median of 157.5; merging the Nexxen and Magnite names as well gives 199 companies, 155.5 for Armor Games and 145 for Coolmath Games. The lists ad blockers use flag more domains overall than we do: 304 against our 231. - Requests are logged when they finish or fail. A request still in flight at a cut-off is not counted, and a failed request still counts as contact with its domain. 30 of the 339,264 logged requests are not network requests at all: 28 are pages probing for browser extensions and two are blank frames.
- One country, one moment. Measured from the United States on 28 September 2026. Visitors in Europe see consent prompts, so numbers there would differ; ad auctions vary from minute to minute.
- Nothing was clicked. Playing a game, or accepting a prompt, would add more.
How we measured
The sample
For each portal we took the first ten game pages, in page order, from its own list of popular or top games on 28 September 2026. ABCya and Friv publish no popularity list, so their ten come from their home pages. Every list page was saved on the day. We added the eight games live on MANXLAB that day.
Two of the biggest portals are not here. Poki’s terms forbid using “any robot, spider or other automatic device” to access the site, and CrazyGames’ terms forbid “any systematic or automated data collection”. We respected both and measured neither. Newgrounds refused our automated requests, so we left it out.
The measurement
Each page was opened in a fresh, empty Chrome profile: Chrome 154 running headless (without a visible window) and configured to behave as an ordinary visitor’s browser would, from a US connection. Service workers were blocked so every request was visible. Nothing was clicked. We recorded every request the page, its frames and its workers made, the compressed bytes received, and the cookies present at 5, 10, 30 and 60 seconds. Each game was loaded three times, on different rounds, and we report medians. For 3 games one load failed on both attempts, so those games have two loads instead of three.
Who counts as an advertising or tracking company
Domains are grouped by the organisation that owns them using Patrick Hulce’s open third-party-web list (version 0.30.0, MIT licence), plus a supplement of our own for domains it lacks. Each supplement row cites a public source where we found one, usually the company’s own site or the open-source ad-auction code (Prebid) that names it; rows we could not source are marked unknown and not counted as advertising. A company counts as advertising or tracking when that list places it under advertising, analytics, marketing or tag management. We cross-checked against EasyList and EasyPrivacy, the lists ad blockers use, counting only their rules that block a whole domain. Of the 244 classified domains that we or the lists flag as advertising or tracking, both flag 190 (78%). We flag 41 that the lists do not, and the lists flag 13 that we class as something else, so the disagreements run both ways. The lists are by The EasyList authors; we used the EasyList and EasyPrivacy sources at easylist/easylist commit 4300ac0edfef0a381cc8ca0b12c8fa965715d810 (the 28 September 2026, 15:01 UTC build). Our notes from the day recorded a commit made fourteen minutes later; the rule counts we recorded match this one, and the reproduce folder explains how we settled it. A portal’s own domains, including the servers it delivers its files from, count as its own (they are listed in supplement.csv).
Check our arithmetic
The figures in this cross-check and the ABCya ad-flag counts can be recomputed by anyone, with nothing but Python 3, from the files in the reproduce folder. Request addresses are published there without their parameters, apart from the two ad flags (npa and tfcd), because the full addresses identify the connection the measurement was run from.
A side effect we should declare
The pages were loaded by an automated browser configured to behave as an ordinary visitor’s browser would. Automated visits can trigger network activity and may start ad auctions. We did not inspect billing records and do not know whether any advertiser was charged. We kept the study to 231 page loads: 78 games loaded three times each, less the 3 loads that failed.
Our own site
In the 28 September snapshot, every MANXLAB game made two requests to Cloudflare’s analytics beacon, and Riviera Rush loaded Google Fonts. These are historical measurements: the live site now serves its fonts from its own files and no longer requests Google Fonts.
The beacon is counted in the tables as one outside company, but not as advertising or tracking, because the company list we use files its domain, cloudflareinsights.com, under utility. EasyPrivacy, one of the ad-blocker lists we cross-checked against, does flag that domain. By the block lists’ standard our own figure would be one, not zero.
MANXLAB also logs activity to its own API. A random ID is kept in browser local storage. The hub sends that ID, the referring site’s hostname, and the visit time to MANXLAB. When a game page opens, it sends the ID, game, session, and visible time; the session is updated every 15 seconds while the page is visible and when it is hidden or closed. MANXLAB records when each update arrives. A vote is stored with the ID, game, vote, and vote time. Some games also save settings, high scores, or progress in local storage on the device; those saves are not sent to MANXLAB. These first-party records are not part of the third-party company counts above. MANXLAB has no automatic deletion schedule for these records; see the privacy page.
Data and script
Everything is free to reuse under CC BY 4.0 with a link to this page.
- portals.csv, one row per portal · games.csv, one row per game · runs.csv, one row per load · domains.csv, every domain contacted per load, with its owner and category. It lists domains that made a request. A domain can hold a cookie without making a request inside the minute, so a load’s count of outside cookie domains in runs.csv can be higher than domains.csv shows; the second load of Kingdom Rush Frontiers is one such case (193 against 192).
- The script: measure.cjs (Node and Playwright), analyze.py and aggregate.py (Python, standard library), facts.py, make_charts.py. Start with README.txt.
- To recompute the block-list cross-check and the ad-flag counts: the reproduce folder (Python, standard library), with every request of every load (3.1 MB, addresses without their parameters).
- The game list: sample-urls.txt. The company data: entities.json and supplement.csv (built on third-party-web, MIT licence; see its licence).
Context
A 2024 study of about two thousand websites for children found trackers on around 90% of them and targeted ads on about 27% (Moti et al., “Targeted and Troublesome”, IEEE S&P 2024). The same year, Internet Safety Labs reported that Coolmath Games’ ad configuration was set to coppa: false and that location data was sent into ad auctions; the owner then clarified that the site is for users aged 13 and older. The US Federal Trade Commission’s amended children’s privacy rule, which, with some exceptions, requires separate parental consent before a site covered by it discloses children’s personal information to third parties, including for advertising, reached its compliance date on 22 April 2026. Whether it applies to any site measured here depends on facts this study does not examine. For scale, the median desktop home page in 2025 made 80 requests (HTTP Archive Web Almanac 2025).
Cite or embed
APA
Klebl, C. (2026). What a free browser game really downloads. MANXLAB, Sterling Digital Partners. Retrieved from https://manxlab.com/research/free-game-trackers/
Chicago
Klebl, Chris. “What a free browser game really downloads.” MANXLAB, Sterling Digital Partners, 28 September 2026. https://manxlab.com/research/free-game-trackers/
BibTeX
@misc{klebl2026freegametrackers,
author = {Klebl, Chris},
title = {What a free browser game really downloads},
howpublished = {MANXLAB, Sterling Digital Partners},
year = {2026},
month = sep,
url = {https://manxlab.com/research/free-game-trackers/},
note = {Data CC BY 4.0}
}
Wikipedia
{{cite web |last=Klebl |first=Chris |title=What a free browser game really downloads |url=https://manxlab.com/research/free-game-trackers/ |website=MANXLAB |publisher=Sterling Digital Partners |date=28 September 2026}}
Link to it
<a href="https://manxlab.com/research/free-game-trackers/">What a free browser game really downloads</a>, MANXLAB, 2026
Every chart above has its own embed code.
Changes to this page
- 8 October 2026. After outside reviews, we stopped calling the company counts conservative and now say they are approximate in both directions, naming the companies the public list counts more than once and what merging them does to the figures. We said why our own Cloudflare beacon is not counted as tracking and that the EasyPrivacy block list flags it. We said the ranges are each page’s median of three loads, showed the sum behind the 231 loads, noted how requests are logged, the block-list commit our notes recorded, and why two of the data files can differ by one cookie domain. We added “with some exceptions” to the sentence on the US children’s privacy rule. No figure changed.
- 7 October 2026. We stated the sum behind the 78% agreement figure, said that all three child-directed ad requests were on one page, published the reproduction kit, replaced a guess about advertisers being billed with what we know, and described the activity MANXLAB itself logs. No figure changed.
See also: Browser games that actually work offline, tested.
Corrections
If a figure looks wrong, email [email protected] with the game and the figure. We will re-check it and date any correction on this page.