We measured Türkiye’s most visited websites the moment they open.

The short version

• Almost all of them connect to other servers: 96 per cent of the sites we measured send a request to another domain on first load; the median site connects to 8 different domains.
• Most set tracking cookies before the visitor does anything: on 66 per cent, an analytics or advertising cookie appears as soon as the page opens. An analytics cookie is present on 59 per cent, an advertising cookie on 35 per cent.
• Privacy links are common: 84 per cent have a link to a privacy policy, a KVKK page, a privacy notice or a cookie policy on their homepage. The share of sites that set a tracking cookie and show no such link on the homepage is 10 per cent.
• The picture changes by domain extension: advertising cookies appear on 54 per cent of .com.tr sites, 20 per cent of .edu.tr sites and 4 per cent of .gov.tr sites; analytics tracking, by contrast, is common in all three groups.

How the sample was built

The sample comes from the Tranco list, which researchers use. Tranco combines five separate traffic sources into a popularity ranking of sites and publishes each list with a date. From the list dated 6 October 2026 we took the first 500 domains ending in .tr; 412 of them returned a live site in our 7 October measurement for the Türkiye Machine Readability Index. The sample of this article is those 412 sites.

Of the 412 sites, 5 were not measured because their robots.txt file closes the homepage to crawlers; 17 did not open within 30 seconds or returned a connection error. That left 390 sites: 203 .com.tr, 77 .gov.tr, 74 .edu.tr and 36 with other extensions.

What we measured, and how

We opened only the homepage of each site, in a real Chrome browser with the language set to Turkish. After the page loaded we waited until the network went quiet, then 2 seconds more; we clicked nothing, closed no banner and submitted no form. What we measured is therefore what happens in a visitor’s first seconds on the site, before they state any preference.

1. The cookies created in the browser: their names, and whether they belong to the site’s own domain or to another domain.
2. Which other domains the page sends requests to.
3. Whether the homepage has a link to a privacy policy, a KVKK page, a privacy notice or a cookie policy.

We classified cookies by name. The analytics family: Google Analytics (_ga, _gid), Microsoft Clarity (_clck, _clsk), Hotjar (_hj…) and similar. The advertising family: Google’s advertising cookies (IDE, test_cookie, _gcl_au, NID), Meta (_fbp, fr), TikTok (_ttp), Microsoft Advertising (_uetsid, _uetvid) and similar. Cookies for the session, the basket, security, language preference and the like were not counted in either family.

Results

Third-party requests. 96 per cent of the sites we measured connect to another domain on first load. The most common domains are Google’s tag manager (googletagmanager.com, 78 per cent), Google Analytics (50 per cent), Google’s advertising network doubleclick.net (43 per cent) and its ad delivery domain googlesyndication.com (26 per cent). The share of sites that send a request to at least one domain of the Google family is 90 per cent. Meta’s domains appear on 17 per cent, Yandex’s domains on 15 per cent, Microsoft Clarity on 12 per cent and TikTok on 8 per cent.

Cookies. On 95 per cent of the sites at least one cookie is created on first load; the median site sets 7 cookies. The share of sites that set at least one cookie from the analytics or advertising family is 66 per cent. Some of these are set on the site’s own domain (first party), some on another company’s domain (third party): 51 per cent of the sites have at least one third-party cookie.

Privacy link. 84 per cent of the homepages have a link to a privacy policy, a KVKK page, a privacy notice or a cookie policy. The link is present on 93 per cent of .com.tr sites, 82 per cent of .edu.tr sites and 69 per cent of .gov.tr sites.

• .com.tr · 203 sites · analytics or advertising cookie 65 per cent · advertising cookie 54 per cent · privacy link 93 per cent
• .gov.tr · 77 sites · analytics or advertising cookie 64 per cent · advertising cookie 4 per cent · privacy link 69 per cent
• .edu.tr · 74 sites · analytics or advertising cookie 76 per cent · advertising cookie 20 per cent · privacy link 82 per cent
• Other · 36 sites · analytics or advertising cookie 64 per cent · advertising cookie 28 per cent · privacy link 75 per cent
• Total · 390 sites · analytics or advertising cookie 66 per cent · advertising cookie 35 per cent · privacy link 84 per cent

What do these results mean, and what do they not mean?

A cookie being set on first load does not, on its own, make anything unlawful. The Personal Data Protection Authority’s cookie guide does not require explicit consent for strictly necessary cookies such as session, form and security cookies; it also says that first-party analytics cookies can be assessed within this scope under certain conditions: that the purpose is limited to measuring the site’s own audience, that only anonymous statistics are produced, that no cross-site tracking is done and that the data is not passed on to third parties. Advertising and third-party tracking cookies fall outside these conditions. We explain the details in our cookie policy guide.

This measurement cannot tell whether a site meets these conditions: from the outside we cannot see which settings a cookie runs with, where the data is transferred or whether the site has another legal basis. What we can say is this: before the visitor has stated any preference, a cookie from the analytics or advertising family appears on two thirds of the sites we measured, and a cookie from the advertising family is present on one third.

The limits of this measurement

• Only the homepage was measured; the picture may differ on inner pages or after an action.
• The measurement was taken from a single location at a single moment. Some sites behave differently depending on the visitor’s country or previous visit.
• Cookies were classified by name; a tracking cookie whose name is not on our list was not counted, so the shares are a lower bound.
• The link check looks at the link’s text and address; we did not assess whether the link actually leads to a privacy notice, or what that text says.
• Our measurement tool was a browser that behaved like a visitor and identified itself; we did not measure sites that close their homepage in robots.txt.

Our own site

This site writes no cookies and sends no request to another domain on first load; we use no first-party cookies at all, and only a bot check (hCaptcha) loads when someone touches the contact form. We explain how we built it in our article on designing a KVKK-compliant website. To see what your own site does on first load, open your browser’s developer tools and, without clicking anything, look at the cookie list in the “Application” tab and the requests in the “Network” tab.