# Method

## Sample

Four company lists, one homepage per company:

| Group | Domains on the list | Archived record scored | Counted (denominator) |
| --- | ---: | ---: | ---: |
| Inc 5000 (2026) | 4,969 | 4,929 | 4,885 |
| Y Combinator | 6,133 | 6,133 | 5,386 |
| Fortune 500 (2026) | 500 | 472 | 472 |
| Unicorns | 1,111 | 1,000 | 1,000 |

Fortune 500 rows are the 2026 list (`companies_2026.csv`); the 2023 list is
held separately and is not counted here.

## Detection

One homepage fetch per domain, rendered in a headless browser, archived as a
gzipped record. Visitor-identification tags are injected by JavaScript, so a
plain fetch finds only part of what is there and every number here comes from
the rendered record. A domain with no usable rendered record falls back to its
plain record; 72 Inc 5000 and 144 YC domains are counted that way.

Detection is a regex rule per vendor, written from the hostnames the vendor's
own snippet loads (for example `cdn.getkoala.com/`, `tag.unifyintent.com/`,
`app.factors.ai/assets/`). Rules are deliberately narrow: a vendor named in a
consent banner's provider list, in a Content-Security-Policy header or in an
opt-out link does not count as an install.

## Levels

Company-level vendors resolve the visiting company from its IP address.
Person-level vendors resolve an individual visitor or household and are marked
`person_level=yes`: RB2B, Warmly, Vector, Retention.com, Customers.ai,
Opensend, Hyros. Retention.com and RB2B share a script family, so a site
running both can be attributed to either; both are counted in the person-level
total once.

## Consent

`consent_tool` is yes when a consent-management platform from the Consent and
Privacy category (OneTrust, Cookiebot, TrustArc, Usercentrics, Osano, Iubenda,
CookieYes, Termly, Didomi, Quantcast Choice, Complianz) is detected on the same
homepage. A no means no consent-management tool was detected, which is not the
same as no banner: a hand-built banner leaves no vendor fingerprint.

## Rounding and suppression

Shares below a base of 20 domains are not published. Counts of one to four are
reported as "<5" in prose; the CSVs carry the exact counts.

Licensed CC BY 4.0. Source: Installmap.