1,741 Partners Behind One Click: We Counted the Vendor List Your Banner Draws From

The number to find on your own site this morning is how many companies receive data when a visitor clicks Accept. Not whether your banner is pretty, not whether it has a Reject button: the count. On 30 July 2026 the privacy group noyb filed a complaint with the Austrian data protection authority arguing that a single click on the dictionary site dict.cc granted consent to 1,741 advertising partners, and that consent at that scale cannot be informed. Your own number is probably in the hundreds, you have almost certainly never looked at it, and you can change it today without touching your ad code.

What noyb is arguing

The complaint does not claim that any single partner is unlawful. It attacks the arithmetic of the consent itself. noyb states that consent must be "freely given, informed, specific and unambiguous", then points out what informed would require in practice: reading the partners' privacy policies "would at least take 170 hours (even if you just scan each policy for 6 minutes)". The remedies sought are deletion of the data, notification of everyone it was shared with, and a fine.

Treat that six-minutes-per-policy figure as a yardstick rather than a legal test. No regulator has ruled that a vendor count above some threshold is unlawful, and this complaint is unproven. What it does is turn a vague obligation into a number you can compute about your own site, which is more than most compliance advice offers.

We counted the universe those vendors come from

Most European consent banners draw their partner list from the IAB Europe Transparency and Consent Framework. That list is published as a JSON file, so we downloaded it on 30 July 2026 and counted it. Method: fetch https://vendor-list.consensu.org/v3/vendor-list.json, take the length of the vendors object, then count entries whose legIntPurposes array is non-empty.

• Global Vendor List version 169, specification version 3, last updated 2026-07-23T16:00:22Z.
• 1,196 vendors on the whole list.
• 428 of them declare at least one purpose under legitimate interest rather than consent.
• 11 purposes and 2 special features are defined, running from "Store and/or access information on a device" to "Use limited data to select content".
• 1,016 vendors declare a standard data retention period. The longest declared is 4,320 days, about 11.8 years.

One observation follows immediately, and it is ours rather than noyb's: 1,741 is larger than 1,196. A partner list that size cannot come from the TCF vendor list alone, which means a second set of ad technology providers is being stacked on top of it. If your banner shows a partner count well above the size of the framework list, the same is true of yours, and half of that list is invisible in the place you would think to look.

The legitimate-interest figure is the one to sit with. For 428 vendors, the framework contemplates processing that does not depend on the visitor clicking Accept at all. Whatever you think of that as a legal position, it means the Reject button on your banner does not do what most of your visitors assume, and it is usually a toggle in your consent tool rather than something you negotiated.

Get your own number in five minutes

Open your site in a private browsing window from an EU or UK address, let the banner appear, and follow the least prominent link on it, usually labelled Partners, Vendors, or Our partners. That screen is the disclosure your consent is supposed to rest on. Three things to write down:

1. The total partner or vendor count.
2. How many are listed under a Legitimate interest tab as opposed to Consent.
3. Whether rejecting on the first screen actually clears the legitimate-interest toggles, or leaves them on.

Multiply the first number by six minutes. That is the noyb yardstick applied to you: a site with 800 partners is asking for 80 hours of reading. If that comparison feels unfair, it is the same one now sitting in front of the Austrian DPA.

Cutting the list without cutting the revenue

The reduction is a configuration change in your consent management platform, and the order matters because the last step is the one that costs money.

Start with vendors nothing on your site calls. Most platforms default to the entire framework list because it is the safe default for them, not for you. Open your browser's network tab on an article page after accepting, sort by domain, and list the ad and analytics hosts that actually fire. In our experience that set is an order of magnitude smaller than the enabled vendor list. Everything outside it is disclosure burden with no counterpart revenue.

Then handle legitimate interest. Look for the setting that forces advertising purposes to consent rather than legitimate interest. Turning it on makes your Reject button mean what visitors think it means, and it removes 428 vendors' worth of ambiguity from your disclosure.

Then check retention. An 11.8 year declared retention period is a defensible thing for you to refuse. Sorting the vendor list by declared retention and dropping the tail is quick and does not usually touch your main demand sources.

Then measure before you cut demand partners. Removing vendors from a header bidding setup can reduce bid density and revenue. Change the list, then compare revenue per thousand impressions over a fortnight against the fortnight before. If your site earns nothing from programmatic advertising and you are running a full framework banner because your CMS installed one, the correct vendor count is zero, and the shortest route there is the one we set out in deleting the banner rather than waiting for Brussels.

Where this connects to money you already lose

A long vendor list is not only a legal exposure. Every additional partner is another party receiving your traffic data and another script in the chain that decides what a click on your site is worth. If you buy traffic as well as sell it, the same lack of visibility shows up on the other side of the ledger, which is the subject of our invalid traffic measurement routine. And if any part of your site is an AI feature rather than an ad slot, the disclosure obligations that arrived on 2 August 2026 are a separate list to check, covered in our Article 50 walkthrough.

A rule you can apply without a lawyer

If you cannot name the business reason a specific vendor is on your list, it should not be on your list. That test is stricter than anything a regulator has published and it survives whatever the Austrian DPA decides about dict.cc, because it is really a question about your own operations: you are currently sharing visitor data with companies you cannot identify, on the strength of a click that took a visitor half a second to make and would take them 170 hours to understand.