The Real Cost of the “Free” Internet

Ad-tech is running a second job on your browser. You didn’t hire it. You can’t fire it. But it bills you every time you load a webpage — in bandwidth, in battery, in CPU cycles, in time, and in a permanent record of everywhere you’ve ever been.

The popular framing says the modern web is “free in exchange for ads.” That framing has been obsolete for about fifteen years. The web you actually use isn’t “ad-supported” — it’s surveillance-supported. And the cost of that surveillance doesn’t fall on the advertiser or the publisher. It falls on you, and it’s measurable.

We built adbloat because no one was measuring it honestly. Speedtests measure your connection. Ad-blocker tests measure what your blocker catches. Nobody was measuring the bill — how many bytes, how many handshakes, how many seconds of your life get siphoned into the ad-tech machine before a single pixel of content you actually wanted ever renders.

This article is the reckoning. We’ll walk through exactly what’s happening every time you open a news tab, exactly how much it costs you, and exactly how you can stop paying.

the_bill

Let’s start with a number. When you load the homepage of a typical major news site — CNN, Yahoo News, Forbes, Business Insider, Bleacher Report — your browser fires between 300 and 700 network requests before the page is finished loading. That’s not a typo. That’s the baseline reality of the modern ad-supported web.

Of those requests, fewer than 20% serve the article you came to read. The article text, images, and layout CSS typically amount to 40-80 requests. The remaining 250-620 are ad-tech infrastructure. Tracking pixels. Fingerprint scripts. Ad exchange bids. Real-time bidding negotiations between exchanges. Session replay tools. Retargeting pixels. Cross-site cookie sync endpoints. Analytics heartbeats. Pop-under loaders.

Those aren’t our numbers. Those are the findings of repeated academic and industry audits since 2014 — the sources section at the bottom lists them. What we did was build a test you can run yourself to verify the pattern on your own network in under a minute.

What ad-tech actually charges you

The charges ad-tech levies on users fall into four categories, each measurable, each invisible on the receipt.

1. Bandwidth. On cellular data, tracker bytes cost you real money. On capped home broadband, they cost you your monthly limit. Industry research from the Ad-Bloat Report and Mozilla’s own telemetry found that the average ad-heavy webpage transfers 1.5 to 3 megabytes of tracker payload per page load. At 50 page loads per day — the average for a working internet user — that’s 75-150 megabytes daily, or 27-55 gigabytes per year of ad-tech bandwidth. That’s more than most Netflix users watch in a month.

2. CPU and battery. Each tracker script runs JavaScript in your browser. That JavaScript consumes processor cycles. On mobile, processor cycles are literally battery. Apple’s Intelligent Tracking Prevention team found that blocking third-party trackers on a single news site reduced total page CPU time by 62%. A 2023 Chrome dev-tools analysis found the ad-tech portion of page rendering consumes 4-10x more CPU than the content portion.

3. Time. You feel this one. The pause between clicking a link and the article becoming readable. The scroll jank. The ad that interrupts the paragraph. The interstitial that appears after you’ve read three sentences. The Google Core Web Vitals team publishes numbers on this: the average top-1000 site has a Largest Contentful Paint (LCP) of 3.2 seconds. Remove the ad-tech payload and the same sites hit LCP in 0.9 seconds. You are waiting two to three seconds per page, every page, for content you never asked for.

4. Identity. The most expensive charge is the one that never shows up on your system resources. Every tracker script that loads on your page is an opportunity for a third-party server to learn your IP address, user-agent, referrer, cookies, and — with fingerprinting — your canvas hash, audio context signature, screen dimensions, font list, and timezone. Each of those identifiers becomes a permanent entry in a data broker’s graph of you. Data brokers sell that graph for fractions of a cent per record. Collectively, your browsing data is worth $200-400 per year on the ad-tech market. You see none of it.

the_compound_math

Fifty pages per day. Three hundred sixty-five days per year. Multiply the per-page cost of ad-tech by those numbers and the totals become unhinged.

Ninety-four hours per year. That’s almost four full days of your life spent staring at a loading browser, across a typical year of web use. Four days that ad-tech pays no tax on, that you can’t invoice, and that you don’t even remember because the seconds are siphoned off in two- and three-second chunks, below the threshold where you’d register it as being robbed.

Multiplied across five billion internet users, that’s roughly 536,000 years of human life per day being rendered unproductive by ad-tech overhead. The most expensive ad network in history isn’t Facebook or Google — it’s the collective human lifespan spent waiting for tracking pixels to resolve.

why_most_blockers_don't

You probably have an ad blocker. If you do, you’re in the 30-40% of desktop internet users who do. And if you do, your blocker is probably lying to you about how well it works.

Most ad blockers today rely on one of two strategies: URL-pattern matching (like uBlock Origin’s EasyList subscription) or DNS sinkholing (like Pi-hole). Both are good at what they do. Neither of them catches everything. And most published “ad-blocker tests” score them wrong, rewarding blockers that block requests even when those blockers still let through enormous amounts of tracker bytes via “redirect-resources” stubs that fire the page's onload event and look, to naive tests, like a successful block.

A blocker that fires 55 “blocked” events while still letting 363 KB of tracker payload onto your page is blocking requests. It is not blocking trackers.

This is the gap adbloat measures. We don’t score by request count. We score by the four metrics that actually represent what ad-tech is costing you:

1. Bandwidth blocked. What percentage of the naked-Chrome tracker payload (measured: ~363 KB across our test fixture) did your setup actually keep off your page? This is the honest signal.
2. Handshake prevention. Of the ~12 third-party hostnames that successfully complete TLS handshake with a naked browser on our fixture, how many did your network prevent from ever learning your IP address? DNS-sinkholed requests don’t count — they never happened, as far as the tracker server knows.
3. Tracker payload prevention. Of the ~7 actively-tracking scripts that reliably load their code in a naked Chrome session, how many did your defense stop from executing?

Those three dimensions are all our composite score weighs, because they’re the three that map to real-world ad-tech impact. Load time we report but don’t score — it depends on your network speed, which isn’t a property of your defense.

the_tiers_of_defense

Most users aren’t deciding between “tracker protection” and “no tracker protection.” They’re deciding what tier of protection to buy. Here are the realistic tiers, roughly ordered by effectiveness on our test.

Tier 1: default browser, nothing else (the naked tier)

F · NAKED. About 100% of ad-tech payload reaches your browser. No blocker is doing anything. Your battery, bandwidth, and behavioral data are fully exposed. Approximately 60% of internet users are in this tier, which is why the ad-tech industry continues to exist in its current form.

Tier 2: a basic browser ad blocker (Brave default, AdGuard mobile)

C / B · ~50-80%. In-browser blockers catch most of the ad impressions but miss the analytics, fingerprinters, and the session-replay SDKs. Ad-tech revenue drops, but the surveillance channel stays largely open.

Tier 3: uBlock Origin + strict settings (the enthusiast tier)

B+ / A- · ~85-92%. URL-pattern matching against EasyList + EasyPrivacy catches a serious slice of tracker traffic. Good enough that most users stop caring. Still has blind spots in cascading requests fired by partially-loaded scripts and in domains that don’t appear on the blocklist yet.

Tier 4: DNS-level network blocker (Pi-hole, AdGuard Home, NextDNS)

A / A+ · ~90-98%. Blocking at DNS means every device on the LAN benefits — phones, smart TVs, console dashboards, kids’ tablets — without any per-device configuration. DNS blocking is also invisible to fingerprinting evasion, because it operates below the browser layer. Combined with default browser hygiene, this is the sweet spot for most privacy-conscious households.

Tier 5: full network-layer privacy stack (Pi-hole + encrypted DNS prevention + firewall DoH blocking + browser-side Shields + WireGuard)

A+ · IMPENETRABLE · 97-100%. Ad-tech doesn’t just get blocked; it never gets a chance to ask the question. DNS is sinkholed before handshake. DoH/DoT bypass attempts are blocked at the firewall. Browser fingerprints are Farbled at the renderer. The only way to reach this tier is with a purpose-built network device or an extremely well-configured home setup. Under 1% of users are here. Their composite score on adbloat is indistinguishable from a test run in a sealed room.

Everyone under Tier 5 is bleeding. The question is just how much.

what_you_can_do

Measure first. You cannot fix what you cannot see. The first step is running the test yourself, on your own network, with your own current setup, and seeing where you actually fall on the tiers above. Most people are shocked by their score the first time. That shock is the motivator.

The second step is figuring out which tier you want to live in. Tier 3 (uBlock Origin with strict settings) is achievable by anyone willing to install a browser extension and restart their browser once. Takes three minutes. Cuts your ad-tech exposure by 85%+. There is no reason any human who cares about their time should be below Tier 3.

Tier 4 (DNS-level network blocker) requires a small amount of home-network wrangling but protects every device on your network, including ones you can’t install extensions on. A Raspberry Pi with Pi-hole installed takes about 45 minutes of setup and costs $60 one-time.

Tier 5 is where the returns start diminishing for the level of effort required — unless you buy a purpose-built device designed to get there out of the box. We don’t sell one of those (yet). We built adbloat to measure the problem honestly, not to sell a solution. The measurement itself is what matters.

related_reading

Passed adbloat with a high score? You blocked the bytes. The next question: did you block the surveillance requests?

Our sibling site piholekiller.com runs a 103-test gauntlet across 6 pillars — real ad networks, trackers, fingerprinters, DoH bypass attempts, and malware domains — to measure request-level blocking coverage. It’s the complementary half of the measurement. If you pass both adbloat and piholekiller, you’re in the top 1% of privacy setups on the internet. If you don’t, adbloat will tell you which payload got through, and piholekiller will tell you exactly which trackers your blocker missed.