First-Response Privacy Signals on the Homepages of Major News Sites (2026)

A reproducible point-in-time snapshot (2026-07-21) of privacy-relevant signals in the first HTTP response from the homepages of 20 widely read news sites: number of Set-Cookie headers, presence of Permissions-Policy and Cross-Origin-Opener-Policy, and Referrer-Policy value. Derived from a single curl request per site; fully reproducible; no fabricated values. IMPORTANT: this captures only first-response, first-party headers, NOT the JavaScript-loaded third-party trackers that do most real-world tracking, so it is a narrow header snapshot and not a privacy audit. Compiled by We The Purple. Related reading on tracking and surveillance: wethepurple.org.