How Gymshark Tracks Every Visitor With 47 Cookies, 12 Pixels & a $300K/Year Tracking Stack

Because most brands are flying blind with their tracking. Gymshark runs one of the most sophisticated pixel stacks in DTC ecommerce. Understanding it shows you what "good" actually looks like (see also our full tech stack breakdown):

Gymshark drops 47 cookies on a single page load. That's roughly 2x the average ecommerce site (which sets ~24 cookies according to Cookiebot's 2024 compliance report). The split: 28 first-party cookies and 19 third-party cookies — with some tracking cookies persisting for up to 2 years.

36% of all cookies are advertising trackers. Meta, Google, TikTok, Pinterest, and Snapchat each drop their own cookies to build cross-site behavioral profiles. The longest-lived cookie? _ga from Google Analytics — set to expire in 2 years.

Notable Cookies (Full Audit)

This cookie audit is exactly the kind of analysis LeadMaxxing generates automatically for any ecommerce site — cookie inventory, category breakdown, expiry audit, and compliance gaps — delivered to your inbox in under 60 seconds.

Gymshark runs 12 distinct tracking pixels, covering every major ad platform plus session recording and personalization. Each one fires on page load, sending data about your visit to its respective platform. Here's what we detected in the page source and network requests:

Loading gymshark.com triggers requests to 38 unique external domains. Your browser downloads scripts, pixels, fonts, and data from nearly 40 different companies before the page finishes loading. Here's the breakdown by category:

Network Waterfall: What Loads and When

Here's the approximate load order when your browser requests gymshark.com. Notice how many third-party scripts fire in the first 2 seconds — before most users have even scrolled:

Curious how many third-party domains YOUR site contacts? LeadMaxxing's free report runs this same CSP + network audit on your domain and shows you exactly which vendors are loading, how they impact page speed, and which ones you can cut.

All 38 External Domains Contacted

Gymshark uses OneTrust for cookie consent, the enterprise standard ($50K+/yr) used by brands like Nike, Adidas, and ASOS. But the implementation reveals some interesting choices about what loads before users make a consent choice:

What Happens When You Visit gymshark.com

Here's the exact sequence from the moment your browser hits gymshark.com:

Not sure what fires before consent on your own site? LeadMaxxing's compliance audit maps your pre-consent vs post-consent script loading — so you know exactly what's at risk before a GDPR regulator does.

Is Gymshark's tracking footprint unusual? We compared their setup against averages from Cookiebot's 2024 ecommerce compliance report and HTTP Archive data:

Gymshark's tracking is roughly 2x the industry average across every metric. But context matters: this isn't careless bloat. With £607M in revenue and advertising across 6 platforms, they need granular attribution data to allocate millions in ad spend. The mParticle CDP shows real sophistication — server-side event routing means they're not just spamming pixels, they're building a unified customer data graph. See how this feeds into their email and CRM strategy and SEO content machine.

You don't need Gymshark's $300K tracking stack. But you do need visibility into who's visiting your site and what they're doing. Here's the actionable breakdown by revenue stage:

Frequently Asked Questions

How many cookies does Gymshark's website set?

Gymshark drops 47 cookies on a single page load — roughly 2x the average ecommerce site (which sets ~24 cookies according to Cookiebot's 2024 compliance report). The split: 28 first-party cookies and 19 third-party cookies. By category: 17 advertising (36%), 11 analytics (23%), 9 functional (19%), 6 personalization (13%), and 4 strictly necessary (9%). The longest-lived cookie is Nosto's ki_u at 5 years.

Does Gymshark use Google Tag Manager?

Yes, Gymshark uses Google Tag Manager (GTM) as their primary tag orchestration system. GTM loads at approximately 120ms after page load and evaluates consent state — sending consent_default: denied for EU visitors and granted for everyone else. GTM manages the deployment of GA4, Google Ads conversion tracking, and coordinates with mParticle as the central customer data platform for server-side event routing.

What consent management platform does Gymshark use?

Gymshark uses OneTrust, the enterprise-tier consent management platform ($50K+/yr) also used by Nike, Adidas, and ASOS. OneTrust auto-categorizes cookies into Strictly Necessary, Performance, Functional, and Targeting groups. EU/UK visitors see a GDPR-compliant opt-in banner with Accept All, Reject All, and Cookie Settings options. US visitors see no consent banner — all tracking fires immediately by default.

Does Gymshark fire tracking pixels before cookie consent?

Yes, 7 scripts fire before consent: OneTrust (consent itself), mParticle CDP, Google Tag Manager, GA4 (in consent mode with anonymized pings), Nosto personalization, Hotjar session recording, and the Contentful CDN. For EU visitors, advertising pixels (Meta, TikTok, Pinterest, Snapchat, LinkedIn, Criteo) are gated until consent is given. For US visitors, there is no consent gate — everything fires from the first millisecond.

What retargeting pixels does Gymshark use?

Gymshark runs 7 retargeting pixels: Meta Pixel (Facebook/Instagram), Google Ads Conversion tag, TikTok Pixel, Pinterest Tag, Snapchat Pixel, LinkedIn Insight Tag, and Criteo. Each fires PageView events on every page load and tracks ecommerce events (AddToCart, Purchase, ViewContent). The Criteo pixel enables display retargeting across thousands of third-party publisher sites.

How does Gymshark's tracking compare to GDPR requirements?

Gymshark earns a B+ compliance grade. Their OneTrust implementation properly gates advertising cookies for EU/UK visitors with a GDPR-compliant banner. However, 7 scripts (including mParticle CDP, Nosto personalization, and Hotjar session recording) fire pre-consent. For US visitors, all tracking is active by default with no consent prompt. The geolocation-based approach is common among DTC brands but means American visitors are fully tracked from the first millisecond.

What session recording tools does Gymshark use?

Gymshark uses Hotjar for session recording. Hotjar records user sessions (mouse movements, clicks, scrolling), generates heatmaps, and runs on-site surveys. The _hjSessionUser cookie persists for 1 year, while _hjSession expires after 30 minutes of inactivity. Hotjar loads pre-consent at approximately 200ms and is used for CRO — identifying friction in checkout and product detail page flows.

How many third-party scripts load on gymshark.com?

Loading gymshark.com triggers requests to 38 unique external domains. By category: 14 advertising domains (Meta, Google, TikTok, Pinterest, Snapchat, LinkedIn, Criteo), 8 analytics domains (GTM, GA4, mParticle, Bing, Clarity), 6 CDN/performance domains (Contentful, Shopify, Google Fonts), 5 personalization domains (Nosto, Bazaarvoice, Reviews.io), 3 consent domains (OneTrust), and 2 session recording domains (Hotjar). This is 73% above the ecommerce average of 22 external domains.