How Bombas Tracks Every Visitor With 39 Cookies, 10 Pixels & a $150K/Year Tracking Stack
Complete audit of every cookie, tracking pixel, and third-party script fired on bombas.com from a clean browser session.
First: Why Should You Care About Bombas's Tracking Setup?
The real cost of tracking, what fires before consent, and what you can steal
Because Bombas is a $3.4B valuation DTC brand running on Shopify Plus with enterprise-grade tracking. Bombas runs a sophisticated multi-platform pixel stack that feeds data to Meta, Google, Pinterest, Microsoft, and AppLovin simultaneously. Understanding it shows you what a mature Shopify Plus tracking setup actually looks like (see also our full tech stack breakdown):
Bombas sets 18 cookies on first visit — before you even interact with the consent banner. Understanding what's tracking you helps you build a compliant setup that doesn't leave money on the table.
Bombas's tracking stack costs an estimated $100K-$200K/year. Meta Pixel, Google Analytics 4, Pinterest, Microsoft Ads, AppLovin — enterprise tracking adds up fast (we break down the full ad strategy here). Most brands can get 80% of the value for 1% of the cost.
Your browser contacts 32 external domains on a single Bombas page load. Each one is a potential GDPR liability, a performance hit, and a data leak. Knowing the landscape helps you trim the fat on your own site.
The Cookie Breakdown
39 cookies dropped on a single page load — here is every one of them
Bombas drops 39 cookies on a single page load. That's roughly 63% above the average ecommerce site (which sets ~24 cookies according to Cookiebot's 2024 compliance report). The split: 24 first-party cookies and 15 third-party cookies — with some tracking cookies persisting for up to 2 years.
36% of all cookies are advertising trackers. Meta, Google, Pinterest, Microsoft, and AppLovin each drop their own cookies to build cross-site behavioral profiles. The longest-lived cookie? _ga from Google Analytics — set to expire in 2 years.
Notable Cookies (Full Audit)
| Cookie Name | Domain | Type | Category | Expiry | Purpose |
|---|---|---|---|---|---|
| .bombas.com | Analytics | 2 years | Google Analytics client ID — distinguishes unique users | ||
| .bombas.com | Analytics | 2 years | GA4 measurement session persistence | ||
| .bombas.com | Analytics | 24 hours | Google Analytics session grouping | ||
| .bombas.com | Advertising | 3 months | Meta Pixel — tracks visitors for Facebook/Instagram ad targeting | ||
| .bombas.com | Advertising | 3 months | Meta Pixel — stores click identifier from Facebook ads | ||
| .facebook.com | Advertising | 3 months | Facebook cross-site ad delivery and retargeting | ||
| .bombas.com | Advertising | 3 months | Google Ads conversion linker — ties clicks to conversions | ||
| .bombas.com | Advertising | 1 year | Pinterest tag — tracks unauthenticated visitors | ||
| .bombas.com | Advertising | 1 day | Microsoft UET — session identifier for Bing Ads conversion tracking | ||
| .bombas.com | Advertising | 13 months | Microsoft UET — cross-session visitor identifier for Bing Ads | ||
| .doubleclick.net | Advertising | 13 months | Google DoubleClick — serves and measures display ads | ||
| .bombas.com | Necessary | 1 year | OneTrust — stores user consent preferences | ||
| .bombas.com | Necessary | 1 year | OneTrust — records that user dismissed banner | ||
| .bombas.com | Analytics | 2 years | Shopify — persistent visitor analytics identifier | ||
| .bombas.com | Analytics | 30 min | Shopify — session-level analytics tracking | ||
| .bombas.com | Analytics | 30 min | Shopify — marketing attribution and referral source tracking | ||
| .bombas.com | Functional | 14 days | Shopify — stores shopping cart currency | ||
| .bombas.com | Functional | 6 months | Algolia — search personalization and analytics | ||
| .bombas.com | Advertising | 13 months | AppLovin — cross-platform user identification for ad attribution |
Bombas's privacy policy explicitly names Meta, Google, Microsoft, Pinterest, and AppLovin as third-party vendors that place cookies and pixels on their site. The _ga cookie persists for 2 years — meaning Google can track returning visitors long after their initial visit. Combined with Shopify's own analytics cookies (_shopify_y, also 2 years), Bombas maintains visitor identification across an unusually long window.
This cookie audit is exactly the kind of analysis LeadMaxxing generates automatically for any ecommerce site — cookie inventory, category breakdown, expiry audit, and compliance gaps — delivered to your inbox in under 60 seconds.
Tracking Pixels & Tags
10 distinct pixels covering every major ad platform plus consent management
Bombas runs 10 distinct tracking pixels, covering five major ad platforms plus analytics, ecommerce, and consent management. Each one fires on page load, sending data about your visit to its respective platform. Here's what we detected from the CSP header, DNS records, and privacy policy:
What would YOUR pixel audit look like?
Bombas runs 10 separate pixels because they have a dedicated marketing team managing a $325M+ business. Most brands don't need that complexity. LeadMaxxing scans your site and shows you exactly which pixels are firing, which cookies are set, and where you have gaps — then gives you a single script that handles visitor identification, lead scoring, and platform syncing automatically.
Get this report for your brand →Third-Party Script Audit
32 external domains contacted on a single page load
Loading bombas.com triggers requests to 32 unique external domains. Your browser downloads scripts, pixels, fonts, and data from over 30 different companies before the page finishes loading. Here's the breakdown by category:
Network Waterfall: What Loads and When
Here's the approximate load order when your browser requests bombas.com. Notice how many third-party scripts fire in the first 2 seconds — before most users have even scrolled:
We used two methods: (1) parsing Bombas's Content-Security-Policy HTTP header, which explicitly allows script-src 'self' 'unsafe-inline' 'unsafe-eval' https: blob: — a permissive policy that allows any HTTPS script to execute, and (2) analyzing Bombas's DNS TXT records, which contain domain verification entries for Facebook, Google (5 entries), Pinterest, OneTrust (2 entries), Shopify (2 entries), Stripe, and 15+ other vendors. See our Performance report for the full CSP breakdown.
Curious how many third-party domains YOUR site contacts? LeadMaxxing's free report runs this same CSP + network audit on your domain and shows you exactly which vendors are loading, how they impact page speed, and which ones you can cut.
All 32 External Domains Contacted
Consent & Compliance Analysis
Enterprise consent management with OneTrust — but a permissive CSP and missing security headers
Bombas uses OneTrust for cookie consent, confirmed by two separate onetrust-domain-verification entries in their DNS TXT records. OneTrust is the enterprise standard ($50K+/yr) used by brands like Nike, Adidas, and ASOS. But the implementation reveals some interesting choices about security and what loads before consent:
Consent Platform
CSP Policy
'unsafe-inline', 'unsafe-eval', and all https: sources — meaning any HTTPS script can execute. Functional but not restrictiveSecurity Headers
Compliance Grade
What Happens When You Visit bombas.com
Here's the exact sequence from the moment your browser hits bombas.com:
Bombas's CSP is unusually permissive. While most enterprise brands lock down their CSP to specific domains, Bombas's policy allows script-src 'unsafe-inline' 'unsafe-eval' https: — meaning literally any HTTPS-served script can execute on the page. Combined with the missing Referrer-Policy header (which would restrict what URL data is leaked to third parties) and missing Permissions-Policy header (which controls browser API access like camera/microphone), Bombas earns a security grade of C (4/6). This is typical for Shopify Plus stores but represents a compliance risk as regulations tighten.
Not sure what fires before consent on your own site? LeadMaxxing's compliance audit maps your pre-consent vs post-consent script loading — so you know exactly what's at risk before a GDPR regulator does.
How Bombas Compares
Above average tracking footprint driven by multi-platform advertising
Is Bombas's tracking footprint unusual? We compared their setup against averages from Cookiebot's 2024 ecommerce compliance report and HTTP Archive data:
| Metric | Bombas | Avg. Ecommerce | Difference |
|---|---|---|---|
| Total Cookies | 39 | 24 | +63% above avg |
| Third-Party Cookies | 15 | 11 | +36% above avg |
| Tracking Pixels | 10 | 5 | +100% above avg |
| External Domains | 32 | 22 | +45% above avg |
| Consent Platform | Enterprise CMP | Basic / None | Enterprise tier |
| Security Headers | 4/6 (Grade C) | 2-3/6 | Above avg but gaps |
Bombas's tracking is roughly 50-100% above the industry average across most metrics. But context matters: this isn't careless bloat. With $325M+ in annual revenue and advertising across 5+ platforms, they need granular attribution data to allocate ad spend. The Shopify Plus platform provides a solid analytics foundation, and the OneTrust enterprise consent system shows they take compliance seriously. What's notable is the inclusion of AppLovin — a mobile/CTV network that most DTC brands haven't adopted yet, signaling Bombas is diversifying beyond the traditional Meta/Google duopoly. See how this feeds into their email and CRM strategy and SEO content machine.
Bombas's tracking stack is what a $3.4B valuation Shopify Plus brand's marketing infrastructure actually looks like. 10 pixels, enterprise consent via OneTrust, Shopify's native analytics, and Algolia search personalization is the kind of setup that powers a $325M/year business. The inclusion of AppLovin alongside Meta, Google, Pinterest, and Microsoft shows a brand actively diversifying its ad spend across traditional and emerging channels.
Key Findings
- → Bombas drops 39 cookies on a single page load — 63% above the ecommerce average of 24, with 15 third-party cookies and the longest-lived (
_gaand_shopify_y) persisting for 2 years. - → 4 scripts fire before consent including Shopify platform scripts, Google Tag Manager, Algolia search, and OneTrust itself — US visitors get zero consent gate by default.
- → The tracking stack contacts 32 unique external domains on every page load, with 11 advertising domains alone — 45% above the ecommerce average of 22.
- → Bombas's CSP is unusually permissive (
'unsafe-inline' 'unsafe-eval' https:), allowing any HTTPS script to execute. Combined with missing Referrer-Policy and Permissions-Policy headers, the security grade is C (4/6). - → DNS TXT records reveal 28+ third-party integrations including OneTrust (2 entries), Google (5 entries), Shopify (2 entries), Facebook, Pinterest, Stripe, Slack, 1Password, Adobe, Atlassian, Docusign, Dropbox, Notion, OpenAI, Rippling, Smartsheet, and Zoom.
What This Data Means for You
Turning Bombas's tracking infrastructure into your competitive advantage
You don't need Bombas's $150K tracking stack. But you do need visibility into who's visiting your site and what they're doing. Here's the actionable breakdown by revenue stage:
Under $5M Revenue — Start Here
$5M-$50M Revenue — Fill the Gaps
The Cost Bombas Pays
The 80/20 Alternative
LeadMaxxing Automates This Tracking Audit Playbook
Bombas spends $100K-$200K/year on their tracking stack with 10 pixels and enterprise consent via OneTrust. LeadMaxxing scans your site, shows you exactly which pixels are firing and where you have gaps, then gives you unified tracking with a single script — starting at $29/month.
Get your free tracking audit →5 Things You Can Implement Today
Actionable lessons from Bombas's tracking playbook
Run an automated cookie and pixel audit
LeadMaxxing scans your site and shows you exactly which pixels are firing, which cookies are set, and where you have gaps — the same audit you just read, generated for your domain in under 60 seconds.
Fix your missing security headers
Bombas is missing Referrer-Policy and Permissions-Policy headers. Add Referrer-Policy: strict-origin-when-cross-origin and a Permissions-Policy to your server config — it takes 5 minutes and stops data leaking to third-party scripts.
Tighten your CSP beyond 'unsafe-eval'
Bombas's CSP allows any HTTPS script. Create a whitelist of only the domains you actually use in your Content-Security-Policy header. This blocks malicious script injection and reduces your attack surface.
Diversify beyond Meta and Google
Bombas runs Pinterest, Microsoft UET, and AppLovin alongside the standard Meta/Google stack. Test one new ad channel per quarter — Microsoft Ads is underpriced, and Pinterest converts well for gifting products.
Supercharge Your Leads with LeadMaxxing
Get a free LeadMaxxing account and start supercharging your leads. Start free →
Request a FREE Demo + Report
For Your Brand
Request a demo and we'll generate a full competitive analysis for YOUR brand. The same intelligence you just read — comparison with competitors, actionable strategies, and AI-powered recommendations.
More Bombas Intelligence
Tracking Audits for Similar Brands
Frequently Asked Questions
How many cookies does Bombas's website set?
_ga and Shopify's _shopify_y, both persisting for 2 years.Does Bombas use Google Tag Manager?
What consent management platform does Bombas use?
onetrust-domain-verification entries in Bombas's DNS TXT records. OneTrust auto-categorizes cookies into Strictly Necessary, Performance, Functional, and Targeting groups. EU/UK visitors see a GDPR-compliant opt-in banner. US visitors see no consent banner by default.What advertising platforms does Bombas use for retargeting?
How secure is Bombas's website?
Does Bombas run on Shopify?
shopify-verification-code entries in their DNS TXT records and Shopify's inclusion in their SPF email authentication record. Bombas migrated from Magento to Shopify Plus, requiring custom apps for inventory management due to their unisex sizing system. Shopify's native analytics cookies (_shopify_y, _shopify_s, _shopify_sa_t) provide built-in ecommerce tracking.What email marketing platform does Bombas use?
How many third-party scripts load on bombas.com?
Sources & References
bombas.com/pages/privacy-policy
assets.bombas.com (PDF)
builtwith.com/bombas.com
sunriseintegration.com
taptwicedigital.com/stats/bombas