Under Armour Tracks Every Visitor With 8+ Pixels & an F Security Grade — While 222M Records Were Breached
Complete audit of every cookie, tracking pixel, and third-party script on underarmour.com — plus the security gaps that led to two of the largest retail data breaches in history.
First: Why Should You Care About Under Armour's Tracking Setup?
What a $5.2B brand's tracking reveals about the gap between data collection and data protection
Under Armour is one of the most instructive case studies in ecommerce tracking. Not because they run the most sophisticated pixel stack — but because they demonstrate what happens when tracking investment outpaces security investment. With $5.2B in revenue (FY2025, SEC filing) and 8+ tracking pixels feeding their advertising machine, their tech stack tells a cautionary story:
Under Armour has had 222 million customer records breached across two incidents — 150 million in the 2018 MyFitnessPal breach and 72.7 million in the November 2025 Everest ransomware attack. Understanding what they track — and how they failed to protect it — helps you avoid the same mistakes.
Under Armour scores F on security headers — only 1 of 6 standard headers present. They have HSTS (good) but lack Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. For a $5.2B public company that has been breached twice, this is a red flag. See the full breakdown in our tech stack analysis.
Under Armour generated $5.2 billion in FY2025 revenue — making their tracking data enormously valuable. Every pixel, every cookie, every third-party script is a data collection point across millions of visitors. When that data gets breached, the exposure is massive. Tracking isn't just about marketing — it's about the performance and security obligations that come with it.
The Cookie Breakdown
An estimated ~38 cookies dropped on a single page load — here are the notable ones
Under Armour drops an estimated 38 cookies on a single page load. Based on the confirmed tracking vendors detected via public source analysis (Google Analytics, Meta, Pinterest, Criteo, Bing, OneTrust), we estimate the split: approximately 14 advertising cookies, 10 analytics cookies, 6 functional cookies, 4 strictly necessary cookies, and 4 personalization cookies. This is roughly 58% above the ecommerce average of ~24 cookies.
37% of all cookies are advertising trackers. Meta, Google Ads, Pinterest, Criteo, and Bing each drop their own cookies to build cross-site behavioral profiles. The longest-lived cookies include Google Analytics _ga (2 years), Criteo cto_bundle (13 months), and Pinterest _pin_unauth (1 year).
Notable Cookies (Detected via Public Source Analysis)
| Cookie Name | Domain | Type | Category | Expiry | Purpose |
|---|---|---|---|---|---|
| .underarmour.com | Analytics | 2 years | Google Analytics client ID — distinguishes unique users | ||
| .underarmour.com | Analytics | 2 years | GA4 measurement session persistence | ||
| .underarmour.com | Analytics | 24 hours | Google Analytics session grouping | ||
| .underarmour.com | Advertising | 3 months | Meta Pixel — tracks visitors for Facebook/Instagram ad targeting | ||
| .underarmour.com | Advertising | 3 months | Meta Pixel — stores click identifier from Facebook ads | ||
| .facebook.com | Advertising | 3 months | Facebook cross-site ad delivery and retargeting | ||
| .underarmour.com | Advertising | 3 months | Google Ads conversion linker — ties clicks to conversions | ||
| .underarmour.com | Advertising | 1 year | Pinterest tag — tracks unauthenticated visitors | ||
| .doubleclick.net | Advertising | 13 months | Google DoubleClick — serves and measures display ads | ||
| .underarmour.com | Advertising | 13 months | Criteo — behavioral retargeting identifier | ||
| .underarmour.com | Advertising | Session | Bing Ads UET — session-level conversion tracking | ||
| .underarmour.com | Advertising | 13 months | Bing Ads UET — persistent visitor identification | ||
| .underarmour.com | Necessary | 1 year | OneTrust — stores user consent preferences | ||
| .underarmour.com | Necessary | 1 year | OneTrust — records that user dismissed banner |
Under Armour's security header grade of F (1/6 passing) is the most notable finding in this audit. The site lacks a Content-Security-Policy header — meaning there's no browser-level restriction on which third-party domains can load scripts. For a company that has suffered two massive data breaches (150M + 72.7M records), implementing CSP would be a basic first step toward preventing unauthorized script injection.
This cookie audit is exactly the kind of analysis LeadMaxxing generates automatically for any ecommerce site — cookie inventory, category breakdown, expiry audit, and compliance gaps — delivered to your inbox in under 60 seconds.
Tracking Pixels & Tags
8+ distinct pixels covering major ad platforms and analytics
Under Armour runs at least 8 confirmed tracking pixels, covering Google, Meta, Pinterest, Criteo, and Bing. Each fires on page load, sending data about your visit to its respective platform. Here's what we detected via public source analysis and vendor documentation:
What would YOUR pixel audit look like?
Under Armour runs 8+ separate pixels because they have a dedicated data team to manage them. Most brands don't need that complexity. LeadMaxxing scans your site and shows you exactly which pixels are firing, which cookies are set, and where you have gaps — then gives you a single script that handles visitor identification, lead scoring, and platform syncing automatically.
Get this report for your brand →Third-Party Script Audit
An estimated ~25 external domains contacted on a single page load
Loading underarmour.com triggers requests to an estimated 25 unique external domains. Your browser downloads scripts, pixels, fonts, and data from dozens of different companies before the page finishes loading. Here's the estimated breakdown by category:
Network Waterfall: What Loads and When
Here's the approximate load order when your browser requests underarmour.com. Under Armour uses Fastly CDN (confirmed via DNS: CNAME to n.sni.global.fastly.net) for edge delivery, but multiple third-party scripts fire in the first 2 seconds — before most users have even scrolled:
We used two methods: (1) analyzing underarmour.com's DNS records (which reveal Fastly CDN infrastructure), and (2) cross-referencing publicly documented tracking vendors from Under Armour's cookie disclosures and privacy policy. The lack of a Content-Security-Policy header means we cannot enumerate allowed domains via CSP — which is itself a security finding. See our Tech Stack report for the full infrastructure breakdown.
Curious how many third-party domains YOUR site contacts? LeadMaxxing's free report runs a CSP + network audit on your domain and shows you exactly which vendors are loading, how they impact page speed, and which ones you can cut.
Estimated External Domains Contacted
Consent & Compliance Analysis
Enterprise consent management — but an F security grade and two massive breaches tell a different story
Under Armour uses OneTrust for cookie consent (detected via cdn.cookielaw.org), the same enterprise platform used by Nike, Adidas, and Target. But the real compliance story isn't about cookies — it's about the gap between Under Armour's consent infrastructure and their actual data protection track record:
Consent Platform
Default Behavior
Security Headers
Breach History
What Happens When You Visit underarmour.com
Here's the estimated sequence from the moment your browser hits underarmour.com:
The consent-security gap is the real story. Under Armour invests in enterprise consent management (OneTrust) to comply with GDPR/CCPA cookie regulations. But they score F on security headers — meaning there's no Content-Security-Policy to restrict which scripts can run. And they've been breached twice in 7 years, exposing 222M+ records. Consent management without matching security investment is like putting a lock on the front door while leaving the back wall open.
Not sure what fires before consent on your own site? LeadMaxxing's compliance audit maps your pre-consent vs post-consent script loading — so you know exactly what's at risk before a GDPR regulator does.
How Under Armour Compares
Moderate tracking footprint but critically weak security posture
Is Under Armour's tracking footprint unusual? We compared their estimated setup against averages from Cookiebot's 2024 ecommerce compliance report and HTTP Archive data:
| Metric | Under Armour | Avg. Ecommerce | Difference |
|---|---|---|---|
| Total Cookies | ~38 | 24 | +58% above avg |
| Tracking Pixels | 8+ | 5 | +60% above avg |
| External Domains | ~25 | 22 | +14% above avg |
| Consent Platform | Enterprise CMP | Basic / None | Enterprise tier |
| Security Headers | F (1/6) | C (3/6) | Below average |
| Data Breaches | 2 (222M+) | 0 | Critical risk |
Under Armour's tracking is moderately above the ecommerce average, but their security posture is critically weak. With $5.2B in revenue and advertising across multiple platforms, they need robust tracking for attribution. But the F security grade (verified via our header scan) combined with two major breaches tells a cautionary tale. Enterprise consent management means nothing if the underlying infrastructure can't protect the data being collected. See how this connects to their email and CRM strategy and SEO content approach.
Under Armour's tracking stack is what a $5.2B retail brand's marketing infrastructure looks like — standard enterprise-level pixels and consent. But the real lesson is the security gap: an F on headers, no CSP, and 222M+ breached records. Tracking investment without matching security investment is a liability, not an asset.
Key Findings
- → Under Armour runs 8+ confirmed tracking pixels (Meta, Google Ads, GA4, Pinterest, Criteo, DoubleClick, Bing, OneTrust) with an estimated ~38 cookies — roughly 58% above the ecommerce average of 24.
- → The site scores F on security headers (1/6 present) — only HSTS is implemented, with no Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or Permissions-Policy.
- → Under Armour has suffered 222M+ records breached across two incidents: 150M in the 2018 MyFitnessPal breach and 72.7M in the November 2025 Everest ransomware attack.
- → Despite the F security grade, Under Armour runs OneTrust enterprise consent management — creating a gap where cookie compliance is prioritized over fundamental infrastructure security.
- → The site uses Fastly CDN (confirmed via DNS CNAME to n.sni.global.fastly.net) for content delivery, but the lack of CSP means there's no browser-level restriction on third-party script execution.
What This Data Means for You
Turning Under Armour's tracking infrastructure into your competitive advantage
You don't need Under Armour's pixel count. But you do need to avoid their security mistakes. Here's the actionable breakdown by revenue stage:
Under $5M Revenue — Start Here
$5M-$50M Revenue — Fill the Gaps
The Cost Under Armour Pays
The 80/20 Alternative
LeadMaxxing Automates This Tracking Audit Playbook
Under Armour spends an estimated $400-700K/year on their tracking stack with 8+ pixels and enterprise consent. LeadMaxxing scans your site, shows you exactly which pixels are firing and where you have gaps, then gives you unified tracking with a single script — starting at $29/month.
Get your free tracking audit →5 Things You Can Implement Today
Actionable lessons from Under Armour's tracking playbook
Run an automated cookie and pixel audit
LeadMaxxing scans your site and shows you exactly which pixels are firing, which cookies are set, and where you have gaps — the same audit you just read, generated for your domain in under 60 seconds.
Fix your security headers before adding more tracking
Under Armour's F grade shows what happens when you skip security basics. LeadMaxxing's security scan checks all 6 standard headers and tells you exactly what to add — CSP, X-Frame-Options, Referrer-Policy, and more.
Map your pre-consent vs post-consent scripts
Under Armour uses OneTrust to gate tracking for EU visitors. LeadMaxxing's compliance audit maps your pre-consent vs post-consent script loading — so you know exactly what's at risk before a GDPR regulator does.
Benchmark your tracking against competitors
Under Armour runs ~58% above the cookie average. LeadMaxxing's competitive reports show you how your tracking compares to direct competitors — cookie counts, pixel coverage, consent implementation, and security posture.
Supercharge Your Leads with LeadMaxxing
Get a free LeadMaxxing account and start supercharging your leads. Start free →
Get This Analysis For Your Brand FREE
When You Create A Free LeadMaxxing Account
Create a free LeadMaxxing account and we'll generate a full competitive analysis for YOUR brand. The same intelligence you just read — comparison with competitors, actionable strategies, and AI-powered recommendations.
More Under Armour Intelligence
Tracking Audits for Similar Brands
Frequently Asked Questions
How many cookies does Under Armour's website set?
Does Under Armour use Google Tag Manager?
What consent management platform does Under Armour use?
Has Under Armour had any data breaches?
What tracking pixels does Under Armour use?
What is Under Armour's security header grade?
How does Under Armour's tracking compare to other ecommerce sites?
What CDN does Under Armour use?
Sources & References
cnbc.com
classaction.org
about.underarmour.com
developers.google.com/analytics
onetrust.com
cpomagazine.com