Your activity on porn sites is being tracked by Google and Facebook

Porn sites are notorious for using the seediest and most underhanded forms of advertising. Pop-ups, misleading links, giant overlays that cover your entire screen — if it's annoying and potentially malicious, you'll probably run into it during those intimate moments alone. Usually, those are the types of ads you find on porn sites because more reputable companies don't want to be associated with that type of explicit content. But, as it turns out, a recent study found companies like Google and Facebook are more than happy to operate behind the scenes, acting as voyeurs to track your activity on porn sites and use it to build a profile of your interests and behaviors.

Researchers from the University of Pennsylvania, Carnegie Mellon and Microsoft used a tool called webXray to scan 22,484 adult-themed websites and see what kind of data they collect and where they send it to. According to the study, published in the peer-reviewed New Media and Society journal, 93 percent of those sites send out user data to third parties. On average, the sites relay user information to seven different domains, the vast majority of which are collected by tracking cookies on the site. Trackers from Google or one of its subsidiaries like advertising service DoubleClick were discovered on 74 percent of all the sites scanned. Facebook, which specifically forbids pornographic content and nudity on the platforms that it operates, was found to be tracking activity on 10 percent of all adult sites scanned.

While it may not be surprising to know there are tracking cookies and other tools on even explicit sites (if you're online, best to just assume your activity is being watched one way or another), it is considerably different than having your clicks on social media or a online retailer tracked. For better or worse, that information is useful for companies to serve up personalized advertisements and fine-tune an experience for each user. That's a practice that often makes people uncomfortable, like when ads on Facebook or Instagram are so specific to a person's interests that they start believing those apps are listening to conversations using their phone's microphone. With porn activity, there's less to be gleaned in terms of what companies can sell to a person. Instead, the information collected serves to flesh out the profile of a person in a way that might be uncomfortably revealing.

According to the researchers, tracking on porn sites can often provide suggestions regarding a person's gender identity, sexual preferences, and sexual identity. That is the type of data most people would likely consider to be sensitive information. It's also the type of information that can't really be processed in the same way that other internet browsing activity can. A person who reads about cats and likes photos of cats and follows cat accounts on social media is probably fine seeing cat-related ads. What we search for on porn sites are often things that we consider to be private and sometimes experimental. Handling that information requires sensitivity and understanding of a person's experience — and trying to boil it down to data points is unfair.

As the researchers state in their paper, "Collecting and tracking data are often framed as ways to ‘know’ quantitatively unknowable and often morally charged constructions like who or what is ‘average,’ ‘normal,’ or ‘healthy.’" Algorithms aren't built with the kind of subtlety to properly process and contextualize this data, they just aim to put people in particular boxes so they know what kind of ads to show them. The researchers warn that this type of tracking violates the sexual privacy of users and particularly puts people in traditionally marginalized and vulnerable communities at risk. That includes women, people of color, and members of the LGBTQ community who have often had their sexual interests and identities labeled as being "abnormal."

Most people are unaware that this type of tracking is taking place on adult websites, but even if they wanted to know, they would have a hard time finding any indication of it. According to the study, just 17 percent of the thousands of sites scanned had an easily accessible privacy policy. Some sites had no policy at all, others had ones that were effectively hidden. Even the sites that do have the disclosure available often use complicated language that requires college-level reading comprehension to process and understand it. The researchers noted that policies also don't list what companies are tracking user activity on the site, making it impossible for users to truly consent to having their data shared.

Even more troubling: just 17 percent of the sites scanned by researchers are encrypted. That means that all of the user data being tracked and sent to third parties could potentially be exposed to malicious actors. It wouldn't necessarily be as easy for a hacker to pair user behavior on these sites to a specific user the way that companies with trackers all over the web can do, but it does mean that things like usernames and passwords could be intercepted by hackers.

Being tracked online anywhere is unpleasant and invasive, but we've grown to mostly accept that as a fact of being online, especially when using free services. Having activity tracked, logged, and categorized while on porn sites feels like a step too far. While it's not medical information or other personal data, activity on these sites is often intensely personal and private and not information that people want to be directly associated with or defined by. Porn sites should take additional steps to seek out user consent or at the very least take better steps to inform users that they are being watched by third-party tracking services.

In the mean time, you might want to consider using a virtual private network when visiting adult sites. (Incognito mode and other "private" browsing solutions really only delete your local search history and browsing activity. Sites can still track your activity and likely have enough other information to identify you.) It provides a secure, encrypted connection and ensures that none of your information is collected by the site, any trackers, or your internet service provider.