Google and Facebook may be tracking users’ online porn habits — even when users access pornographic websites in incognito or private browsing modes.

More than 20,000 porn websites were analyzed for a recent study, findings from which were published on Monday (via CNET). The investigation — conducted by researchers from Microsoft, Carnegie Mellon University, and the University of Pennsylvania — found that 93 percent of the sites analyzed leak user data to a third party.

Editor's Pick 10 best adult coloring book apps for Android! Coloring books have been around for ages. However, the idea of adults doing them to relieve stress is a fairly new concept. These days, it's more or less apropos to kids and adults alike to …

The research team said this data can be used to help build “detailed profiles” of user habits and sexual interests, which can be shared and sold for targeted advertising. The user is often unaware the data collection is taking place.

Data collection occurs through a variety of services: those belonging to Google, like Google APIs and analytics, were found on around 50 percent of the websites analyzed. The use of Google’s code and analytics tools — or Facebook developer tools — doesn’t inherently mean these companies use information gathered through these means, but it does suggest they have access to a lot of it.

“Google refuses to host porn, but has no limits on observing the porn consumption of users, often without their knowledge,” the research team wrote in the paper.

The research also suggested Google and its subsidiaries ran tracking services on around 74 percent of the pornography sites examined, and Facebook on around 10 percent.

Why is Incognito mode ineffective?

Incognito and private modes typically only prevent your browser from saving your search activities. However, ISPs, websites, and tracking services still receive this information. Furthermore, Incognito mode doesn’t necessarily increase security — if a website doesn’t support encryption (only around 17 percent of the examined porn sites did), then your login or password information is at the same risk whether you browse privately or not.

Editor's Pick Popular beauty apps on Play Store showed porn ads, stole photos The Google Play Store isn't completely free of nefarious apps, and a new discovery by security firm Trend Micro (h/t: Ars Technica) has shown just how dangerous it can be. Trend Micro found that a group …

Therefore, users are likely to be tracked whenever they visit one of the thousands of websites investigated, and due to poor security practices, run a significant risk of having their private data shared or misused. Critically, a person’s sexual predilections, as oppose to their purchasing habits or something else which may be tracked, can be particularly sensitive.

“The user data often suggests or reveals gender/sexual identities or interests represented in the porn site URL accessed, and thus poses an additional risk if tracked and assumptions about users’ sexual identities/interests are linked to personal identifying information,” wrote the researchers.

All told, it’s a troubling set of findings. Hopefully, the research spurs authorities to introduce tighter controls around online tracking activities.

Read next: Best porn apps for Android