Depression is a nightmare that can cut you off from everyone and everything you love. For some people, getting help means talking to someone, sometimes anyone. For many of us, that means researching our symptoms online, taking a quiz, or just watching a YouTuber talk about their own depression. Depression isolates, and there’s comfort in finding out your symptoms match a known medical diagnoses, or that someone else has gone through or is going through the same thing. But when we research our depression online, advertisers are watching and marketing accordingly.

Researchers in Europe have discovered that people going online to research depression and seek help are being watched by the very websites they turn to for help. Sometimes, those websites pass what they learn about people to third parties, including advertisers. Popular websites like France’s doctissimo.fr and Britain’s e-counseling.com allow users to take quizzes to test for depression, then provide resources—including links to counselors and phone numbers to call. They’re also monitoring what users do and selling that information to advertisers.

“Our findings of this report show that many mental health websites don’t take the privacy of their visitors as seriously as they should,” Privacy International—a UK based charity that promotes privacy—said in its report. “This research also shows that some mental health websites treat the personal data of their visitors as a commodity, while failing to meet their obligations under European data protection and privacy laws.”

Privacy International looked at 136 depression-related websites operating in France, Germany, and the United Kingdom and studied the way the sites handled user data. More than 97 percent of the sites used some form of third party software like a cookie or bit of JavaScript, which collect data on visitors to the site. That, in itself, isn’t shocking. Most websites on the internet are running third party software of some kind.

But according to Privacy International, the websites aren’t handling users data in a responsible way. “We found that four out of nine depression test websites share test answers and test results with third parties, either as variables or directly,” the report said. “Answers to depression tests and results of depression tests clearly constitute personal data concerning health, as these are shared with third parties together with unique identifiers that are associated with users.”

People reaching out for help with their depression sometimes start with an online quiz to check if their symptoms are serious. Privacy International discovered many of those sites were taking the results of that information and selling it directly to advertisers. “It was extremely worrying to see that the results of questionnaires were being piped into the adtech ecosystem,” Michael Veale, Lecturer in Digital Rights and Regulation at University College London's Faculty of Laws, told me over Twitter DM. “This is indicative of the perverse incentives baked into the economics of real-time bidding: the winner is the firm that plays the dirtiest and gets away with it. And as it stands, they all do.”

Often, the mental health data advertisers are scraping is completely unsecured.

“There is effectively no consideration of issues of security in the data supply chain, meaning data on an individual's mental health is likely in the databases of hundreds, if not thousands of companies,” Veale said. “This data is not just likely to leak beyond these companies—either with or without these firms' knowledge, but using it to target individuals is manipulative and wrong.”

According to Veale, the presence of invasive trackers on even authentic–seeming health websites has shown how the internet has been turned into an insecure tracking infrastructure.