A study shows that visitors to porn sites have a “fundamentally misleading sense of privacy” and that they are tracked by third party software made by tech companies like Google and Facebook.

The paper explores tracking and privacy risks on pornography websites. The researchers analyzed 22,484 pornography websites and found that 93% of those websites leak user data to a third party. Tracking on these sites is highly concentrated by a handful of major companies, which the study identifies as Google and Facebook. Content analysis of the sample’s domains indicated 44.97% of them expose or suggest a specific gender/sexual identity or interest likely to be linked to the user.

The study found that the majority of the porn websites leak data to third parties, including when accessed via a browser’s “incognito” mode.

Incognito mode only ensures that your browsing history is not stored on your computer. The sites you visit, as well as any third-party trackers, may observe and record your online actions. These third-parties might also use what they have decided about these interests for marketing or building a consumer pro€file.

According to the study, Google tracks 74% of sites, Oracle 24%, Facebook 10%, Cloudflare and Yadro 7%, and New Relicand Lotame 6%. Porn-specific trackers in the top ten are exoClick (40%), JuicyAds (11%), and EroAdvertising (9%).

“We don’t allow Google Ads on websites with adult content and we prohibit personalized advertising and advertising profiles based on a user’s sexual interests or related activities online,” a Google spokeswoman told The New York Times, which was first to cover the findings of the study. “Additionally, tags for our ad services are never allowed to transmit personally identifiable information.”

Facebook, whose trackers appeared on 10 percent of the sites the researchers looked at, made a similar denial to the NYT, though the code it release to track users can be embedded in any site without Facebook’s permission.

“The fact that the mechanism for adult site tracking is so similar to, say, online retail should be a huge red flag,” said Elena Maris, the study’s lead author and a researchers at Microsoft. “This isn’t picking out a sweater and seeing it follow you across the web. This is so much more specific and deeply personal.”

The study also found that without using specialized software it’s practically impossible for users to know when a porn site is tracking them. Privacy policies that might disclose such information were only available for 17 percent of the 22,484 sites scanned, and the authors note that those policies are written in such a way that someone should be a lawyer in order to understand them.