93% of porn sites passed visitor data to other companies, and the mental health apps people turn to were not much better

What a porn site sends out

In March 2018 three researchers, Maris, Libert and Henrichsen, pointed an automated tool at 22,484 porn sites. They took every site in the top million websites with "porn" in its address, title or description, loaded its home page from one computer in the US, and logged every request the page sent to another domain¹.

93% of the sites sent visitor data to at least one other company, and those that did sent it to seven other domains on average². 79% set a third-party cookie². Google was on 74% of the sites. ExoClick, a porn-specific tracker, was on 40%, Oracle on 24% and Facebook on 10%². Across all of them the researchers counted 230 different tracking companies and services¹.

Not every request is tracking. Some only fetch code or fonts¹. The authors also call their counts a lower bound, since some sites may have blocked their tool as a bot². Still, a visit to a porn site in 2018 was rarely a visit to one company. It was a visit to the site and, on average, seven other domains that the visitor never chose².

The address says what you watched

What a tracker receives is the address of the page. In a random sample of 378 site addresses, 44.97% revealed or strongly hinted at a sexual orientation, gender identity or topic¹. The company on the other end does not need to see the video. The address alone can hint at what kind it is.

The sites rarely told visitors any of this. The researchers could pull out a privacy policy for 3,856 sites, and those policies named 11% of the third parties seen tracking visitors on their pages¹. Someone who read the policy to find out who was watching would find about one name in nine.

Private browsing does not hide it

Many people assume a private window takes care of all this. In a 2018 study, Wu and colleagues showed each of 460 US adults one of 13 explanations of private mode, 12 copied from real browsers and one vague one they wrote themselves, then asked what would happen in private mode in 20 situations³. 37% wrongly believed their employer could no longer track what they browsed on the work network³. 40.2% thought websites could not estimate where they were, 22.6% that the government could not track them and 22% that their internet provider could not³.

The top reason the authors list for using private mode at all was to hide browsing history, especially visits to adult websites³. That is the gap. Private mode does not change what a page sends over the network³, and a porn site that leaked data in 2018 sent it to seven other domains on average². Clearing cookies when the window closes only makes tracking harder, not impossible³. The sample was paid online workers on Amazon Mechanical Turk, and the browser explanations date from 2017³. Those figures are beliefs held after reading an explanation, so people who never read one may believe more of it³.

Google has had to say so in writing. In December 2023 it agreed to settle a US class action over tracking in Incognito mode⁴. It agreed to rewrite its notice to say Incognito does not change how websites and the services they use, Google included, collect data, and to delete billions of records⁴. A settlement is an agreement, not a court finding that Google did anything wrong. Final approval was still pending in September 2026⁵.

What a leak looks like

Data passed around this freely can also be stolen. In December 2025 a hacking group said it held about 200 million records of what Pornhub Premium members had searched for and watched⁶. Reporters saw a small sample with email addresses, video titles and times. Pornhub said its own systems were not breached, and that the data came from Mixpanel, an analytics company it had not used since 2021⁶. Mixpanel said it found no sign the data was stolen from it⁶.

The full scale is not confirmed, so the 200 million is the group's own claim⁶. The sample is enough to make the point, though. A list of video titles next to an email address is about the most personal record a porn user can leave behind.

The apps people turn to for help

Someone who wants to stop often reaches for an app next. No porn recovery or accountability app was in either of the reviews below⁷. The closest evidence comes from apps for depression and for quitting smoking.

In 2018 Huckvale, Torous and Larsen took the top 36 free apps for depression and quitting smoking on Android and iOS in the US and Australia. They captured the traffic each one sent out on test phones between January and June⁷. 33 of the 36 sent data to another company, and 29 sent it to Google or Facebook⁷. Only 25 had a privacy policy at all⁷.

The policies did worse than the code. 17 apps shared data without saying so properly. 9 had no policy, 5 left the sharing out of theirs, and 3 said it would not happen⁷. Of 28 apps sending data to Google, 12 named Google in their policy. Of 12 sending to Facebook, 6 named Facebook⁷. Two apps put health details the user had typed in, a health diary and substance use, into the data sent to analytics companies⁷.

The test found no names or email addresses going to third parties⁷. Still, 9 of the 33 sharing apps sent a fixed device ID or a username, and 26 sent weaker identifiers such as an advertising ID, which can follow a user across apps⁷. The test saw only what an app sent straight out, so it may have missed some sharing⁷. It is a snapshot from 2018 and says nothing about any one of those apps today. The pattern matches the porn sites all the same. Most of the apps sent data to the same large companies, and the written policy told the user less than the traffic did.

Mozilla came at it from the policy side. Its reviewers read the privacy policies and checked the security of 32 mental health and prayer apps in 2022, and gave 28 of them a privacy warning label⁸. Mozilla first said 29, then removed the label from one app, Glorify, after it explained its practices⁸. Mozilla's 2023 release still gives the 2022 count as 29⁹. In its 2023 review of 32 mental health apps, Mozilla gave 19 labels⁹. Mozilla said 40% had got worse and nearly a third had improved⁹. Both were Mozilla's own consumer guides, not peer-reviewed studies⁸⁹.

Health answers sent to advertisers

The app test shows what an app can send. The BetterHelp case shows it reaching advertisers. In 2023 the US Federal Trade Commission said BetterHelp, an online therapy service, had given email addresses, IP addresses and health questionnaire answers to Facebook, Snapchat, Criteo and Pinterest for advertising, after promising to keep them private¹⁰. BetterHelp agreed to pay $7.8 million, and in May 2024 about 800,000 people were told they were eligible for a refund¹¹.

Like the Google case, this ended in a settlement. The complaint is the FTC's account, not a court finding¹⁰. Facebook turns up in three parts of this story. It was on 10% of porn sites in 2018², it received data from 12 of the 36 health apps⁷, and it was on the FTC's list for BetterHelp¹⁰.

When therapy notes get out

Sharing is one risk. Theft is the other. In 2018 a hacker took the records of an estimated 33,000 patients of the Vastaamo psychotherapy centre in Finland¹². Prosecutors said he first demanded about 370,000 euros from the company, and when it refused, in 2020, he began publishing patient records and demanding 200 or 500 euros from patients¹². About 24,000 people filed police complaints, and Vastaamo went bankrupt in 2021¹².

A Finnish court gave the hacker, Aleksanteri Kivimäki, a prison sentence of 6 years and 3 months in April 2024¹³. In February 2026 the appeal court raised it to 6 years and 11 months, and Yle reported that the ruling could still go to the Supreme Court¹⁴. Vastaamo was a criminal break-in, not the routine data sharing the other studies measured. It is here because it shows what is at stake. Notes written in therapy, once out, were used to extort the patients they described.

How they found it

• Maris, Libert and Henrichsen loaded each porn site home page with an automated tool and recorded every request it sent to another domain. They found 230 different tracking companies and services.
• In the porn site study, a random sample of 378 site addresses was checked for what the address itself revealed, and privacy policies were pulled out for 3,856 sites.
• Wu and colleagues showed each of 460 US adults on Amazon Mechanical Turk one of 13 explanations of private mode, 12 copied from real browsers, then asked what would happen in private mode in 20 situations.
• Huckvale, Torous and Larsen captured the traffic from each of 36 depression and quit-smoking apps on test phones, January to June 2018.
• Mozilla reviewed the privacy policies and app security of 32 mental health and prayer apps in 2022 and 32 mental health apps in 2023.
• The Google, Pornhub, BetterHelp and Vastaamo details come from court filings, FTC press releases and news reports.

What it cannot tell you

• The porn site scan dates from 2018 and covered home pages only. Sites and trackers have changed since. Sending data to another domain is not always tracking, as some requests fetch code or fonts. The authors call their counts a lower bound, since some sites may have blocked the tool as a bot.
• The private browsing figures are what people believed after reading an explanation of private mode, so beliefs without one may be worse. The sample was paid online workers in the US, and the explanations date from 2017.
• No porn recovery or accountability app was in either app review. Apps change, and a snapshot from 2018 says nothing about any one app today.
• The 2018 app test saw only what an app sent straight out, so it may miss some sharing. It found no names or email addresses going to third parties.
• Google and BetterHelp settled. A complaint is one side's account, not a court finding. The full scale of the Pornhub data claim is not confirmed.
• Vastaamo was a criminal break-in, not routine data sharing. It shows what is at stake when therapy notes leak.

In P-Minus

The P-Minus app shows no ads and reads no advertising ID. Its analytics carry an account id and not your email, and no staff screen shows your answers against your account.

Sources

1. Maris E, Libert T, Henrichsen JR. Tracking sex: the implications of widespread sexual data leakage and tracking on porn websites. New Media Soc. 2020;22(11):2018-38.
2. Maris E, Libert T, Henrichsen J. Tracking sex: the implications of widespread sexual data leakage and tracking on porn websites [preprint]. arXiv:1907.06520. 2019.
3. Wu Y, Gupta P, Wei M, Acar Y, Fahl S, Ur B. Your secrets are safe: how browsers' explanations impact misconceptions about private browsing mode. In: Proceedings of the 2018 World Wide Web Conference. 2018. p. 217-26.
4. Brown v. Google LLC, No. 4:20-cv-03664-YGR-SVK (N.D. Cal.). Plaintiffs' unopposed motion for final approval of class action settlement, Dkt. 1153-1. 20 March 2025.
5. Brown v. Google LLC, No. 4:20-cv-03664-YGR-SVK (N.D. Cal.). Stipulation re preservation orders, Dkt. 1188. 24 September 2026.
6. Abrams L. PornHub extorted after hackers steal Premium member activity data. BleepingComputer. 15 December 2025.
7. Huckvale K, Torous J, Larsen ME. Assessment of the data sharing and privacy practices of smartphone apps for depression and smoking cessation. JAMA Netw Open. 2019;2(4):e192542.
8. Mozilla Foundation. Top mental health and prayer apps fail spectacularly at privacy, security. Press release, 2 May 2022.
9. Mozilla Foundation. Shady mental health apps inch toward privacy and security improvements, but many still siphon personal data. Press release, 2 May 2023.
10. US Federal Trade Commission. FTC to ban BetterHelp from revealing consumers' data, including sensitive mental health information, to Facebook and others for targeted advertising. Press release, 2 March 2023.
11. US Federal Trade Commission. BetterHelp customers will begin receiving notices about refunds related to a 2023 privacy settlement with FTC. Press release, 6 May 2024.
12. Associated Press. Finnish hacker gets prison for accessing thousands of psychotherapy records and demanding ransoms. 30 April 2024, via NY1.
13. Yle News. Court hands Kivimäki 6-year prison sentence in historic hacking case. 30 April 2024.
14. Yle News. Report on the Court of Appeal ruling raising Aleksanteri Kivimäki's sentence to 6 years and 11 months. 26 February 2026.

Sources checked October 2026.