You might think that your late-night online fap sessions are your little secret, but a new study’s results says otherwise. The study’s authors analyzed over 25,000 porn sites and discovered, they wrote, “tracking is endemic on pornography websites: 93% of pages leak user data to a third-party.” Most notably Google (which tracks 74% of the sites), Oracle (24%), and Facebook (10%). And, by the way, your browser’s “incognito mode” doesn’t make a bit of difference.

The study, forthcoming from the journal New Media & Society, also found that, “Without using specialized software it’s practically impossible for users to know when a porn site is tracking them,” The Verge reported. “Privacy policies that might disclose such information were only available for 17% of the 22,484 sites scanned, and the authors note that when such policies are offered, they’re usually so specialized as to be unreadable to most users.”

What, exactly, is being tracked and how that information is being used can vary widely. “Trackers are endemic across the web, and many have banal applications,” according to The Verge. But the study’s authors believe that porn watchers should be concerned. “[E]veryone is at risk when such data is accessible without users’ consent, and thus can potentially be leveraged against them,” the study authors were quoted as saying by BoingBoing. “These risks are heightened for vulnerable populations whose porn usage might be classified as non-normative or contrary to their public life.” 

Furthermore, lead study author Elena Maris told The New York Times, “The fact that the mechanism for adult site tracking is so similar to, say, online retail should be a huge red flag…This isn’t picking out a sweater and seeing it follow you across the web. This is so much more specific and deeply personal.”

Google and Facebook both told The New York Times that their software is not collecting information that is used to build advertising profiles or other insidious uses, since neither company allows advertising interfaces of any kind with adult websites. But the collected information could still, clearly, be hacked and used as blackmail, released to the public, or worse.

And it’s not just mainstream companies tracking online masturbators: porn-specific companies are in on the game, too, most notably ExoClick (40%), JuicyAds (11%), and EroAdvertising (9%).

At the moment, there isn’t much that anyone can do about this tracking—though BoingBoing recommended “using a more secure browser like Firefox, read[ing] up on cyber security tips from the EFF, refusing to sign into a Google account and never going online without the protection of a VPN.” 

The study’s authors recommend government regulation, which could help enforce new privacy norms, and that sites allowing tracking be clearer in their Terms of Service agreements.