Internet users may have had their information used for tracking without their consent, according to a new study.
The goal of the study was to spot sites that pulled email and password before users could submit a consent form.
The study, carried out by researchers from Radboud University, University of Lausanne and KU Leuven, looked at the top 100,000 websites on the internet.
All in all there were 1,844 'leaky sites' when visited from the EU and 2,950 when visited from the US.
This means if you type something out in a form on some websites and then erase it before hitting enter, someone may still be able to see what you typed.
Some of the sites caught out in the study were huge, with Meta and TikTok reportedly logging user information from web forms without user consent.
In some cases, these security compromises were apparently unintentional, with incidental password collection on 52 websites being resolved thanks to the study's findings.
The study said: "These issues were fixed thanks to our disclosures."
Elsewhere in the study, the researchers added: "Some websites told us that they were not aware of this data collection and rectified the issue upon our disclosures."
The study involved dozens of screen captures that showed information pulling through to websites before consent forms had even been finished.
In a Q&A section, the study states: "We believe it is strongly against users’ expectations to collect personal data from web forms for tracking purposes prior to submitting a form.
"We wanted to measure this behavior to assess its prevalence."
The data collected by these sites could be used by the website themselves or by third party companies who may want to target you for marketing services.
The research findings are to be featured at The 31st USENIX Security Symposium, a cybersecurity and privacy gathering in Boston, Massachusetts.
Don't miss the latest news from around Scotland and beyond - Sign up to our daily newsletter here.
