Tracking tools found on EU government and health websites

Online tools which track user behaviour for advertisers have been found on a swathe of EU public health websites, including NHS and Gov.uk pages.

These trackers could compromise sensitive data about people, according to researchers at data protection compliance service Cookiebot.

The researchers also discovered trackers on 89% of EU government websites.

Most of the trackers were developed by Google.

They were designed to "associate web activity with the identities of real people" Cookiebot said.

Of all the 28 EU member states, only Spanish, German and Dutch government websites were tracker-free.

"We of course expect everyone to fully comply with EU data protection rules and it is the responsibility of EU data protection authorities to ensure compliance," a spokeswoman for the European Commission said.

But the public health website trackers presented additional risks, said Cookiebot.

"Over 100 advertising technology companies are systemically and invisibly tracking EU citizens when they visit their governments online, or when they access public health service resources about sensitive issues, such as pregnancy, sexual health, cancer or mental illness," it explained.

Some of the search queries that could bring users to these public health pages included "I have HIV, now what?" and "I want to terminate my pregnancy".

The Cookiebot researchers argued that this personal and sensitive information could be sold on by the ad tech industry and used to target online ads.

In a statement, Google said, "We do not permit publishers to use our technology to collect or build targeting lists based on users' sensitive information, including health conditions like pregnancy or HIV."

"The UK government urgently needs to ensure that its own websites, especially health and welfare sites, are not handing sensitive personal data to advertisers so that they can profile and monetise knowledge about very private topics," Jim Killock at the Open Rights Group told the BBC.

"This kind of practice is in our view unlawful, both on the grounds of needing explicit consent, and on the grounds that it is impossible to know where the information about you ends up, once it is placed into advertising bidding systems."

The UK Information Commissioner's Office said it was "looking into" tracking and other technologies used for targeting online advertising.