Here’s what you can learn about a person just by looking at their search terms

81% of top websites leak search terms to third parties. Why is it something to be concerned about? Even relatively benign searches can vividly depict a person’s life and interests.

Websites of all imaginable categories – adult, shopping, travel, and even health – collect search terms that might include your purchasing habits and sensitive data like gender identity and sexual preferences.

NortonLifeLock’s global research team, Norton Labs, released a study looking into this widespread phenomenon and learned that 81.3% of websites leak search terms in some form to third parties: 75.8% of websites via the Referer header, 71% of websites via the URL, and 21.2% of websites via the payload.

Norton Labs consider these numbers a lower bound because, for example, many payloads are obfuscated to avoid inspection, and the actual numbers for the payload are likely higher.

Norton Labs researcher Daniel Kats shared his morning’s search history. Only from this you can learn Kats is from Santa Monica, is thinking about buying a new laptop, loves coffee, and is a fan of Murakami books.

“In 2012, Target used its users’ shopping habits to determine which users might be pregnant to sell maternity-related products more efficiently. By doing this, Target inadvertently outed a teenage girl’s pregnancy to her father before she herself was even aware she was pregnant,” Kats noted.

Since the passage of the General Data Protection Regulation (GDPR) law in Europe and the California Consumer Privacy Act (CCPA) in California, many websites now include a privacy policy. So the researchers decided to find out if users are at least informed that their search data is passed on to third parties.

Norton Labs crawled the top 1 million websites and used an artificial intelligence tool to read the documents and find any sections mentioning search terms.

“We found that only 13% of privacy policies mentioned the handling of user search terms explicitly, a worryingly small percentage. However, 75% of privacy policies referred to the sharing of “user information” with third parties (which may include search terms) using generic wording. We think it’s unlikely that ordinary users can be well-informed on the treatment of their private data based on the wording of these privacy policies,” researchers said.

Websites hold most of the power when it comes to sharing your search terms with third parties, so it looks like users need to take care of their privacy themselves. Norton Labs recommends using privacy-focused browsers, tracker blocking, and ad-blocking browser extensions.