Websites lie about what private information they are sharing with other sites, including advertising sites like Doubleclick.

That’s the bottom-line of a study by a Stanford researcher Jonathan Mayer released at an online privacy forum at the National Press Club.  The study, called Tracking the Trackers: Where Everybody Knows Your Username, Looking at the top 250 sites (defined by Quantcast), the study found that 61% shared at least some information with third-party sites, most often including the user’s username.

As the study notes, since people often use the same username across multiple sites, this gives advertisers and others the ability to piece together whatever other information can be gleaned from different sites into a linked set of information about each person.   And “combining data from multiple accounts often provides a sufficiently comprehensive mosaic to identify an individual.” The top recipients of the data include Google Analytics, Google’s DoubleClick, comScore, Quantcast and Facebook.

What’s worse is that most of the sites covered by the study lied about their sharing policies — or at least in the more delicate phrasing of the study “websites make what would appear to be incorrect, or at minimum misleading, representations” about what information they share.

At the privacy forum, Federal Trade Commission Chairman Jon Leibowitz praised the study as “absolutely terrific work” and said it  would help in the agency’s efforts to protect consumers’ online privacy. Said Leibowitz:

“Once you enter cyberspace, software placed on your computer, usually without your consent or even knowledge, turns your private information into a commodity out of your control. Your computer is your property, and people shouldn’t be putting things in it without your permission.”

Or as John Simpson of Consumer Watchdog argued in a written statement, the online advertising industry tries to lull consumers by claiming that online tracking gathers behavioral data anonymously. This study proves that personally identifiable information is regularly shared without consumers’ knowledge. We can’t rely on industry promises to protect consumer privacy; clearly we need ‘do not track’ legislation, and we need it now.