In the case of the social networks surveyed, all of the URLs being relayed via such HTTP headers included the user's unique identifier, he said.

When a user's page is being loaded on such sites, third-party tracking and advertising services that have a relationship with the site get not only the data from their tracking cookies but also the data containing the users unique identifier from the HTTP header, he said.

Another way in which identity data is leaked to third-party providers is when a social networking site contains objects from a server that appears to be part of the site, but in reality belongs to the third-party.

At least two of the social networks surveyed were relaying personal identity data to such hidden third-party servers, the report said. Also, five of the 12 social networks surveyed were also leaking unique user identifiers via so-called Request-URIs, which identify pages or objects on a Web site.

"We don't know what the specific practice of a third-party tracking site," when it comes to using the information, Wills said. "But this information is available to them. It is particularly worrisome because third party aggregators are creeping into a lot of sites that you and I visit."