Millions of people are using online dating sites to search for love or connection, but users should beware: many online dating sites are taking short cuts in safeguarding the privacy and security of users. Whether it’s due to counter-intuitive privacy settings or serious security flaws, users of online dating profiles risk their privacy and security every day. Here are six sobering facts about online dating services and a few suggestions for routing around the privacy pitfalls.

1. Your dating profile—including your photos—can hang around long after you’ve moved on. Whether you signed up on a lark or maintained an active profile for several years, your online dating profile can be lurking around long after you’ve cancelled the account. In fact, dating sites have an impetus for maintaining your information—what if things don’t work out and you want to reactivate your profile in a few months? But having your data hanging around on a company’s servers, even if they aren’t actively serving that content to the web at large, raises a host of privacy issues. The most pressing concern is that information about you may be exposed to future legal requests that might involve a criminal investigation, a divorce case, or even a legal tussle with an insurance company.

Photos in particular can linger long after you’ve deleted them or closed your account due to many large websites hosting user-uploaded photos with Content Delivery Networks. In short, photos are hosted on an outside company’s servers. As Joseph Bonneau explained, the main website provides an obfuscated URL for the photo to anyone it deems has permission to view it. But in Bonneau’s experiment with 16 popular websites, removing the photo from the main website didn't always remove it from the Content Delivery Network; in those cases, anyone who still had the destination URL would be able to view the photo. This means that Content Delivery Networks can maintain caches of sensitive photos even after users “delete” them, leaving photos vulnerable to being rediscovered or even hacked in the future.

What you can do about it: Look at the privacy policy of a website before you sign up and see what they say about how they treat data of deleted profiles. Remember that a privacy policy can change at any time; even if a site promises to discard your data upon deletion now, it could revise that policy tomorrow to hang on to data for a few months—or forever. If you decide to sign up for a dating site, consider taking a few steps to make it harder for a dating site to easily identify you.  Get a throw-away email address, avoid using your name, and avoid paid sites that would elicit your credit card number and billing information. To maintain the highest levels of privacy, consider taking steps to obfuscate your IP address, such as using a VPN.

2. Gaping security holes riddle popular mobile dating sites-still. In January, an Australian hacker exploited a security flaw in Grindr, the mobile app that allows gay and questioning men to find sexual partners nearby through the use of GPS technology. The vulnerability allows an attacker to impersonate another user, send messages on his behalf, access sensitive data like photos and messages, and even view passwords. Grindr acknowledged the vulnerability on January 20th and promised a mandatory update to their software “over the next few days.” To date, Grindr's blog and Twitter profile do not mention a security fix for the flaw. While there haven’t been reports about a hack of the straight-themed sister app, Blendr, security experts speculate that it suffers from a similar vulnerability.

What you can do about it: For right now, we have to agree with Sophos security: if you’ve got a Grindr or Blendr account, you should close it at least until the security vulnerability is addressed; then keep an eye on the Grindr blog for news of a security update.

3. Your profile is indexed by Google. While this isn’t the case for every online dating site, OkCupid profiles are public by default and indexed by Google. It’s a simple privacy setting, but it can trip up even advanced users, as Wikileaks' Editor-in-Chief Julian Assange learned last year when his publicly-accessible OkCupid profile was discovered. Even something as small as a unique turn of phrase could show up in search results and bring casual visitors to your page.

What you can do about it: Some people don’t mind having an online dating site publicly indexed and searchable, but if you find the thought disquieting, then dig into your privacy settings and make sure that your profile is only viewable to other logged-in users on the site. It’s good to familiarize yourself with the other available privacy settings regardless of which site you are using.

4. Your pictures can identify you. Photo identification services like TinEye and Google Image Search make it a trivial matter to re-identify photos that you’ve posted online. Users hoping to create a barrier between their real identities and their online dating profiles might use strategies such as pseudonyms and misleading information in a profile to obfuscate their identity. However, just changing your name and a few facts about your life may not be enough. If you use a photo on your dating site that can be associated with one of your other online accounts—for example, if it had previously been shared on your Facebook profile or LinkedIn profile – then your real identity could be easily discovered.

What you can do about it: Face it (no pun intended): there are a number of ways your online dating profile can be connected to your real identity, especially if you have a robust online life. Photos are a particular vulnerability. Before uploading a photo, consider whether you’ve used it in other contexts. Try searching for the image using TinEye and Google Image Search before uploading it.  And be aware that search technology and facial recognition technology is rapidly evolving. At least one study suggests that it’s possible that even photos you have never uploaded before could be used to figure out your identity. So think hard about how you’d feel if a potential employer or acquaintance found personal data about you on a dating site. This might be a particular concern for individuals who use niche dating sites, such as HIV-positive or queer dating sites.

5. Your data is helping online marketers sell you stuff. The cynics among us might think this is the primary purpose of an online dating site. The operators of these sites cull vast amounts of data from users (age, interests, ethnicity, religion, etc.), then package it up and lend or sell the data to online marketers or affiliates. Often, this transaction is gift-wrapped with the promise that your individual data is “anonymized” or sold in aggregate form, yet users should be wary of such promises. Using data from social networking sites sold to advertisers, Stanford researcher Arvind Narayanan demonstrated that it’s hard to truly anonymize data before it’s packaged and sold. In addition, last October researcher Jonathan Mayer discovered that OkCupid was actually leaking1 personal data to some of its marketing partners. Information such as age, drug use, drinking frequency, ethnicity, gender, income, relationship status, religion and more was leaked to online advertiser Lotame.

What you can do about it: You should consider contacting the sites you use to clarify their practices and letting them know your concerns. If you are dissatisfied with a company's practices with sharing data, you might also consider filing a complaint with the Privacy Rights Clearinghouse's Online Complaint Center. Remember, part of what helps companies change practices is public interest in an issue, so blog posts and public discussion can help push companies to adopt better practices.

6. HTTPS support is a wreck on many of the popular online dating sites, meaning you risk exposing your browsing history, messages, and much more when you use them. Unfortunately, our recent survey of major online dating sites found that most of them were not properly implementing HTTPS. Some online dating sites offer partial support for HTTPS, and some offer none at all. This leaves user data exposed. For example, when a user is on a shared network such as a library or coffee shop, she may be exposing sensitive data such as a username, chat messages, what pages she views (and thus what profiles she is viewing), how she responds to questions, and more to an eavesdropper monitoring the wireless connection. Even worse, poor security practices leave her vulnerable to having her entire account taken over by an attacker. More so, since the advent of Firesheep, an attacker doesn’t need any particular skill to perpetrate such attacks. See our in-depth post on OkCupid to learn more.

What you can do about it: Start protecting yourself immediately by installing HTTPS Everywhere, a Firefox addon created and maintained jointly by EFF and the Tor Project. When you use Firefox, HTTPS Everywhere will automatically change URLs from HTTP to HTTPS on over a thousand sites. As more dating sites begin to provide support for HTTPS, we’ll expand the ruleset for HTTPS Everywhere to include those sites so you’ll be better protected.

EFF is individually contacting online dating sites to get them to step up their security practices, but we could use your help. Please send an email to OkCupid to tell them to safeguard user privacy and security.

• 1. Mayer clarified: "Leakage, in common parlance, implies unintentionality. In computer security, leakage is a term of art for an information flow—some instances of leakage are entirely intentional." Learn more: http://cyberlaw.stanford.edu/node/6740