Two separate investigations, by the BBC and web browser Brave, found half of Yorkshire councils had websites that collected data for advertising and almost all did not comply with data protection laws.
Anyone visiting Sheffield City Council website, including to get help with a benefit claim, would have seen adverts for cars, beds, radios and tickets for theatre shows. There was also an advert shown for saving money on funeral expenses and another for a pharmaceutical product.
The council, which collected the most data of any council in Yorkshire, has now updated its processes and removed advertising from its website.
Councils collect the data to track how people use their websites, including which sections users visit the most, to improve these services, they said. The data is anonymous, meaning advertisers do not know personal information like names and addresses.
While some councils did not host advertising on their website, almost all of them collected data improperly by assuming people consented to having non-essential data collected, instead of specifically asking.
Nearly all councils in the UK permitted at least one company to learn about the behaviour of people visiting their websites and 54 per cent of councils collected data through their benefits pages.
In total, this was linked to 31 known companies spread across 10 different countries, including the UK. Some 951 advertising trackers on benefits pages were found.
Lord Paul Scriven, a former leader of Sheffield City Council and Lib Dem peer, said: “It’s unethical and unacceptable that the council has made money by passing on data to companies it then has no control over.”
Lord Scriven, who covers IT and civil liberties in his role in the House of Lords, added: “Before any more action is taken, this needs to be discussed in the city of Sheffield.”
Mark Gannon, director of business change and information solutions at Sheffield City Council said: “Like the vast majority of websites, [tracking codes] are used on our website for site-specific purposes, such as improving customer experience on the site, analytics and advertising through the Council Advertising Network.”
The council said no personal data was sold on and that it met statutory data protection regulations.
While UK organisations no longer will be bound by European data protection rules from the end of this year, UK regulations are set to be virtually identical.
The Council Advertising Network said it did not “specifically target vulnerable people via council advertising” and that it automatically blocked ads for payday loans, gambling and alcohol.
Dr Johnny Ryan, chief policy officer of Brave, which by coincidence carried out the same investigation as the BBC, said councils were exposing people to “mass profiling”.
He said: “This is dangerous, because it leads manipulation and discrimination.”