  We turn our attention to the elephant in the room of data protection, which
is none other than the simple and obvious question: "Who's tracking sensitive
domains?". Despite a fast-growing amount of work on more complex facets of the
interplay between privacy and the business models of the Web, the obvious
question of who collects data on domains where most people would prefer not be
seen, has received rather limited attention. First, we develop a methodology
for automatically annotating websites that belong to a sensitive category, e.g.
as defined by the General Data Protection Regulation (GDPR). Then, we extract
the third party tracking services included directly, or via recursive
inclusions, by the above mentioned sites. Having analyzed around 30k sensitive
domains, we show that such domains are tracked, albeit less intensely than the
mainstream ones. Looking in detail at the tracking services operating on them,
we find well known names, as well as some less known ones, including some
specializing on specific sensitive categories.
