Google has admitted bypassing the privacy settings of Apple's Safari web browser on iPhones and computers to track users' browsing behaviour.
The internet firm was able to do this using a piece of code that Google claims was designed to enable the delivery of personalised content to Google users who had opted in to the service.
But the code also enables Google and other advertisers to see what websites Safari users are visiting, according to the Stanford University researcher who discovered the security loophole.
"Our data suggests that millions of users may have been affected," researcher Jonathan Mayer told the Guardian.
According to the Wall Street Journal, Google put code onto some of its ads served by DoubleClick's servers at doubleclick.net to fool the Safari browser into thinking the user was interacting with DoubleClick, which meant Safari allowed the code which it would normally have blocked.
Apple has issued a statement saying: "We are aware that some third parties are circumventing Safari's privacy features and we are working to put a stop to it."
According to Google, the firm has started removing the code from Safari browsers, which it claims created the privacy loophole inadvertently, said BBC reports, citing a senior Google source, who insisted users' identities had remained anonymous throughout.
Privacy group, the Electronic Frontier Foundation (EFF), said the admission was bad news for Google, especially coming so soon after the firm announced plans to consolidate the data it keeps about people using different parts of its services such as YouTube and its main search engine.
"It's time for Google to acknowledge that it can do a better job of respecting the privacy of web users," the EFF said in a statement.
The EFF said Google needs to make a pro-privacy offering to restore users' trust and commit to giving users a voice about tracking and then respecting those wishes.
The admission by Google over Safari has given rise to speculation the firm may also be tracking people without their knowledge on other browsers.
Observers said the admission is likely to put extra pressure on Google from trade authorities in the US and Europe.