He said that demographic picture could be connected to the user's real identity.
"That would give potentially, advertisers a way to target individuals who may be suffering from mental health issues," Mr Sargent said.
The comments came after the issue was raised in a report by Privacy International, titled Your Mental Health for Sale.
The report said depression.org.nz, along with the United Kingdom's NHS, used cookies by a company called Hotjar.
It said Hotjar cookies provided heatmaps and session replay scripts, which could be used to playback everything people typed or clicked on a web page.
Mr Sargent said it was inevitable that users of The Depression Test on depression.org.nz, would create a unique identifier.
"And if at any stage in the future, an individual identifies themselves by some other means, it's quite likely that the tracking agency can connect these pieces of information together to build up a bigger picture of who that person is, their name and their personal information," he said.
The Depression Test is promoted by former All Black Sir John Kirwan.
The self-test indicates if the person is showing signs of depression and anxiety.
The Health Promotion Agency spokesperson said the depression.org.nz website does not collect personal data from test users, but it is currently reviewing privacy statements on the website.
"As with most websites we may use cookies to gather data about trends in website usage using a tool called Google Analytics, and other similar analytics technology," the spokesperson said.
"The depression and anxiety quiz result algorithms are displayed in the URL to enable us to display the correct score page to the user. Once again this information is non-identifiable and only aggregated URL information is retained by the website, viewable via Google Analytics."
Privacy Commissioner John Edwards, said that the commission "hopes depression.org.nz takes note of the study and reviews it's third party cookies".
Netsafe chief executive Martin Cocker, believed the agency had two options.
"They can make users more aware and give them the opportunity to opt out. Or they can replace the systems that they're using, you know, third party services with their own services," he said.
"For the core service that they're providing, they don't need all these third party plugins. So they could replace them with something they code themselves or a service that they run themselves.
"Or they could simply make them opt out for users who don't wish to have them running when they're on the site."
