I'm not an expert or even particularly up to date, but I heard that other websites could see the client certificates installed. So a third party website might recognise the client certificate and know things about the user.