Web-Tracking Pixels on Health Sites
The Meta and Google Pixel Scandals on Telehealth and Hospital Sites
Evidence grade 5 of 5, Settled. Read how the Atlas grades evidence.
The written rationale for this grade is still being prepared.
- FDA
- Not Applicable (privacy/consumer-protection domain)
Reference only. Not medical advice.
What can go wrong
For consumers, pixel leakage means a search for ED medication, a TRT clinic visit, or a mental-health intake can become an input to advertising profiles and data brokers. For organizations it has produced a wave of class-action litigation and regulatory scrutiny. The data, once transmitted to a third party, is largely outside the consumer's control.
This is something to take to a clinician. The Atlas can tell you what is known about web-tracking pixels on health sites in general. It cannot tell you what is happening in your body, and the difference matters most for exactly the symptoms that bring people to this page.
A tracking 'pixel' is a small piece of code (despite the name, usually JavaScript, sometimes a 1x1 image) that a website embeds to measure visits and conversions and to power advertising. The most discussed are the Meta Pixel (formerly Facebook Pixel) and Google Analytics. On general retail sites these are routine. On health and telehealth sites they are dangerous, because the events they transmit (page visited, button clicked, appointment booked, condition searched) can constitute identifiable health information. In 2022-2023 investigative reporting and litigation revealed these trackers widely deployed on hospital, health-system, and telehealth websites, sometimes inside patient portals, transmitting data to Meta and Google. This entry summarizes well-documented reporting and regulatory guidance; specific facts vary by organization.
A one-line snippet of JavaScript can leak what you clicked on a clinic's site.
What people take it for
What it is taken for. Approval, where it exists, covers only some of these.
How it works
When a page loads, the embedded tracker runs in the user's browser and sends an HTTP request to the third party (Meta, Google) containing event parameters plus identifiers the browser already holds: cookies, the Meta '_fbp' identifier, the logged-in Facebook user if applicable, the page URL (which can itself reveal a condition, e.g. '/erectile-dysfunction/'), and IP address. On portal pages, reporting found trackers could capture data tied to appointment booking or medication selection. Because Meta can match the _fbp cookie or a logged-in session to a real account, the 'anonymous' event can become a named one on Meta's side.
Why 'we didn't send names' misses the point
Organizations often defended pixel use by saying no medical records or names were transmitted. But a URL like 'clinic.com/conditions/low-testosterone/book' plus a Meta cookie is enough for the receiving platform to infer a sensitive condition and link it to a person. The 2022 HHS Office for Civil Rights bulletin took the position that regulated entities using such trackers in ways that disclose protected health information to third parties can violate HIPAA, and that an IP address combined with a visit to a health page can be individually identifiable health information. A 2024 court ruling narrowed parts of OCR's guidance regarding unauthenticated public webpages, but the core privacy concern (and the FTC's separate authority over non-HIPAA entities) remains.
What people get wrong
Often saidA pixel just counts page views
ActuallyModern advertising pixels transmit rich event data and persistent identifiers to a third party in real time. They are designed to attribute conversions to specific users, which is the opposite of anonymous counting.
Often saidIf the URL has no name in it, the visit is private
ActuallyThe receiving ad platform often holds its own identifier for you (a logged-in session or a durable cookie). It can attach the 'anonymous' health-page visit to your real profile.
Who profits, and who pushes back
Nobody is named here yet, because we have not done that work on this entry. Read that as unfinished. Somebody almost certainly sells this, and somebody almost certainly disputes it. Assume both until we have checked.
What we do not know
- After the 2024 court ruling narrowing OCR guidance, where exactly is the HIPAA line for public health webpages?
- Will server-side tracking (Conversions API) make pixel leakage harder to detect from the browser?
- Can health systems realistically run advertising analytics without leaking condition-revealing URLs?
At a glance
- Most-named tracker
- Meta Pixel (formerly Facebook Pixel)
- Major reporting
- The Markup / STAT, 2022
- Hospitals flagged
- Reporting found the pixel on dozens of top hospital sites
- Regulator guidance
- HHS OCR bulletin on tracking tech (2022, updated 2024)
- FTC angle
- Pixel data-sharing central to GoodRx/BetterHelp orders
What this entry does not yet cover
What follows is unfinished work on our side, not a finding about Web-Tracking Pixels on Health Sites. A short entry is not a safe entry.
- Timeline. We have not built the dated record of research and regulatory events.
- Cost and market. We have not documented what it sells for or who sells it.
- Supply chain. We have not mapped where it is made.
- Who uses it. We have not documented the user groups.
- What could change. No forward-looking summary yet.
- How it compares. We have not set it against the alternatives.
- Children and teenagers. We have not checked what is known about younger people.
- Where we land. We have not taken a position on this yet.
Sources
The studies below are named and described, but not linked. You cannot open them from here and check our reading against them, which means this page is our summary of the literature rather than a document you can verify. Weigh it accordingly until the links exist.
The studies that matter
The Markup / STAT 'Pixel Hunt' investigation2022
Found the Meta Pixel on the websites of a large share of top U.S. hospitals; on some it transmitted data tied to appointment scheduling and patient-portal pages
Telehealth tracking study (JAMA / academic analyses)2023
Multiple analyses found third-party trackers (Meta, Google, others) on direct-to-consumer telehealth platforms handling sensitive conditions
HHS OCR bulletin on online tracking technologies2022 (revised 2024)
Stated HIPAA-regulated entities may not use tracking tech in ways that impermissibly disclose PHI; later partially vacated by a federal court for unauthenticated public pages
FTC GoodRx & BetterHelp orders2023
Both turned substantially on identifiable data flowing to advertising platforms via embedded trackers/pixels