Healthcare Tracking Privacy
Is your website sending patient health data to Facebook and Google?
Most medical practices have no idea their website quietly sends health signals to the ad platforms every day — until a fine, a lawsuit, or a throttled ad account makes it obvious. We find it with a free, read-only audit, and fix it without breaking your ads.
Get a free tracking auditRead-only. We change nothing without your approval. Marketing/technology information — not legal advice.
In plain terms: the Facebook pixel and Google tags are built to send the page address, the referrer, and sometimes personal details to the ad platforms automatically. On a medical site, a page like /low-testosterone-quiz/ or /anxiety-treatment/ tells Facebook and Google that a specific visitor is interested in that condition. Nobody has to set anything up wrong — it happens unless you turn it off. The FTC has fined companies millions for it, patients have won lawsuits worth tens of millions, and Meta now quietly throttles ad accounts it flags as health-related.
The fines are real — and already happening
The Federal Trade Commission fines the health company that leaked the data, not the ad platform that received it. These are real orders for sending patient and consumer health information to Facebook, Google, and others.
| Company | Penalty | What happened |
|---|---|---|
| GoodRx | $1.5M | Shared prescriptions and health conditions with Facebook, Google, and Criteo after promising not to — the FTC’s first-ever Health Breach Notification Rule penalty. [1] |
| BetterHelp | $7.8M | Sent emails, IP addresses, and therapy-intake answers to Facebook, Snapchat, Criteo, and Pinterest. First FTC order banning the use of health data for re-targeting. [2] |
| Cerebral | ~$7M | Exposed sensitive data of roughly 3.2 million people to LinkedIn, Snapchat, and TikTok through website trackers. [3] |
| Monument | $2.5M | Disclosed the health details of about 84,000 alcohol-recovery patients to Meta and Google via pixels and APIs. [4] |
| Premom | $100K | Shared ovulation and pregnancy data through SDKs with Google and others without consent. [5] |
In July 2026 the FTC went further and sued Hims & Hers — a case that specifically names Meta’s server-side Conversions API, not just the browser pixel (allegations; unresolved). The FTC and HHS also jointly warned about ~130 hospital systems and telehealth providers over the Meta Pixel and Google Analytics back in 2023. [8]
It’s not just fines — patients are winning lawsuits
Private lawsuits need no regulator at all, and they’ve become the bigger threat. A wave of "Meta Pixel" cases has swept through healthcare, with reported settlements including:
And it reached the platform itself: in August 2025 a California jury found Meta liable for collecting women’s health data from the Flo period-tracking app without consent. Google agreed to pay $48 million, Flo Health $8 million, and Flurry $3.5 million. [15] This isn’t theoretical, and it isn’t slowing down.
Settlement figures are as reported by the sources cited and, where noted, remain subject to court approval. We verify every figure against primary records before relying on it in your audit.
How common is this? Almost universal.
How the leak actually happens
The web address itself gives it away
Both Meta and Google record the page someone visits by default. A page named for a condition — a Botox page, a weight-loss page, a "low testosterone quiz" — tells the ad platform exactly what that visitor is interested in, before they ever fill anything out.
The pixel can grab names and emails
With Meta’s automatic advanced matching switched on, the pixel can pull email, name, phone, and more from your forms and send them — scrambled, but still a stable identifier the platform can match back to a real person.
Ad clicks get tied to condition pages
Google tags each ad click with an ID and follows that visitor around your site, linking the click to every treatment page they browse.
Form fields slip into the data
Google itself warns that personal information "can trickle into" your analytics when people complete forms. A patient asking about a treatment can hand their identity to Facebook and Google along with the request.
The common thread: these tools collect the address, the referrer, and personal details by default. On a medical website, "default" means leaking health signals — you have to deliberately switch it off.
Where the law stands right now
The FTC doesn’t need HIPAA to act — it has used its own authority against GoodRx, BetterHelp, Cerebral, Monument, and more for sharing health data with advertisers after promising not to. That covers most clinics, telehealth, and apps. [1]
HIPAA. HHS guidance says tracking on logged-in patient pages generally touches protected health information and needs a formal agreement or patient permission — a privacy policy alone isn’t enough. [6] One thing most agencies get wrong: a 2024 court ruling struck down the idea that an IP address plus a visit to a public condition page automatically creates protected information. [7] That narrowed one slice of risk — but it’s not an all-clear, and it left the FTC and the lawsuits untouched.
State laws. Washington’s My Health My Data Act protects health data far beyond HIPAA and lets individuals sue directly; California treats health data as sensitive. [16]
The platforms’ own rules. Meta flatly prohibits sending health data — and even prohibits naming an event or audience in a way that implies a condition. [9] Google bars personalized ads and remarketing built from health interest. [11] So the leak breaks the terms you already agreed to.
This is marketing and technology information, not legal advice. The legal call for your practice is yours and your attorney’s — for anything involving patient records we recommend a legal review.
It’s also quietly wrecking your ad results
Leaking health data isn’t even a shortcut — it hurts the campaigns it’s supposed to help.
Meta throttles the data
Once Meta flags your account as health-related, it strips page detail and can block your Lead and Purchase events — starving the optimization that depends on them.
Google removes your remarketing
Google bars remarketing and lookalike audiences for health, so you can’t retarget the condition-page visitors who are your warmest prospects.
Messy tracking breaks attribution
Multiple pixels and double-counted conversions mean your reports lie and the bidding learns from bad data.
Browser privacy severs the trail
Safari and Firefox block the cookies sloppy setups rely on, so conversions get under-reported no matter what.
The clean, compliant setup is also the better-performing one. Fixing the privacy problem fixes the reporting problem at the same time.
How we fix it — without breaking your ads
Audit first, read-only — we map every tracker and every page that leaks before touching a thing.
Send plain, generic page names to the platforms instead of condition-named URLs.
Turn off automatic advanced matching so no names or emails flow to Meta or Google.
Rename any event or audience that implies a condition — Meta’s own rules require it.
Consolidate to one clean, correctly-categorized tracking dataset.
Set up server-side tracking that only sends approved, non-health fields, with conversions counted once.
Wire privacy signals (Limited Data Use, Consent Mode) in properly.
Roll it out one change at a time, watching your ads the whole way — nothing goes live without your okay.
What it costs
Every engagement starts with the free audit. If we find exposure, most fixes land in the low-to-mid four figures, with optional monthly monitoring — a fraction of a single fine or lawsuit, and it usually pays for itself in recovered ad performance.
We scope it to what's actually broken — anything from a quick cleanup to a full server-side rebuild — and give you a fixed quote after the audit. No surprise agency bills.
Find out what your website is leaking — free
A read-only audit and a plain-English report: every pixel firing, which pages leak condition signals, and exactly what to fix first. No changes, no obligation.
Get my free tracking auditQuestions, answered
Is the Facebook (Meta) pixel HIPAA compliant?+
Not by itself. The pixel is built to send the page address, the referrer, and — with advanced matching on — personal details to Meta automatically. On a medical website that default behavior means health signals are going out the door. Meta’s own rules put the responsibility on you: you promise not to send health data, and you’re not even allowed to name an event in a way that implies a condition. Whether your setup is compliant depends on how it’s configured and which pages it runs on — which is what an audit tells you.
Didn’t a court throw out the government rules on this?+
Only partly. In 2024, a federal court struck down one specific theory — that simply tying an IP address to a visit to an unauthenticated public condition page automatically creates protected health information. The rest of the guidance stands, especially for logged-in patient areas, and it changed nothing about the FTC’s power or the lawsuits patients keep winning. It is not a green light.
Will fixing this break the ads I’m already running?+
Not when it’s done carefully, which is the whole point. We review your account first, protect anything your live campaigns depend on, clean up the tracking your ads already use rather than moving them, and make changes one at a time while we watch performance. In most cases it actually helps — Meta stops throttling a dataset once it’s no longer flagged as health data.
What does the free audit include?+
A read-only check of your website tracking: every pixel firing, which pages leak condition signals, your Meta data settings, your Google Ads and Analytics exposure, and whether anything runs on logged-in patient pages. You get a plain-English report of what’s exposed and what to fix first. We change nothing without your approval.
I run a small clinic or med spa, not a hospital. Does this apply to me?+
Yes — often more so. Smaller practices advertise the hardest on Facebook and Instagram and have the most condition-specific pages, usually with nobody watching the tracking. Several of the FTC’s cases were against telehealth and app companies, not big hospitals.
Is this legal advice?+
No — it’s marketing and technology help. The legal call for your practice is yours and your attorney’s, and for anything involving patient records or logged-in areas we’ll point you to get a legal review.
Sources & references
Every claim is tied to a government, platform, peer-reviewed, or reputable news source. FTC penalties are from ftc.gov; settlement figures are as reported and, where noted, remain subject to court approval.
- [1] FTC — Action to Bar GoodRx from Sharing Health Info for Advertising. https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising
- [2] FTC — Final Order Banning BetterHelp from Sharing Health Data for Advertising. https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising
- [3] FTC — Proposed Order Prohibiting Cerebral from Disclosing Sensitive Data. https://www.ftc.gov/news-events/news/press-releases/2024/04/proposed-ftc-order-will-prohibit-telehealth-firm-cerebral-using-or-disclosing-sensitive-data
- [4] FTC — Monument Banned from Disclosing Health Data for Advertising. https://www.ftc.gov/news-events/news/press-releases/2024/04/alcohol-addiction-treatment-firm-will-be-banned-disclosing-health-data-advertising-settle-ftc
- [5] FTC — Premom / Easy Healthcare case. https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3186-easy-healthcare-corporation-us-v
- [6] HHS OCR — Online Tracking Technologies by HIPAA Covered Entities. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
- [7] AHA — HHS Will Not Appeal AHA Court Victory in Online-Tracking Case (Aug 2024). https://www.aha.org/news/headline/2024-08-29-hhs-will-not-appeal-aha-court-victory-online-tracking-case
- [8] HHS OCR & FTC — Joint Warning Letters to ~130 Hospital & Telehealth Providers (Jul 2023). https://www.hhs.gov/about/news/2023/07/20/hhs-office-civil-rights-federal-trade-commission-warn-hospital-systems-telehealth-providers-privacy-security-risks-online-tracking-technologies.html
- [9] Meta — Business Tools Terms (sensitive data). https://www.facebook.com/legal/terms/businesstools
- [10] Meta — Advanced Matching (pixel user-data fields). https://developers.facebook.com/docs/meta-pixel/advanced/advanced-matching/
- [11] Google — Health in Personalized Advertising policy. https://support.google.com/adspolicy/answer/16701855
- [12] Google Analytics — Avoid Sending PII. https://support.google.com/analytics/answer/6366371
- [13] Health Affairs / coverage — Nearly all US hospitals transfer data to third parties. https://healthitsecurity.com/news/nearly-all-us-acute-care-hospitals-transfer-data-to-third-parties-study-finds
- [14] Rutgers / PNAS Nexus — 66% of hospitals use tracking pixels; 46% more likely breached. https://www.rutgers.edu/news/invisible-codes-hospital-websites-put-patient-data-risk
- [15] The Record — Google & Flo Health settle privacy class action. https://therecord.media/google-flo-health-settle-privacy-class-action
- [16] Washington State — My Health My Data Act (coverage). https://datamatters.sidley.com/?p=4971