Healthcare Tracking Privacy · Phoenix AZ

Is Your Website Sending Patient Health Data to Facebook and Google?

Most medical practices have no idea their website quietly sends health signals to ad platforms every day — until a fine, a lawsuit, or a throttled ad account makes it obvious. We find it with a free, read-only audit, and fix it without breaking your ads.

Get a Free Tracking Audit →See how the leak happens

Read-only audit. We change nothing without your approval. Marketing/technology information — not legal advice.

The short version: the Meta (Facebook) pixel and Google tags are built to send the page URL, the referrer, and sometimes hashed personal details to the ad platforms by default. On a healthcare site, a page like /low-testosterone-quiz/ or /anxiety-treatment/ tells Meta and Google that a specific visitor is interested in that condition. Nobody has to misconfigure anything — it happens unless you actively stop it. The FTC has fined companies millions for it, patients have won lawsuits worth tens of millions, and Meta now quietly throttles ad accounts it flags as health-related.

The fines are real — and already happening

The Federal Trade Commission penalizes the health company that leaked the data — not the ad platform that received it. These are real orders against real companies for sending patient and consumer health information to Facebook, Google, and others.

Company	Penalty	When	What happened
GoodRx	$1.5M	Feb 2023	Shared prescriptions and health conditions with Facebook, Google, and Criteo despite promising not to. First-ever FTC Health Breach Notification Rule penalty. [1]
BetterHelp	$7.8M	Jul 2023	Disclosed email addresses, IP addresses, and intake-questionnaire answers to Facebook, Snapchat, Criteo, and Pinterest. First FTC order banning the sharing of health data for re-targeting. [2]
Cerebral	~$7M	Apr 2024	Disclosed sensitive data of ~3.2 million people to LinkedIn, Snapchat, and TikTok via trackers. ~$5.1M for refunds plus $2M of a suspended $10M penalty. [3]
Monument	$2.5M	Apr 2024	Disclosed health info of ~84,000 alcohol-addiction patients to Meta and Google via pixels and APIs. Penalty suspended for inability to pay. [4]
Premom	$100K	May 2023	Shared ovulation-tracking health data via SDKs with Google, AppsFlyer, and two China-based analytics firms without consent. [5]

In July 2026 the FTC went further and sued Hims & Hers (with Utah and California) — a case that specifically names Meta's server-side Conversions API, not just the browser pixel, signaling that moving tracking to the server is not a loophole. (Allegations; unresolved.) The FTC and HHS also jointly warned roughly 130 hospital systems and telehealth providers about the Meta Pixel and Google Analytics back in July 2023. [8]

It's not just fines — patients are winning lawsuits

Private class-action lawsuits need no regulator at all, and they have become the bigger financial threat. A wave of "Meta Pixel" cases has swept through hospitals and health companies, with reported settlements including:

up to $20.5M

CVS / Criteo

website & app user data (prelim. approval 2026)

$12.25M

Advocate Aurora

~3M people (proposed settlement)

$9.5M

Penn Medicine

reported settlement, 2026

$6.6M

Novant Health

up to ~1.36M people (reported)

$3.7M

Duke Health

reported settlement

And it reached the platform itself: in August 2025, a California federal jury found Meta liable for collecting women's health data from the Flo period-tracking app without consent. Google agreed to pay $48 million, Flo Health $8 million, and Flurry $3.5 million. [17] The point for any practice running ads: this isn't theoretical, and it isn't slowing down.

Settlement figures are as reported by the sources cited and, where noted, remain subject to court approval. We verify every figure against primary court and settlement records before relying on it in your audit.

At a glance: what this has cost

Selected FTC fines and class-action settlements for sending health data to ad platforms.

FTC penalties from ftc.gov; settlement figures as reported, some subject to court approval. See sources below.

How common is this? Almost universal.

98.6%

of US acute-care hospital websites studied sent data to a third party — with Meta on roughly half of them (Health Affairs). [15]

66%

of hospitals used third-party tracking pixels — and those hospitals were 46% more likely to suffer a data breach (Rutgers / PNAS Nexus). [16]

~130

hospital systems and telehealth providers were sent joint FTC + HHS warning letters naming the Meta Pixel and Google Analytics (July 2023). [8]

How the leak actually happens

A patient visits

/low-testosterone-quiz/

Your pixel & tags fire

by default, on page load

Facebook & Google receive

the signal — tied to a real person

↳ the condition in the URL↳ hashed email & name↳ which ad they clicked

The page URL itself is the leak

Meta's Conversions API defines event_source_url — the browser URL where the event happened — and requires it for web events. [11] Google Analytics collects page_location, page_referrer, and page_title by default, and Google warns that "the URL path and parameters must be free of PII." [13] So a condition-named page silently transmits health interest to both platforms.

Automatic advanced matching sends hashed personal data

With Meta's automatic advanced matching enabled, the pixel can scrape and send eleven user-data fields — email, name, phone, birthdate, city, state, ZIP, and more — hashed with SHA-256. [10] Hashing is not anonymization: a hashed email is a stable, matchable identifier — that's the entire point of it. Combine that identifier with a condition page and the platform knows exactly who was interested in what.

Google auto-tagging ties ad clicks to condition pages

Google Ads auto-tagging appends a gclid to your landing-page URLs and stores it in a first-party cookie, linking a specific ad click to everything that visitor does on your site — including the condition and treatment pages they browse.

Form fields quietly flow into events

Google itself warns that PII "can trickle into your GA4 property when visitors complete form fields," and Meta's advanced matching is the equivalent on the Meta side. A patient filling out an intake or consultation form can send their identity straight to the ad platform alongside the service they're asking about. [13]

The common thread: these tools collect the URL, the referrer, and personal identifiers by default. On a medical website, "default" means leaking health signals. It's not a misconfiguration — it's the out-of-the-box behavior you have to deliberately switch off.

Where the law stands right now

The FTC doesn't need HIPAA to act. It has used the FTC Act and its Health Breach Notification Rule against GoodRx, BetterHelp, Cerebral, Monument, and others for sharing health data with advertisers after promising not to. That authority covers most non-hospital health businesses — telehealth, apps, clinics, and practices. [1]

HIPAA and HHS. HHS's Office for Civil Rights issued guidance that tracking technologies on authenticated pages — patient portals, logged-in telehealth — generally have access to protected health information and must be configured accordingly, with a Business Associate Agreement or patient authorization; a privacy policy alone is not enough. [6] One important correction that most agencies get wrong: in American Hospital Association v. Becerra (June 2024), a federal court vacated the theory that merely combining an IP address with a visit to an unauthenticated public condition page automatically creates PHI. HHS dropped its appeal in August 2024. [7] That narrowed one slice of HIPAA exposure — but it is not an all-clear: authenticated-page rules still apply, and the FTC and the courts are untouched by it.

State laws. Washington's My Health My Data Act protects "consumer health data" far beyond HIPAA and — critically — gives individuals a private right of action, which is expected to fuel more lawsuits. California treats health data as sensitive personal information under the CPRA. [18]

The platforms' own rules. Meta's Business Tools Terms flatly prohibit sending health information — and even prohibit naming an event or audience in a way that implies a health condition. [9] Google's policy classifies health as a sensitive category and bars personalized advertising, Customer Match, and remarketing built from it. [12] So the leak isn't just a legal risk; it violates the platforms' terms you already agreed to.

This is marketing and technology information, not legal advice. The legal determination for your practice is yours and your attorney's — both Google and HHS explicitly recommend consulting counsel, and for anything involving protected health information we recommend a legal review.

It's also quietly wrecking your ad performance

Leaking health data isn't even a growth hack — it actively hurts the campaigns it's supposed to help.

Meta throttles the data

Once Meta flags your dataset as health-related, it strips URL detail and parameters and can block standard events like Lead and Purchase — starving the optimization that depends on them. We've seen this live: a 'data sharing restrictions applied' warning on a real med-spa account.

Google removes your remarketing

Google bars Customer Match, similar audiences, and audience expansion for health categories — so you can't build a remarketing audience from the condition-page visitors who are your warmest prospects.

Fragmented datasets break attribution

Multiple pixels, mismatched event IDs, and no deduplication between the browser pixel and the Conversions API mean conversions get double-counted or dropped — and the bidding algorithm learns from garbage.

Browser privacy severs the trail

Safari blocks third-party cookies and purges storage after seven days; Firefox isolates cookies per site. Sloppy client-side-only tracking under-reports conversions regardless of the health rules.

The compliant setup — clean generic events, one dataset, server-side control, deduplicated conversions — is also the higher-performing setup. Fixing the privacy problem fixes the reporting problem at the same time.

How we fix it — without breaking your ads

Audit first, read-only

We map every pixel and tag, every page that leaks, your dataset categories, and anything running on authenticated pages — before touching anything.

Generic page names, never condition URLs

We stop sending condition-named paths to the platforms, using data redaction and controlled event parameters instead of the raw URL.

Turn off automatic advanced matching

No scraped form fields, no hashed PII flowing to Meta or Google — the single biggest identity leak, switched off.

No condition-implying event or audience names

Required by Meta's own terms — we rename anything that implies a diagnosis or treatment.

Consolidate to one clean dataset

One pixel, one dataset, declared in the right category — so your ads stop fighting a fragmented, throttled setup.

Server-side control + deduplication

A shared event ID across the pixel and the Conversions API so conversions count once, with the server-side layer whitelisting only approved, non-PHI fields.

Privacy signals wired correctly

Limited Data Use, Consent Mode, and restricted data processing set up as the compliance layer — not an afterthought.

Rolled out carefully, one change at a time

We watch delivery and conversions after each change and preserve anything your live campaigns depend on. Nothing goes live without your approval.

For anything touching protected health information or authenticated patient areas, server-side tracking is not automatically HIPAA-safe — it only helps if the sensitive fields are actually filtered out, and it may require a Business Associate Agreement or patient authorization. That's exactly the line we identify in the audit, and where we recommend a legal review.

What it costs

Every engagement starts with the free audit. If we find exposure, most fixes land in the low-to-mid four figures, with optional monthly monitoring — a fraction of a single FTC penalty or lawsuit, and it usually pays for itself in recovered ad performance.

We scope it to what's actually broken — anything from a quick cleanup to a full server-side rebuild — and give you a fixed quote after the audit. No surprise agency bills.

Find out what your website is leaking — free

We'll run a read-only audit of your tracking and send you a plain-English report: every pixel that's firing, which pages leak condition signals, what Meta and Google already restrict, and exactly what to fix first. No changes, no obligation.

Get my free tracking audit →

Questions, answered

Is the Facebook (Meta) pixel HIPAA compliant?

Not on its own. The pixel is designed to send the page URL, the referrer, and — with automatic advanced matching on — hashed personal data to Meta by default. On a medical site, that default behavior transmits health-interest signals. Meta's own Business Tools Terms put the obligation on you, the advertiser: you warrant you will not send health information, and even your event and audience names must not imply a health condition. HIPAA compliance depends on configuration, what pages the pixel runs on, and whether a BAA or authorization exists — which is exactly what an audit determines.

Didn't a court throw out the HHS rules on website tracking?

Partly, and it's important to get this right. In American Hospital Association v. Becerra (June 2024), a federal court vacated one specific theory in HHS's tracking bulletin — the idea that merely combining a visitor's IP address with a visit to an unauthenticated public page about a health condition automatically creates protected health information. The rest of the bulletin stands, including the obligations around authenticated pages like patient portals. And it changed nothing about the FTC's separate authority, state laws, or the private class-action lawsuits — which are now the biggest financial threat. It is not an all-clear.

Will fixing this break my ad campaigns?

Done carelessly, it can — which is why we don't. We audit first (read-only), identify any custom audiences or conversions that depend on condition URLs, clean up the dataset your ads already use rather than moving them, and roll out changes one at a time while watching delivery. The pixel keeps firing; we change the details it sends, not the fact that it fires. In most cases the compliant setup actually performs better, because Meta stops throttling a dataset it has flagged as health-related.

What does the free audit include?

A read-only review of your website's tracking: every pixel and tag that's firing, which pages leak condition signals (URLs, event names, form data), your Meta dataset category and any data-sharing restrictions already applied, Google Ads/GA4 PII exposure, and whether anything is running on authenticated pages. You get a plain-English report of what's exposed, how serious it is, and what to fix first. We change nothing without your approval.

I'm a med spa / dental / hormone / weight-loss clinic, not a hospital. Does this apply to me?

Yes — arguably more. Smaller practices run the most Meta and Instagram ads and have the most condition-specific pages (Botox, TRT, GLP-1/weight loss, PCOS, anxiety, addiction), and they rarely have a privacy team watching the tracking. Several of the FTC's actions were against telehealth and app companies, not hospitals. The exposure scales with how condition-specific your pages are and how aggressively you advertise.

Is this legal advice?

No. This is marketing and technology information to help you understand and reduce your exposure. The legal determination for your practice is yours and your attorney's — both Google and HHS explicitly say to consult counsel. For anything touching protected health information or authenticated patient areas, we recommend a legal review, and we'll tell you where that line is.

Sources & references

Every claim on this page is tied to a government, platform, peer-reviewed, or reputable news source. FTC penalties are from ftc.gov; settlement figures are as reported by the cited sources and, where noted, remain subject to court approval.