CookieGuard

Consent infrastructure

Tracking pixels on telehealth and health websites: what changed, and what still applies

Ad pixels and analytics, such as Meta Pixel, Google Analytics, TikTok and session replay tools, are how most telehealth funnels measure performance. They can also send page URLs, form events and identifiers to third parties, and on a health site that data can reveal what someone is being treated for. Three sets of rules matter: HIPAA, the FTC's rules for health data outside HIPAA, and state consumer health data laws.

General information, not legal advice. Last reviewed October 19, 2026.

1. HIPAA: the HHS tracking guidance after AHA v. Becerra

The HHS Office for Civil Rights published a bulletin on how HIPAA applies when covered entities and business associates use online tracking technologies (HHS OCR bulletin).

What the court struck. On June 20, 2024, the U.S. District Court for the Northern District of Texas vacated one part of it in American Hospital Ass'n v. Becerra, No. 4:23-cv-1110: the part saying HIPAA is triggered when a tracking tool connects an individual's IP address with a visit to an unauthenticated public webpage about specific health conditions or providers. HHS appealed, then moved to dismiss, and the Fifth Circuit dismissed the appeal on September 4, 2024. HHS notes the vacatur at the top of the bulletin and says it is evaluating its next steps.

What still applies. The rest of the bulletin remains HHS's published guidance. Among other things, it says:

  • Tracking on user-authenticated pages, such as patient portals and telehealth platforms, “generally” has access to PHI and must comply with the HIPAA Rules.
  • Unauthenticated pages for booking appointments or symptom checkers may involve PHI in certain circumstances, such as when users enter an email address or reason for care.
  • Disclosing PHI to a tracking vendor requires a Privacy Rule permission and a business associate agreement (BAA), or the individual's HIPAA authorization.
  • “Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization.”

The bulletin also says it doesn't have the force and effect of law.

What this means for a consent tool

If you're HIPAA-regulated, a cookie banner isn't how you authorize sharing PHI with an ad platform. You need the HIPAA path: no PHI to the vendor, a BAA, or a valid authorization. CookieGuard isn't HIPAA-certified, doesn't sign BAAs, and doesn't replace those controls.

2. The FTC: health data outside HIPAA

Many telehealth, wellness and direct-to-consumer health brands aren't HIPAA covered entities for all of their data. The FTC has acted against several of them over pixels and similar tools:

  • GoodRx (2023). The FTC's first action under its Health Breach Notification Rule. The FTC alleged GoodRx disclosed users' health information to Facebook, Google and others without authorization. GoodRx agreed to a $1.5 million civil penalty and a ban on sharing health data with applicable third parties for advertising.
  • BetterHelp (2023). The FTC alleged the online counseling service shared email addresses, IP addresses and health questionnaire information with Facebook, Snapchat, Criteo and Pinterest for advertising, after promising to keep it private. The final order required $7.8 million for consumer refunds, banned sharing health data for advertising, and requires affirmative express consent before certain disclosures.
  • Health Breach Notification Rule update (2024). The FTC clarified that the rule covers health apps and similar technologies not covered by HIPAA, and that a “breach of security” includes unauthorized disclosures, not just hacks. The amendments took effect July 29, 2024.
  • Hims & Hers (2026, pending). In July 2026 the FTC, Utah and California sued Hims & Hers in the Northern District of California. Among other claims, they allege it shared health information about medical conditions with advertising platforms, including Meta and Snap, through customer lists and tracking tools that automatically sent visitors' actions on its website, despite promising to keep that information private. The court hasn't ruled; these are allegations.

The pattern across these cases: tracking tools sent health information to ad platforms in ways the FTC said didn't match what users were told or had agreed to.

3. State consumer health data laws

  • Washington (MHMDA) and Nevada (SB 370) require opt-in consent before collecting consumer health data and separate consent before sharing it, unless the data is needed to provide a service the consumer requested. Both reach businesses outside the state that target its residents. Washington's law can be enforced through private lawsuits; Nevada's by public officials.
  • Connecticut's data privacy act requires consent before processing consumer health data and before selling it, for any business regardless of size, and the processing must be reasonably necessary for its purpose. It protects Connecticut residents and is enforced by the Attorney General.
  • Maryland's Online Data Privacy Act, which applies to processing from April 1, 2026, limits collecting, processing or sharing sensitive data, including consumer health data, to what is strictly necessary for a product or service the consumer requested, and bans selling it. Those limits don't turn on consent, so a consent banner isn't the fix there.
  • New York's Health Information Privacy Act passed both chambers in June 2026 and, as of this review, hasn't been signed into law.

Practical steps for a telehealth or health marketing site

These are common steps teams take. They aren't a substitute for legal review.

  1. Inventory every tag. Know what fires on the homepage, condition pages, quizzes, intake, checkout and logged-in areas, and what each one sends: URL, page title, events, form fields, identifiers.
  2. Keep third-party ad and analytics tags off authenticated and intake pages unless counsel has approved the data flow.
  3. Gate tags behind opt-in consent for health-data purposes, with choices that are never pre-checked and aren't granted by a generic “Accept all”.
  4. Stop leaking health detail in URLs and event names. A URL like /quiz/result?condition=… or an event named glp1_eligible goes straight into pixel payloads.
  5. Check server-side flows. Conversion APIs, customer-list uploads and CRM syncs bypass the browser banner entirely.
  6. Keep records of what was consented to, when, and under which rule.
  7. Publish the policies the state laws require, such as Washington's Consumer Health Data Privacy Policy, linked from your homepage.

Where CookieGuard's Healthcare plan fits

CookieGuard handles browser-side consent for consumer health data sites that aren't HIPAA-covered:

  • Separate choices to collect and to share health data, never pre-checked, not granted by Accept All, and denied by Reject All.
  • Ad tags wait for consent to share. With health-data mode on, marketing tags and Google's ad signals (Consent Mode v2) stay off until the visitor agrees to share health data. Analytics can wait for health data too.
  • Washington, Nevada and Connecticut rules, extendable to all US visitors or everyone, and applied when a visitor's location can't be determined.
  • Tagged-script blocking and a JS API for Meta Pixel, Mixpanel, PostHog and affiliate pixels that load outside Google Tag Manager (integration recipes).
  • Consent records for each decision, exportable as CSV or JSON.

What it doesn't do: gate server-side data flows, form contents, or data you send to CRMs, affiliates or warehouses; provide HIPAA authorizations or BAAs; or give legal advice.

Frequently asked questions

Is the HHS online tracking guidance still in effect?
Partly. In June 2024 a federal court in Texas vacated the part saying HIPAA is triggered when tracking connects an IP address with a visit to an unauthenticated public page about health conditions or providers, and HHS dropped its appeal. The rest of the bulletin, including guidance on authenticated pages, booking and symptom-checker pages, BAAs and authorizations, remains published.
Can I use Meta Pixel on a telehealth site?
It depends on where it runs, what it sends, and which laws apply. HIPAA-regulated pages need a HIPAA basis to disclose PHI, and a cookie banner isn't a HIPAA authorization. Outside HIPAA, the FTC has acted against companies whose pixels shared health data in ways users weren't told about or didn't agree to, and Washington, Nevada and Connecticut require consent for consumer health data. Get legal review for your specific setup.
Does a cookie consent banner count as HIPAA authorization?
No. HHS's guidance says banners asking users to accept or reject tracking technologies don't constitute a valid HIPAA authorization.
What did the FTC do in the GoodRx and BetterHelp cases?
GoodRx agreed to a $1.5 million civil penalty in the FTC's first Health Breach Notification Rule case, over health data shared with platforms including Facebook and Google. BetterHelp's final order required $7.8 million for consumer refunds and banned sharing health data for advertising, after the FTC alleged it shared health questionnaire data with ad platforms despite privacy promises.
What is the Hims & Hers case about?
In July 2026 the FTC, Utah and California sued Hims & Hers in federal court in Northern California. Among other things, they allege the company shared health information about medical conditions with advertising platforms, including Meta and Snap, through customer lists and tracking tools that sent visitors' actions on its website, despite privacy promises. The case is pending; these are allegations.
Does the FTC Health Breach Notification Rule apply to my health app or site?
It applies to vendors of personal health records and related entities that aren't covered by HIPAA. The 2024 amendments clarified that many health apps and similar technologies are included, and that unauthorized disclosures can be breaches. Whether your product is covered is a question for counsel.
Is CookieGuard HIPAA compliant?
CookieGuard isn't HIPAA-certified and doesn't sign business associate agreements (BAAs). It's built for consumer health data sites that aren't HIPAA-covered, helping them meet opt-in consent requirements such as Washington's MHMDA, Nevada's SB 370 and Connecticut's health-data rules in the browser.

CookieGuard Healthcare

Separate health-data choices, ad pixels that wait for consent to share health data, and exportable consent records. From $299/month or $2,990/year for 3 websites and 50,000 monthly pageviews, with higher limits by quote.

Get a quoteSee the Healthcare planCheck your site's pixels (free)

Sources

This page is general information, not legal advice, and doesn't create an attorney-client relationship. Whether these laws apply to you, and what they require of you, depends on your business. Confirm both with your own counsel. Last reviewed October 19, 2026.