Tracking pixels on clinic websites: what health data you may be sending to advertisers

How a pixel turns a page view into health data

Advertising and analytics tools work by loading code on a website that sends events to the platform: a page was viewed, a button was clicked, a form was submitted. Each event normally carries the page address, sometimes the page title and form field names, and identifiers that link the visit to a browser, a device or a logged-in account on the platform.

On most websites this is ordinary marketing measurement. On a healthcare website it can be something else. A page address such as a booking confirmation for a specific specialty, a treatment page for a sensitive condition or a symptom checker result, combined with an identifier that links to a person, can reveal information about that person’s health. Under the GDPR, data concerning health is special category data, and processing it requires a specific legal basis and strong safeguards.

Where the risk usually sits

The risk is rarely the homepage. It sits in the places where visitor behaviour becomes specific and identifiable. Booking flows are the most common problem, because a confirmation page or event often includes the type of appointment, the doctor or the specialty. Enquiry forms are the second, especially when tools capture form field contents automatically. Patient portals and logged-in areas are the third, because they combine health information with a known identity.

Search features, symptom checkers, pricing calculators for specific treatments and chat widgets can also leak information through page addresses, event parameters or conversation data. Automatic features such as enhanced conversions, advanced matching or session recording can make the problem worse, because they collect more than a basic page view.

Booking flows

Appointment types, specialties and confirmation events can reveal health information.

Enquiry forms

Automatic capture of form fields can send symptoms or conditions to third parties.

Patient portals

Logged-in areas combine health information with identity.

Chat and search

Queries and conversations can contain sensitive details.

What regulators have made clear

European data protection authorities have taken action against organisations whose tracking technologies sent sensitive information to advertising platforms, and healthcare and pharmacy websites are an obvious focus because the data involved is so sensitive. Consent banners do not solve the problem on their own. Consent must be valid and specific, and for special category data the conditions are stricter. Many organisations cannot realistically obtain valid explicit consent for sharing health-related browsing with advertising platforms, and should not try.

Healthcare professionals are also bound by professional secrecy, and advertising rules in many countries limit how healthcare services may be promoted. A marketing setup that is technically clever but shares patient information would conflict with those duties as well as with data protection law.

Measuring marketing without exposing patients

The goal is not to stop measuring. Clinics still need to know which campaigns bring patients and which pages help people book. The design principle is to separate marketing measurement from sensitive detail.

Keep advertising pixels off booking flows, enquiry forms, patient portals and sensitive treatment pages. Use generic events, such as a completed booking without the specialty or appointment type, and send them from a server that removes identifiers and sensitive parameters rather than directly from the browser. Aggregate reporting, such as bookings per campaign per week, answers most marketing questions without individual-level data.

Review page addresses and titles as well, because they are often sent with events. A booking confirmation page with a neutral address reveals less than one that includes the treatment name. Disable automatic form capture, session recording and advanced matching features on healthcare sites unless a data protection review has confirmed they are appropriate.

A practical audit

Start with an inventory of every script on the website: analytics, advertising pixels, tag managers, chat tools, heatmaps, booking widgets and embedded videos. Then walk through the most sensitive journeys, such as booking a consultation for a sensitive specialty, and record what each tool sends using browser developer tools.

The findings usually fall into three groups: tools that can stay as they are, tools that need configuration changes, and tools that should be removed from sensitive pages or the whole site. Document the decisions, update the privacy notice and consent configuration, and repeat the review whenever a new marketing tool or website feature is added.

This article describes how we approach healthcare website measurement. It is not legal advice, and clinics should confirm their position with their data protection officer or legal adviser.

Where this sits in what we do

This article covers one decision inside a wider engagement. The solution page sets out how that engagement runs, what it includes and what it costs to find out.

• Digital Growth — The ongoing programme — strategy, content, paid, organic and reporting — run as one thing that answers to pipeline rather than to channel dashboards.
• The EU AI Act: what actually applies from 2 August 2026
• Belgium's B2B e-invoicing mandate: the January 2026 big bang
• UTM parameters without chaos: naming rules, internal links and getting campaign data into the CRM
• WCAG 2.2: the nine new success criteria and what they change on real websites
• All insight articles