OAIC findings on tracking pixels on health websites

The OAIC found Medmate and Monash IVF collected sensitive information via tracking pixels without consent. What the June 2026 findings mean for you.

24 June 202611 min read

On 24 June 2026 the Office of the Australian Information Commissioner (OAIC) announced two determinations finding that telehealth provider Medmate Australia Pty Ltd and fertility provider Monash IVF Pty Ltd interfered with people’s privacy by collecting sensitive information through third-party tracking pixels on their websites. Both determinations are dated 11 June 2026.

The OAIC said the decision establishes that using tracking pixels to track visitors to health-related websites, and then target them with ads on social media, is a collection of sensitive information that requires consent. For any practice running Meta, TikTok, Snapchat or similar pixels, this moves the issue from general guidance to a published regulatory finding about health websites specifically.

Background and later developments: the OAIC first published general guidance on tracking pixels on 4 November 2024, which we covered in an earlier article. The June 2026 determinations apply that thinking to health providers. Since then, on 31 August 2026, the Government released an exposure draft Privacy Act bill that proposes, among other things, that disclosing personal information for direct marketing, which may include disclosures of cookies or pixels in programmatic advertising, would need consent as a “trade”. That draft is not law (see our article on the tranche 2 exposure draft).

What changed

The law did not change on 24 June 2026. What changed is that the Privacy Commissioner made formal findings about how the existing Australian Privacy Principles apply to pixels on health websites. The OAIC published three things together:

Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40, dated 11 June 2026.
Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41, dated 11 June 2026.
A report, “Your life, pixelated: how tracking pixels watch your every click”, by Privacy Commissioner Carly Kind, on the OAIC’s inspection of 50 health service provider websites.

The OAIC described the determinations as concluding a year-long investigation into how the two providers collected sensitive information on websites providing telehealth and fertility services. The report says the Commissioner-initiated investigations were launched in December 2024.

The OAIC’s media release quotes the Privacy Commissioner saying its community attitudes research shows 9 in 10 Australians consider it neither fair nor reasonable to be targeted on the basis of their sensitive health data. The Commissioner also said website providers “must obtain consent where they’re using tracking pixels to collect sensitive information”.

We have not summarised the specific declarations or orders made in each determination. If you want that detail, read the determinations themselves, which are linked from the OAIC release.

What the OAIC found across health websites

The report is where the practical detail sits. In October and November 2024 the OAIC scanned 50 health service provider websites, covering helplines and mental health services, services for children and young people, pharmaceuticals, and health services including insurance, fertility and abortion. Of those websites:

96% used tracking technologies.
52% used a third-party tracking pixel.
77% of those using a third-party pixel did not mention it in their privacy policy.

The OAIC then looked closely at 12 websites. All 12 used more than one third-party tracking pixel, and all used Meta’s pixel. Half used TikTok’s pixel and a quarter used Snapchat’s. The OAIC observed data being sent to social media platforms including the full page URL, website searches, button clicks, date and time stamps and device information. It also saw form fields, including hashed name, address or phone number, being shared and used to match visitors to platform profiles, even when they were not logged in.

The report gives examples of what this can reveal in a health setting: a page URL about mental health, answers clicked in a symptom questionnaire, searches for support services, screening outcomes, and medications added to a cart.

Only 4 of the 12 entities referred to tracking pixels in their privacy policies, and only 2 named the specific social media platform. None of the 12 had done a privacy impact assessment before using pixels. Beyond the two determinations, the OAIC said it had targeted engagement with a further 8 organisations.

Three patterns the OAIC called out

Assuming the data is de-identified. Many organisations told the OAIC that hashing or pseudonymising meant privacy obligations did not apply. The report’s findings on matching to profiles show why that assumption is risky.
Not knowing which pixels are installed. In one case study, a provider whose Facebook page had long been disabled discovered 50 active tracking pixels on its website, added over time by a third-party website vendor.
Underestimating harm. A hypothetical case study describes a person who reads about eating disorders on a health service’s site late at night, then receives related ads on social media within days, including from companies she never dealt with.

Who it applies to

The determinations are about two specific providers, but the reasoning applies to any APP entity that runs pixels on a website where browsing can reveal health information. The OAIC states that the Privacy Act covers health service providers regardless of turnover. That includes GPs, specialists, dentists, allied health, psychologists, fertility and telehealth services, and cosmetic clinics. The OAIC encouraged all APP entities to review their use of third-party tracking pixels.

The report also notes that marketing is often outsourced and separated from privacy teams. If an agency installed your pixels, your practice is still the organisation responsible for how they are used.

What the rules require

The OAIC’s key takeaways for organisations, read with its 2024 guidance, come down to four obligations.

Treat browsing data on health pages as potentially sensitive

The report says every page view can reveal or infer health information, and that visiting pages about conditions such as anxiety or fertility suggests a personal health interest. Under APPs 3 and 6, pixels should be configured to limit collection to the minimum reasonably necessary and to avoid disclosing sensitive information to social media platforms. The OAIC states that sensitive information should only be collected via a tracking pixel with express consent.

Know what is installed and keep checking

Organisations must understand their data flows, document what each tracking technology collects and where it is sent, and review this regularly. The OAIC repeats that pixels are not a “set and forget” tool.

Be transparent and get valid consent

Privacy policies and collection notices must clearly explain the use of tracking pixels. Using or disclosing sensitive information for direct marketing requires consent under APP 7, and the OAIC says consent must be voluntary, specific and informed, from a person with capacity to give it. Where pixels are used to target ads on social media, you must give people a simple way to opt out. The OAIC suggests a banner or pop-up on a first visit that explains the use of third-party pixels for advertising and lets the user opt out.

Note the difference. An opt-out banner addresses the APP 7 opt-out requirement for targeted advertising. It is not the same as express consent to collect sensitive information. The 2024 guidance says opt-out mechanisms are a form of implied consent that is only appropriate in limited circumstances.

Privacy by design

The OAIC strongly recommends that organisations handling sensitive information, or serving vulnerable communities such as children, reconsider their use of tracking tools. It points to first-party marketing, such as email to people who have consented or would expect it, as a more privacy-protective option.

What it means for your marketing

Website

Start with an inventory. Use your tag manager, your site’s source code and a browser tool to list every pixel and tag, which pages it fires on and what events it sends. Then remove advertising pixels from pages about conditions, treatments, symptoms and medications, and from booking and enquiry forms, unless you have a consent mechanism that obtains express consent before the pixel fires. Turn off automatic sharing of form fields and on-page search terms.

Paid social and retargeting

Audiences built from visits to health pages are directly in scope of the OAIC’s findings. If your campaigns retarget people who viewed a treatment page or started a booking, that relies on exactly the data flow the Commissioner found to be a collection of sensitive information. Consider campaigns that do not rely on health-page browsing, such as location or interest targeting set within the platform, and measure results at a level that does not send health detail back to the platform.

Google Ads and analytics

The determinations focus on social media pixels, but the OAIC’s guidance covers third-party tracking pixels generally. Apply the same review to conversion tags, remarketing tags and analytics configured to share data for advertising, and check whether URLs or event names contain health terms.

Email and SMS

The OAIC suggests first-party channels such as email to people who have consented as a more privacy-protective alternative. Tracking pixels can also be used in emails, so check what your email platform tracks and whether that data is shared with advertising platforms.

Privacy policy and notices

If you use pixels, your privacy policy should say so, name the platforms that receive data, describe what is collected and why, and explain any overseas disclosure. Collection notices, such as a banner, should appear at or before the point of collection.

Common mistakes we see

Pixels installed site-wide by a theme, plugin or previous agency that nobody remembers.
Advanced matching or automatic form data sharing left on by default.
Treatment and condition names in page URLs, page titles and event names that are passed to ad platforms.
A cookie banner that loads pixels before the visitor makes any choice.
A privacy policy that says browsing data “cannot identify you”, which the OAIC found was often not the case.
No privacy impact assessment and no record of what each tag collects.

A practical checklist

List every third-party pixel and tag on your site, the pages it fires on and the data it sends.
Remove pixels you do not use, including from old platforms and campaigns.
Stop advertising pixels from firing on health condition, treatment, medication, booking and enquiry pages unless express consent is obtained first.
Disable automatic form field sharing and on-site search tracking for ad platforms.
Check that URLs and event names sent to platforms do not contain health terms.
Add a first-visit notice that explains advertising pixels and offers a simple opt-out.
Update your privacy policy to name each platform and describe what it receives.
Complete a privacy impact assessment before adding any new tracking tool.
Diarise a regular tracking review and ask your agency for a written record of all tags.
Rebuild retargeting audiences so they do not depend on visits to health pages.

How this fits with other rules

Pixels are a privacy issue, but they interact with other regimes. Ahpra’s advertising guidelines and the National Law govern what your ads say, not how the audience was built. The Australian Consumer Law could be relevant if a privacy policy misdescribes what happens to visitors’ data. Under the Privacy Act, the penalty tiers introduced in December 2024 mean breaches of specific APPs, including privacy policy content and direct marketing opt-out requirements, can attract infringement notices, while serious interferences can attract much larger court-imposed penalties. Sensitivity of the information is one of the listed factors in deciding whether an interference is serious.

If the tranche 2 reforms proceed as drafted, targeted social media advertising and online behavioural advertising would be expressly defined as direct marketing, and disclosures for direct marketing may need consent as a trade. That is a proposal only.

Frequently asked questions

Are tracking pixels now banned on health websites?

No. The OAIC has said the Privacy Act does not prohibit tracking pixels, but requires organisations to use them responsibly. On health websites, that means not collecting sensitive information through pixels without express consent, and the OAIC strongly recommends reconsidering their use where sensitive information is involved.

Is a cookie banner enough?

A first-visit banner with an opt-out is the OAIC’s suggested way to meet the opt-out requirement for targeted ads. Collecting sensitive information needs express consent, which an opt-out banner does not provide. The pixel also should not fire until a valid choice has been made.

Our agency says the data is hashed. Does that make it safe?

Not necessarily. The OAIC found that hashed form fields were being used to match visitors to their social media profiles, even when they were not logged in. Many organisations it engaged with wrongly assumed hashed data was outside the Privacy Act.

Which pages are the highest risk?

Pages that reveal a condition, symptom, treatment or medication, symptom checkers and questionnaires, on-site search, booking flows and enquiry forms. The OAIC’s examples include mental health pages, symptom questionnaires and medications added to a cart.

Do we need a privacy impact assessment?

None of the 12 closely inspected organisations had done one, and the OAIC recommends a privacy by design approach supported by a privacy impact assessment before deploying pixels. It is the clearest way to show you considered the risks.

What about Google tags?

The two determinations concerned social media pixels, but the OAIC’s guidance covers third-party tracking pixels generally. Review advertising and remarketing tags from any platform in the same way.

Need a hand?

A tracking review is usually quicker than practices expect, and it is the single most useful privacy check for a health website right now. Our compliance audit includes a full pixel and tag inventory with a page-by-page risk view, and our clinic websites team can rebuild tracking so health pages stay out of ad platforms. If you rely on retargeting, our medical SEO work can help shift demand towards channels that do not depend on it.

This article is general guidance based on the published determinations, report and guidance, not legal advice. Final responsibility for how your website and marketing handle personal information sits with your practice, and complex situations may need independent legal or privacy advice.