Tracking pixels on a health website: what practices need to know about patient privacy

Ad pixels and analytics tags are standard, but on a health website they can collect sensitive information. Here’s what the OAIC expects and what to check.

6 March 202610 min read

Updated 29 October 2026 to reflect the latest rules and guidance.

Most clinic websites run a handful of small pieces of code in the background: Google Analytics, a Google Ads tag, a Meta pixel, maybe a heatmap tool. They are standard marketing tools, and most practice owners have never thought twice about them.

On a health website, they deserve a second look. The pages a visitor views, the forms they fill in and the buttons they click can all say something about their health. When that information is passed to an advertising platform, the privacy stakes are higher than they are for a cafe or a plumber. The Office of the Australian Information Commissioner (OAIC) published guidance on tracking pixels on 4 November 2024, and in June 2026 it found that two health providers, Medmate and Monash IVF, interfered with people’s privacy by collecting sensitive information through pixels without consent.

What has changed

The OAIC’s tracking pixel guidance (November 2024)

The OAIC’s guidance, Tracking pixels and privacy obligations, makes clear that the Privacy Act doesn’t ban pixels, but the organisation that deploys one is responsible for configuring it lawfully. In its words: “It is the responsibility of the organisation seeking to deploy a third-party tracking pixel” to ensure compliance. Key points include:

Collect the minimum. Organisations should take a data minimisation approach under APP 3, including considering deploying pixels only on certain pages.
Consent for sensitive information. “Sensitive information should only be collected through a tracking pixel with an individual’s express consent.” Opt-out mechanisms are generally not enough for this.
Disclose it. Organisations should clearly disclose their use of third-party pixels in their privacy policy (APP 1) and notify visitors, for example through a banner or pop-up (APP 5).
Overseas disclosure. Where the pixel provider sends data overseas, APP 8 applies.
Targeted ads. Using pixels to target people with ads brings in APP 7, including a simple way to opt out.
Keep reviewing. The OAIC says due diligence “should not amount to a ‘set and forget’ approach”, and recommends a privacy impact assessment.

Higher penalties and infringement notices (December 2024)

The Privacy and Other Legislation Amendment Act 2024 received assent on 10 December 2024, and most of its first schedule commenced on 11 December 2024. It added a mid-tier civil penalty of up to 2,000 penalty units for any interference with privacy, and a lower tier of up to 200 penalty units for breaches of specified APPs, including privacy policy content (APP 1.3 and 1.4) and direct marketing (APP 7), which the OAIC can enforce through infringement notices. A privacy policy that doesn’t mention your pixels, or targeted advertising with no opt-out, now carries a direct risk of a fine.

The OAIC’s health website findings (June 2026)

On 24 June 2026 the OAIC announced two determinations, dated 11 June 2026: Monash IVF [2026] AICmr 40 and Medmate [2026] AICmr 41. The Commissioner found that using tracking pixels to follow visitors to health-related websites and then target them with social media ads is a collection of sensitive information, which requires consent.

The OAIC also published an inspection of 50 health provider websites, scanned between October and November 2024. 96% used tracking technologies and 52% used a third-party pixel, and 77% of those didn’t mention pixels in their privacy policy. Of 12 sites inspected closely, all used more than one pixel, Meta’s pixel was on all 12, and none had completed a privacy impact assessment before deploying pixels.

Why health websites are different

Under Australian privacy law, health information is sensitive information, and it comes with stricter rules about collection, use and disclosure. A page address that names a condition or treatment, combined with an identifier such as a cookie or email address, can start to look like information about a person’s health. The OAIC’s 2026 findings confirm that this is how it sees health-related browsing used for ad targeting.

Private health service providers are covered by the Privacy Act regardless of turnover, so small clinics can’t rely on the small business exemption.

That doesn’t mean you can’t use analytics or advertising tags. It means you should know exactly what is being collected, where it goes, whether patients would expect it and, where health information is involved, whether you have express consent.

What to check on your own site

What tags are installed. List every pixel, tag and tracking script. Your web team or a tag manager audit can produce this in an afternoon.
Which pages they run on. A pixel on your contact page is very different from one on your IVF, mental health or weight management pages.
What each tag receives. Does it see page addresses, page titles, button labels or form details that name a condition or service?
Whether forms are tracked. Enquiry and booking forms are the riskiest place for tracking. Recording that a form was submitted is very different from passing on what was typed into it. Check for automatic features that capture form fields or email addresses.
Whether audiences are built from health pages. Retargeting audiences built from visits to treatment pages are directly in scope of the OAIC’s findings.
Whether your privacy policy matches reality. If your policy says one thing and your website does another, that is the gap to close.
Whether you have consent. If a pixel collects health-related information, you need express consent before it fires, or you need to stop it collecting that information.

Practical ways to reduce the risk

You can usually keep the marketing value and reduce the exposure:

Track conversions, such as a booked appointment, without sending condition names or form contents to ad platforms.
Avoid putting patient details or sensitive service names into page addresses and page titles that tags can read.
Remove ad pixels from sensitive treatment pages, or don’t load them until a visitor has given express consent.
Limit retargeting to broad audiences rather than people who viewed sensitive pages.
Turn off automatic form-field and advanced matching features unless you’ve assessed them.
Use server-side or privacy-conscious tracking setups where they make sense for your practice, remembering that server-side tracking still has to follow the same rules.
Do a privacy impact assessment before adding a new pixel, and review your tags whenever you add a new service, form or booking system.

What it means for each channel

Website

Your website is where pixels live, so this is where most of the work is: the tag audit, consent settings, page-level controls and the privacy policy. Name the platforms in your policy, explain what they’re used for and how to opt out of targeted ads, and mention overseas disclosure.

Paid social and search ads

Advertising platforms have their own rules about health-related targeting. Meta, for example, restricts audience targeting and ad copy that implies it knows something about a person’s health. Under the OAIC’s findings, the bigger issue is upstream: if the audience was built from health page visits without consent, the collection itself is the problem. Review custom audiences, lookalikes based on them and any customer list uploads.

Email and SMS

Email platforms often add tracking to links and opens, and some pass data back to ad platforms. Check what your platform shares, and make sure patient lists uploaded for advertising are covered by consent and your privacy policy.

Booking systems and third-party widgets

Booking engines and chat widgets often have their own tracking settings, or let you add your pixels inside them. Check them as carefully as your own pages, because booking flows can reveal the type of appointment.

Common mistakes we see

A Meta pixel installed years ago by a previous agency, still firing on every page.
Pixels running on treatment pages for sensitive services, feeding retargeting audiences.
Form-tracking features that capture what visitors type.
Page addresses such as /book-ivf-consult/ or /anxiety-treatment-enquiry/ passed to ad platforms on every conversion.
A cookie banner that appears after tags have already fired.
A privacy policy that mentions “cookies” but not the platforms receiving the data.
No privacy impact assessment before adding new tracking.

A practical checklist

Complete a tag audit listing every pixel, tag and script, and the pages each runs on.
Check what each tag receives: page addresses, titles, button labels and form fields.
Remove ad pixels from sensitive pages, or make sure they don’t fire before express consent.
Turn off form-field capture and automatic matching features unless assessed.
Review retargeting audiences and remove any built from health-related page visits without consent.
Update your privacy policy to name the platforms, explain their use, describe overseas disclosure and give an opt-out from targeted ads.
Add a clear notice or consent step that works before tags fire.
Do a privacy impact assessment for current and new pixels.
Repeat the review at least once a year and whenever you add a form, booking system or new service.

How this fits with other rules

The Privacy Act and the APPs set the legal requirements, the OAIC’s guidance explains how they apply to pixels and its 2026 determinations show how it applies them to health websites. Your privacy policy is where much of this is disclosed, and from 10 December 2026 it will also need to describe certain automated decisions under new APPs 1.7 to 1.9. Separately, the statutory tort for serious invasions of privacy, in effect since 10 June 2025, lets individuals sue over serious misuse of their information. Ahpra’s advertising rules govern the content of your ads, and ad platforms’ own health policies sit on top.

Frequently asked questions

Do we have to remove the Meta pixel?

Not necessarily, but you can’t leave it on default settings. Under the OAIC’s guidance and its 2026 findings, a pixel that collects health-related information needs express consent. Many practices remove it from sensitive pages, limit what it sends and only load it after consent.

Do we have to remove Google Analytics?

Not necessarily. Analytics can usually be set up to collect less, for example by limiting data retention, avoiding identifiers and keeping it separate from advertising features. The point is to know what you collect and why.

Is a cookie banner enough?

A banner is only part of the picture. The OAIC has suggested a banner or pop-up as a way to notify visitors and offer an opt-out from targeted ads, but where health information is collected you need express consent, and a banner that doesn’t change what the tags do doesn’t fix the underlying issue.

Who is responsible?

The practice is, even when an agency or web developer installed the tags. The OAIC’s guidance puts the responsibility on the organisation that deploys the pixel. Ask your providers what they have set up, and keep a record.

What did the OAIC decide in the Medmate and Monash IVF matters?

In determinations dated 11 June 2026, the Commissioner found both had interfered with individuals’ privacy by collecting sensitive information through third-party tracking pixels, and that tracking visitors to health-related websites to target them with social media ads is a collection of sensitive information that requires consent.

A simple annual review

Once a year, and whenever you launch a new form or booking system, list your tags, check what each one receives and compare it with your privacy policy. It takes about an hour and saves a lot of explaining later.

Need a hand?

At The Medical Marketers we set up tracking with this in mind: enough to measure enquiries and bookings, without collecting more than the job needs. If you want us to review what is on your website today, our compliance audit can include your tracking setup, and our clinic website service builds it in from the start. For specific questions about your obligations, speak to your indemnity insurer or a health privacy lawyer.

This article is general guidance based on the published rules, not legal advice. Final responsibility for your website’s privacy practices sits with your practice, and complex situations may need independent legal advice.