Tracking Pixels on US Hospital and Telehealth Sites in 2026: Meta Left, the Ad Trackers Didn’t

Hospitals: Meta is gone, Google is not

We could test 80 of the 99 hospitals in The Markup’s 2022 sample. The other 19 blocked our test browser or failed to load.

In 2022, 57 of those 80 had the Meta Pixel on their homepage. Now three load it at all: UAB Hospital, UCHealth (University of Colorado Hospital) and UT Southwestern, where it sits on the university homepage rather than the booking pages.

The change is real. It followed a wave of class actions, a 2022 HHS warning about tracking technologies and dozens of hospitals reporting their pixels to HHS as breaches of patient data (you can search those reports in our Healthcare Data Breach Lookup).

What replaced Meta is mostly Google, plus a list of less famous names. 26 of the 80 hospital sites sent requests to at least one advertising or ad-measurement company before we touched the cookie banner, 24 of them on the homepage itself:

• Google (ad and remarketing endpoints, DoubleClick): 17 sites
• Microsoft Advertising and The Trade Desk: 5 each
• Adobe Advertising, LinkedIn and Comscore: 4 each
• Meta: 3

A homepage visit says little about you. A booking page says more, and 18 hospitals sent the address of an appointment or doctor page to an advertising, data-broker or session-replay company. Some share a website, so that is 14 websites.

Ten of them sent it to Google’s advertising endpoints (remarketing, conversion tracking or DoubleClick Floodlight): UT Southwestern, UCHealth, Keck Medicine of USC, UVA Health, UAB, Mercy St. Louis, M Health Fairview (University of Minnesota), Ohio State Wexner, the University of Maryland Medical Center and UMass Memorial. UVA, Ohio State and Nebraska Medicine also sent it to Microsoft Advertising; UVA’s request carried the page title, “Request an Appointment”. UAB’s went to MNTN as well, a company that sells TV-style ads on streaming services.

The rest went to Comscore, an audience-measurement company, on Cleveland Clinic’s appointment pages (one website, four of the hospitals in the sample), and to session-replay tools: Hotjar on Northwestern Medicine’s doctor pages, Contentsquare on UnityPoint Health’s.

A page address can be mundane (“/make-an-appointment/”) or specific (“/doctors/” followed by a physician’s name). Either way, the company that receives it learns that someone in your browser was looking to book care at that hospital, and an ad company can tie that to the cookie or device profile it already keeps.

The Markup’s 33, four years later

These are the hospitals that sent the click on their appointment button to Meta in 2022. We could test 29. None sent anything to Meta from their booking pages this time. Three still sent data to another ad company from the booking flow: NewYork-Presbyterian (Google), UT Southwestern (Google, Simpli.fi) and El Camino (Simpli.fi).

Why Meta sometimes only sees the domain

Where Meta’s pixel is still present, it doesn’t always get the full address. On UAB’s and UT Southwestern’s pages, the Meta requests carried only the domain. That matches a rule Meta introduced in January 2025: data sources it classifies as health and wellness fall under a “core setup” restriction, which stops custom parameters and everything in a URL after the domain from being shared (Search Engine Land). The hospitals still load Meta’s code.

A Google endpoint nobody explains

On 24 sites in our sample, Google received the page address and title through google.com/ccm/collect. Google doesn’t document this endpoint. People who debug tags describe it as a delivery route shared by Google Analytics, Google Ads and Floodlight (Event Watcher).

The requests we recorded carried an ID called auid. We matched it to the _gcl_au cookie, which Google lists among its advertising and measurement cookies for Google Ads, Campaign Manager and Display & Video 360. That is suggestive, not proof, so we don’t count this endpoint as advertising anywhere on this page. For UC San Diego Health, OHSU, Penn State Health, Hims and One Medical it was the only route by which the address of a booking, condition or sign-up page left the site. Our dataset has a separate column for it.

Ad trackers aren’t the only ones listening

Session-replay tools, which record clicks, scrolling and sometimes typing to replay a visit, ran on 9 hospital sites (Hotjar and Microsoft Clarity on three each). We saw a consent tool load on 28 of the 80 hospital sites and none on the rest.

Hospitals have also moved to “HIPAA-compliant” analytics. Piwik PRO ran on 18 sites, Freshpaint on 12, Tealium on 8. Some of these tools forward data to ad platforms from their own servers, which no browser can see. Four hospitals used server-side tagging too. So “no ad tracker seen” in our tables means exactly that, and no more.

Telehealth and online pharmacies: the page you read goes along

Telehealth companies sell straight to consumers, and their websites are built like any online shop’s. We tested 27 of 33 sites; GoodRx, Hers, CVS, Zocdoc, Headway and Brightside blocked our test browser.

14 of 27 sent requests to advertising companies before consent, 13 on the homepage. Meta’s pixel loaded on six: Hims, Lemonaid, Noom, WeightWatchers, Henry Meds and Mochi Health.

On 10 sites, the address of a condition page or sign-up screen went to advertising, data-broker or session-replay companies:

• WeightWatchers: the GLP-1 program page reached 14 companies, among them Criteo, Google, Microsoft, OpenAI, Pinterest, Reddit, Snap, Spotify, Taboola, The Trade Desk, TikTok and the data broker LiveIntent. The site also called Experian, LiveRamp, Lotame, TransUnion and Claritas.
• Mochi Health: the medications page and the eligibility check went to 14, including Meta, Amazon, TikTok, X and Hotjar.
• Henry Meds: the GLP-1 weight-management page went to 10, including Meta (through the Referer header), Snap, Reddit, X and Pinterest. The Meta event fired on that page is called “Yellow”. Marketing advisers tell health brands to give their events coded names that reveal nothing about health, and someone took the advice.
• Noom: the clinical intake went to six ad companies.
• Lemonaid: the weight-loss page went to Microsoft, Reddit, Spotify, TikTok and Viant.
• Talkiatry: the depression page went to Google; the assessment screen to TikTok and Snap.
• Walgreens: the virtual-care weight-loss page went to Google and Epsilon, a data broker.
• Call-On-Doc: the erectile dysfunction page went to OpenAI (chapter 3).
• Cerebral: no ad company at all, but Contentsquare’s session replay received the intake page.
• Found: the Ozempic page went to MNTN.

Companies with a record

Several of these companies have already paid, or are in court, over exactly this.

Hims & Hers was sued by the FTC, Utah and California on July 29, 2026. The complaint alleges that Hims shared health information with Meta, Snap and others through customer lists and through tracking technology that reported visitors’ actions on its website (FTC). On November 10, Arizona, Florida, Nebraska, Ohio and Wisconsin joined the case (FTC). Hims denies the allegations. On its erectile dysfunction page we saw 14 ad companies load. Meta received a “ViewContent” event with a hashed category, not the page address in readable form, and Google’s undocumented endpoint received the title, “Erectile Dysfunction Treatment for Men”. With Global Privacy Control on, every ad tracker stayed off.

Call-On-Doc and Lemonaid settled pixel class actions (table in chapter 5). Both still load ad trackers; Lemonaid’s weight-loss page reached five ad companies.

LifeStance agreed in its settlement to drop tracking tools that aren’t HIPAA-compliant for five years. Two TV-ad measurement pixels (Point Media and Bliss Point) still load on its pages, including the depression page and the booking page, but neither received the address of those pages.

BetterHelp, Monument and Cerebral are under FTC orders from 2023 and 2024; Cerebral’s bans it from using health information for most advertising (FTC). None of the three loaded an ad tracker in our test. Ro, Nurx, Teladoc, MDLive, PlushCare, Sesame and Mark Cuban Cost Plus Drugs didn’t either.

OpenAI's new ad pixel, on an erectile dysfunction page

OpenAI opened its ChatGPT ads to all US businesses in May 2026, with a measurement pixel that advertisers put on their websites. We found it on two sites in our sample, Call-On-Doc and WeightWatchers.

OpenAI’s developer documentation says the pixel “adds the current page origin as source_url” (OpenAI). An origin is the site itself, such as https://www.callondoc.com.

That is not what we recorded. The pixel’s first event on each page went to bzr.openai.com with the full address:

• source_url: https://www.callondoc.com/en/erectile-dysfunction, with referrer_url /en/consultation
• source_url: https://www.weightwatchers.com/us/how-it-works/glp-1-program, with referrer_url /us

The same documentation says the pixel treats measurement consent as granted unless the website switches it off. On both sites it fired before we did anything with the cookie banner.

We can’t tell from the outside whether OpenAI stores these addresses or drops everything after the domain on arrival, as Meta does for health advertisers. Either the documentation is out of date, or the pixel sends more than it says. On Call-On-Doc it kept firing with Global Privacy Control on; WeightWatchers switched off all its ad trackers.

Global Privacy Control: hospitals mostly ignore it

Global Privacy Control (GPC) is a signal your browser sends to every site: don’t sell or share my data. About a dozen states, California and Colorado among them, require the businesses their privacy laws cover to treat it as an opt-out (California Privacy Protection Agency).

On hospital sites it made almost no difference. 25 of the 26 hospitals that loaded ad trackers loaded them with GPC on too. Only Penn Medicine’s site stopped.

Telehealth sites did better, and still not well. Of the 14 with ad trackers:

• 4 stopped all ad tracking: Hims, Talkspace, WeightWatchers and Keeps.
• 5 cut the list: Henry Meds went from 9 ad companies to 2, Talkiatry from 6 to 3, Walgreens from 4 to 2, Call-On-Doc from 3 to 2 and Found from 2 to 1.
• 5 changed nothing: Lemonaid, LifeStance, Mochi Health, Noom and One Medical.

Two things soften the hospitals’ result. Our test browser connected from Ohio, which has no general privacy law, and sites may honor GPC only for visitors from states that require it. And most of these hospitals are nonprofits, which many state privacy laws don’t cover at all. Of the 20 state privacy laws in force, only 6 cover nonprofits without exempting HIPAA-covered organizations as a whole: Colorado, Oregon, Delaware, New Jersey, Minnesota and Maryland. Our state privacy law checker shows who each law covers.

What the law says, and what courts have done

Whether any of this breaks a law depends on who runs the site, which page it is, where you live and what the companies do with the data. We don’t claim that any site in our test broke the law. We report what the browser sent.

Hospitals and HIPAA. In 2022 the HHS Office for Civil Rights told hospitals that sending an IP address together with a visit to a page about a condition or a doctor could be a disclosure of health information. A federal court in Texas struck down that part of the guidance in June 2024, and HHS dropped its appeal in August 2024 (American Hospital Association). The guidance still applies to patient portals and other pages behind a login, which we didn’t test. Public booking pages are now a grey area.

Telehealth and the FTC. Many telehealth companies fall outside HIPAA for what happens on their marketing pages. The FTC has stepped in with the FTC Act and its Health Breach Notification Rule: GoodRx and BetterHelp in 2023, Monument and Cerebral in 2024, Hims & Hers now.

Washington’s My Health My Data Act. In force since March 2024, it requires consent before a company collects or shares “consumer health data”, covers nonprofits as well as companies, and lets people sue (RCW 19.373). Health information already protected by HIPAA is excluded.

Class actions. Most pressure has come from private lawsuits under wiretap laws such as the federal Electronic Communications Privacy Act and the California Invasion of Privacy Act. Settlements are getting bigger:

If you used GoodRx before April 20, 2024, you can still file a claim in its settlement until December 29, 2026.

What you can do

You can’t see these requests without developer tools, and you can’t fix a hospital’s website. You can make your browser give away less.

• Turn on Global Privacy Control. Brave and the DuckDuckGo browser send it by default. In Firefox, switch on “Tell websites not to sell or share my data” under Settings, Privacy & Security. Chrome, Edge and Safari need an extension such as the EFF’s Privacy Badger or DuckDuckGo Privacy Essentials. Check it at globalprivacycontrol.org. From January 1, 2027, California’s AB 566 requires every major browser to offer a built-in opt-out signal. Our test shows its limit, though: most hospital sites ignore it.
• Block the trackers instead of asking. Brave’s Shields, Firefox’s Enhanced Tracking Protection set to Strict and the uBlock Origin extension block requests to known tracker domains in your browser. They don’t depend on the site honoring anything. We didn’t test them, so we can’t say how much each one catches on these sites.
• Don’t rely on a private window. It deletes cookies when you close it, but the page address still goes out while you browse. A VPN changes your IP address, and the address of the page still reaches the same companies.
• Book by phone or through the portal app when the subject is sensitive. We didn’t test portals or apps, so this is about fewer third parties, not none.

How we tested, and what we can't see

Samples. Sample A is the 99 hospitals in The Markup’s 2022 “Pixel Hunt” dataset, built from Newsweek’s list of the top 100 US hospitals (data as of June 15, 2022). We kept it unchanged so the two years can be compared. Sample B is 33 telehealth and online pharmacy sites we chose before testing: companies that faced FTC action or pixel lawsuits since 2023, plus the best-known brands in each category (mental health, weight loss, sexual health, pharmacies, general telehealth).

Pages. For hospitals, the homepage, the page its main “schedule” or “find a doctor” link leads to, and the page after clicking the first visible booking button there. For the 36 hospitals where The Markup recorded a scheduling page, we also tested that address and its button again. For telehealth, the homepage, one condition or medication page (depression, GLP-1, erectile dysfunction, birth control, sertraline and similar) and the first screen of the sign-up or intake form, loaded but not filled in. Amwell, K Health and Amazon Pharmacy: homepage only.

Browser. Headless Chromium 153 with a new profile for every site, a Chrome-on-Linux user agent and a 1366 by 900 window, on a cloud server with a US IP address in Columbus, Ohio. At most four sites at a time, each page loaded once per pass. First pass 09:59 to 10:31 UTC on November 15, 2026; second pass, with the Sec-GPC: 1 header and navigator.globalPrivacyControl set, 10:31 to 10:54 UTC.

What we counted. Every request to a third party, sorted by our own map of 113 tracker endpoints into advertising and ad measurement, data brokers and identity, session replay, analytics, server-side tagging and tag managers (tag managers and consent tools don’t count as trackers). “Received the page address” means the path of the page appeared in the request’s URL, its body or its Referer header. google.com/ccm/collect is reported separately and never counted as advertising. Adobe’s Experience Platform endpoint (adobedc.demdex.net) counts as analytics, Adobe Audience Manager’s ID sync as identity and only Adobe Advertising (everesttech.net) as advertising. “Sent requests to” includes loading a company’s tracking script, which already hands over your IP address and browser details.

Not tested. 19 hospitals and 6 telehealth sites. Blocked our test browser (bot protection): Johns Hopkins Hospital, Johns Hopkins Bayview, all four Mayo Clinic sites (Rochester, Jacksonville, Phoenix, Eau Claire), University of Michigan, University of Washington, Yale New Haven, UNC Hospitals, UNC REX, IU Health West and North, Penn Medicine Chester County, Anne Arundel, Torrance Memorial, CentraCare St. Cloud, GoodRx, Hers, CVS, Zocdoc, Headway and Brightside. Failed to load: Memorial Hermann. Crashed in the browser: Sharp Memorial. We didn’t try to get around the blocks.

Limits.

• A browser sees only what the browser sends. Server-side tagging, Meta’s Conversions API and “HIPAA-compliant” intermediaries can pass data to ad platforms out of sight, so “none seen” is not “none”.
• One visit per page and pass. Ad scripts vary from load to load, so a rerun could show a company more or less.
• Public pages only, logged out. No patient portals, no apps.
• One location. Sites that act on consent or GPC only for some states may behave differently for you.
• We know what was sent, not what the receiving company kept or did with it. “Received” does not mean “broke the law”.

Download: our dataset (CSV), one row per site with the pages tested, ad companies on any page and on the sensitive pages, who received the page address, Meta events, session replay, data brokers, consent tools, server-side tagging and the GPC result. Free to use with credit to PrivacyAffairs. We plan to repeat the test every year with the same hospitals.