Are Meta and Google tracking pixels HIPAA compliant?
No pixel is HIPAA compliant on its own. What the Meta Pixel and Google tag send, what HHS and the FTC have said, the GoodRx and BetterHelp cases, and what to use.
Written for growth, marketing and compliance leads at telehealth brands, clinics and DTC health programs running paid ads
No. Neither the Meta Pixel nor the Google tag is HIPAA compliant by itself, and neither Meta nor Google signs a business associate agreement (BAA) that would let you send protected health information (PHI) through them. Meta’s own terms forbid sending it health information at all, and Google says it does not offer a BAA for Google Analytics.
That does not mean a health brand cannot advertise on Meta or Google. It means the browser pixel should not sit on pages where patients answer health questions, and conversions should reach the ad platforms another way: from your server, with chosen fields, hashed, and only for people who consented.
This guide covers what a pixel actually sends, what Meta and Google say in their own terms, what HHS and the FTC have done about it, and what to use instead.
What is a tracking pixel?
A tracking pixel is a snippet of code from an ad or analytics platform that runs in the visitor’s browser. It started as a one-pixel image. Today it is JavaScript. The FTC’s Office of Technology describes pixels as “a broad range of HTML and JavaScript embedded in web sites” that can be hidden from view.
The two most common in health marketing:
- The Meta Pixel, which reports page views and events (lead, purchase, custom events) to Meta for ad measurement, optimization and audiences.
- The Google tag (gtag.js, often loaded through Google Tag Manager), which reports to Google Ads and Google Analytics.
Both are built for ecommerce. They are designed to send as much context as possible, because more context makes ad targeting better. On a shoe store that is the point. On an intake flow it is the problem.
What a pixel sends from a health page
The FTC’s write-up lists what pixels can collect: specific items a user purchased, “information users have typed within a form while on the site”, page views, clicks and ad interactions, and identifying details such as an email address that help link activity to a social profile.
Put that next to a typical telehealth funnel:
| What the pixel sees | Example on an intake flow | Why it matters |
|---|---|---|
| Page URL and title | /glp1/eligibility/bmi-result | The URL alone can reveal a condition or treatment |
| Event name | Lead_GLP1_Qualified | Names the condition and the outcome |
| Form fields (automatic matching) | Email, phone, date of birth | Ties the health context to a person |
| Browser and cookie identifiers | Meta and Google cookie ids, IP address | Links the visit to an ad profile |
| Button clicks | ”I take metformin” | Can be a medical answer in itself |
Any one row may look harmless. Together they tell the ad platform that a named person is looking into a specific treatment. That combination is what regulators have focused on.
What Meta and Google say in their own terms
Neither platform positions its pixel as a HIPAA tool. In their own words (we read both pages on October 24, 2026):
| Platform | What it says | What that means for you |
|---|---|---|
| Meta (Pixel, Conversions API) | Meta’s Business Tools Terms say you will not share data that “includes or is based on, directly or otherwise, health information”. Event names, conversion criteria and custom audiences may not imply health information either. | No BAA, and health data is against the terms whether it comes from the pixel or the server. |
| Google Analytics | Google says it “does not offer Business Associate Agreements in connection with this service” and “makes no representations that Google Analytics satisfies HIPAA requirements”. It tells HIPAA-regulated entities to keep PHI away from Google and not to tag authenticated pages. | No BAA. Keep it off logged-in and intake pages. |
| Google Ads | Google’s personalized advertising policy lists health as a sensitive interest category: advertisers “are unable to use advertiser-curated audiences” (remarketing lists) for it. | Remarketing on health conditions is off the table regardless of HIPAA. |
Two things follow. First, a BAA is not something you can buy your way into here. Second, Meta’s rule is about health information, not only HIPAA PHI, so it applies to cash-pay DTC brands that are not covered entities too. Our list of which marketing tools sign a BAA covers 40 more vendors.
What HHS and the FTC have done
HHS: the tracking technologies bulletin
The HHS Office for Civil Rights issued a bulletin on online tracking technologies for HIPAA covered entities and business associates, and revised it on March 18, 2024. In July 2023 the FTC and HHS sent a joint letter to approximately 130 hospital systems and telehealth providers naming the Meta/Facebook pixel and Google Analytics as technologies that “can track a user’s online activities”.
On June 20, 2024, a federal court in Texas ruled in American Hospital Association v. Becerra. It vacated one part of the bulletin: the part that treated an IP address combined with a visit to an unauthenticated public page about a health condition or provider as protected information. The court said the vacatur should not be read as limiting the rest of the guidance.
What that leaves in practice: a public blog post about weight loss is in a grey zone. An eligibility quiz, a booking page, a patient portal or an intake form, where a person types answers about their own health, is not. That is where most pixels on telehealth sites fire their most valuable events.
FTC: GoodRx and BetterHelp
The FTC enforces against companies outside HIPAA, which includes many DTC health brands.
- GoodRx (February 2023). The FTC’s first action under the Health Breach Notification Rule. The FTC said GoodRx shared users’ prescription medications and health conditions with Facebook, Google, Criteo, Branch and Twilio, contrary to its privacy promises. The proposed order carried a $1.5 million civil penalty.
- BetterHelp (March 2023). The FTC said BetterHelp disclosed email addresses, IP addresses and health questionnaire answers to Facebook, Snapchat, Criteo and Pinterest for advertising, and gave Facebook the fact that users had previously been in therapy so it could find similar people to target. BetterHelp agreed to pay $7.8 million for consumer refunds.
The FTC’s guidance on the Health Breach Notification Rule is explicit that “a breach is not limited to cybersecurity intrusions”: sharing covered information without the person’s authorization triggers notification duties. The rule was amended in July 2024 to make clear that health apps are covered.
The pattern in both cases is the same one a default pixel setup produces: questionnaire answers and identifiers flowing to ad platforms from the browser.
What to use instead
You still need conversions in Meta and Google, or their bidding has nothing to learn from. The fix is to change who sends them and what is in them.
1. Take the pixel off health pages. Keep the Meta Pixel and Google tag, if you use them at all, on marketing pages that ask nothing personal. Remove them from quizzes, intake, booking, checkout and any logged-in page. Check Google Tag Manager for tags that fire on “all pages”.
2. Send conversions server-side. Meta’s Conversions API and Google’s Enhanced Conversions accept events from your server. Your server decides which fields go out, so the page URL, the answers and the condition never leave. Our guide to server-side conversion tracking for healthcare walks through the setup.
3. Send the minimum, hashed. A conversion needs an event, a time, a click id and a match key. Google says Enhanced Conversions hash first-party data such as email and phone with SHA-256 before it reaches Google. Hash everything you send, and send nothing else.
4. Use neutral event names. “Lead” and “Purchase”, never “GLP1_Qualified” or “Anxiety_Intake_Complete”. Meta’s terms apply to event names and audience criteria too.
5. Gate on consent. Only send an event for a visitor who agreed to ad tracking. Record the consent with a timestamp.
6. Put a BAA-covered layer in between. If you are a covered entity, the system that receives intake answers and builds the conversion must sign a BAA with you. The ad platform then receives a de-identified event it is allowed to have.
| Browser pixel on intake | Server-side through a BAA-covered layer | |
|---|---|---|
| Who sends the event | The visitor’s browser | Your server |
| Page URL and answers | Sent by default | Never sent |
| Identifiers | Raw form fields via automatic matching | SHA-256 hashed, chosen fields only |
| Consent | Often fires before the banner is answered | Only consented visitors are sent |
| BAA | Not available from Meta or Google | Signed by the layer that holds PHI |
How to do it in PathwAI
PathwAI is an AI-native patient acquisition platform: an agent builds the intake flow, eligibility quiz and checkout from a plain-English description, the team reviews and approves it, and a built-in Data Platform handles conversion tracking. It is built so the setup above is the default rather than a project.
- No third-party ad pixels in the flow. The Data Platform uses first-party cookies only, and its script loads from your own domain.
- Server-side conversions. Events go to Meta through the Conversions API, to Google Ads through Enhanced Conversions and Customer Match, to TikTok through the Events API and to Microsoft Ads as offline conversions. See the Meta and Google Ads integration pages.
- Hashed and stripped before anything leaves. Email and phone are SHA-256 hashed. PHI such as date of birth and condition is removed. Ad platforms receive hashed identifiers only, and only for visitors who consented.
- Consent as a step. Consent is a first-class step in the flow, timestamped and stored with the intake data. Your clinical or legal team reviews the wording.
- Attribution without the pixel. Click ids (gclid, fbclid, msclkid) and UTMs are captured on the visit, so a conversion is credited to the ad, campaign and keyword.
- A BAA on Enterprise. PathwAI signs a BAA on the Enterprise plan. It does not sell PHI or use it for advertising. More on the HIPAA page.
Checklist
- List every page where the Meta Pixel or Google tag fires, including through Tag Manager.
- Remove both from quiz, intake, booking, checkout and logged-in pages.
- Turn off automatic advanced matching on any pixel that stays.
- Rename events and audiences so none implies a condition or treatment.
- Send conversions server-side with SHA-256 hashed identifiers only.
- Send only for visitors who consented, and keep the consent record.
- Get a signed BAA from every vendor that receives intake answers, if you are a covered entity.
- Have counsel check your state health privacy laws and the FTC Health Breach Notification Rule.
Frequently asked questions
Will Meta sign a BAA for the Pixel or Conversions API?
No. Meta’s Business Tools Terms say you will not share data that includes or is based on health information. That applies to both the browser pixel and the Conversions API, so what you send server-side must also be free of health information.
Is Google Ads HIPAA compliant?
Google does not offer a BAA for Google Analytics and says it makes no representation that Analytics satisfies HIPAA. For Google Ads, send hashed conversions through Enhanced Conversions from a system that has removed PHI, and note that health is a restricted category for remarketing audiences.
Is the pixel fine on my homepage?
It is a lower-risk place than an intake form, and the June 2024 court ruling narrowed HHS’s position on public pages. It is still a legal question for your counsel, especially for pages about specific conditions. Most brands keep the pixel off anything that asks a question.
We are cash-pay and not a covered entity. Does this apply?
HIPAA may not, but the FTC Act and the Health Breach Notification Rule can, as GoodRx and BetterHelp show. Meta’s ban on health information in its terms applies whoever you are.
Does hashing the email make it safe to send?
Hashing protects the identifier in transit. It does not remove the health context around it. The event must also be stripped of answers, URLs and condition-specific names, and sent only with consent.