If you market a behavioral health program, an addiction treatment center, a fertility clinic or any other sensitive service, you’ve probably had this conversation with your legal team: “What exactly are these tracking tags sending to Google and Meta?”
It’s the right question. Every analytics tag and ad pixel on your site sends information to a third party each time it fires. On most websites that’s harmless. On a page about opioid treatment or a form asking about symptoms, it can expose exactly the kind of information your patients trust you to protect.
Some healthcare brands we work with are weighing whether to remove GA4 from their most sensitive pages and turn off ad pixels entirely. That’s a reasonable instinct, but it isn’t the only option. This guide walks through what the rules actually say, what third parties can see, the specific traps in URLs and click IDs, and the privacy-first tools that let you keep measuring without putting patient data at risk.
A quick note: we’re marketers, not lawyers. This article explains how the technology works and where the risks are, so you can have a better conversation with your legal and compliance team. It isn’t legal advice.
The rules for tracking healthcare marketing, in plain English
There isn’t one healthcare tracking law. There are several overlapping ones, and which apply depends on who you are and what data you handle.
HIPAA and the HHS tracking guidance. In December 2022, the HHS Office for Civil Rights (OCR) published a bulletin on online tracking technologies, and updated it in March 2024. In June 2024, a federal court in American Hospital Association v. Becerra struck down one key part of it: the idea that an IP address plus a visit to a public, unauthenticated page about a condition is protected health information on its own. HHS appealed, then dropped the appeal in August 2024, so that ruling stands.
The rest of the bulletin still applies, and it covers the riskiest spots:
- Logged-in pages such as patient portals are generally treated as handling protected health information (PHI).
- What people type in (form fields, symptom checkers, appointment details) can be PHI on any page, public or not.
- Any vendor that receives PHI needs a signed Business Associate Agreement (BAA) and HIPAA safeguards.
Google won’t sign a BAA for Google Analytics. Google’s own guidance tells customers not to use Analytics in any way that creates HIPAA obligations for Google. In practice, that means PHI must never reach GA4.
The FTC covers brands HIPAA doesn’t. The FTC’s Health Breach Notification Rule applies to health apps and websites outside HIPAA. Its 2024 update made clear that sharing health information without authorization, including with advertisers through pixels, counts as a breach. The FTC has already acted: GoodRx paid a $1.5 million penalty and BetterHelp a $7.8 million settlement in 2023 over health data shared with ad platforms. That July, the FTC and OCR jointly warned about 130 hospital systems and telehealth providers about tracking pixels.
States are adding their own rules. Washington’s My Health My Data Act, in effect since 2024, defines consumer health data broadly enough to include what can be inferred from browsing health-related pages. It requires separate consent before collecting or sharing that data, and it lets consumers sue directly.
Lawsuits are the fastest-moving risk. Even where regulators have stepped back, plaintiffs’ firms continue to bring privacy and wiretap class actions over pixels on healthcare sites. That’s why “the court struck down the guidance” isn’t the end of the story. We saw a rash of these being reported over the summer.
What data a third party can actually see
When a standard analytics tag or ad pixel fires in a visitor’s browser, it doesn’t just send “one page view.” Depending on how it’s set up, the platform can receive all of this:
| What’s sent | Where it comes from | Why it matters on a healthcare site |
|---|---|---|
| IP address | Every request a browser makes | Points to a household or device, and gives an approximate location |
| Full page URL, including anything after the “?” | The page the tag fires on | A path like /services/opioid-treatment/ reveals the condition; query strings can carry form answers or campaign names |
| Page title | The page’s title tag | Often repeats the condition or service by name |
| Referrer | The previous page or site | Can reveal a prior health page or what someone searched |
| Device and browser details | The browser itself | Helps platforms recognize the same person across visits |
| Cookies and IDs | Analytics client IDs, ad click IDs, platform cookies | Link visits over time, and can connect to a person’s logged-in Google or Meta account |
| Events and their details | Clicks, form submissions, site searches | Some setups send form values or site search terms; some pixels can automatically pick up an email or phone number from a form |
Any single item might be harmless. Together, they can tell an ad platform that a specific person read about a specific condition and started booking an appointment. That combination is what regulators, plaintiffs’ lawyers and your legal team are worried about.
URLs and UTMs: keep health information out of every link
URLs travel further than most people realize. Whatever is in a link ends up in analytics reports, ad platforms, server logs and the referrer sent to the next site a visitor clicks to. So the simplest rule your legal team can adopt is: no health information in any URL, ever.
Here’s what that looks like in practice:
| Instead of this | Do this |
|---|---|
| utm_campaign=opioid-detox-retargeting | utm_campaign=c2611-svc04, with the meaning kept in an internal lookup sheet |
| utm_content=depression-quiz-email | utm_content=em-q3-a |
| /thank-you-anxiety-assessment/ | One generic /thank-you/ page for every form |
| A form that adds answers to the URL (e.g. ?insurance=…&condition=…) | Forms that submit with POST, so answers never appear in the URL |
| Site search URLs like ?s=bipolar flowing into GA4 | Turn off site search tracking in GA4, or strip the search term before it’s sent |
| Patient emails or IDs in links (?email=…, ?patient=…) | Never put personal identifiers in a URL |
Your public service pages will still describe your services in their URLs, and that’s fine for SEO. The goal is to make sure nothing about a specific person, such as their answers, their search terms, or which assessment they completed, ever ends up in a link.
The gclid: what Google Ads actually receives
When someone clicks a Google ad, Google adds a click ID called the gclid to the landing page URL (newer variants are called gbraid and wbraid). It looks like a random string. On its own, it doesn’t contain a name or an email. It’s Google’s key to its own record of that click, which already includes the campaign, the ad and the search that triggered it.
When you report a conversion back to Google Ads, whether through the tag or by uploading it from your CRM, the required pieces are small:
- The click ID (gclid, gbraid or wbraid)
- The conversion action, which is the name you gave the conversion in Google Ads
- The date and time of the conversion
Optional fields include a conversion value, currency, an order ID, a consent signal and, with enhanced conversions, a hashed email address or phone number.
So the gclid itself is rarely the problem. The risk is in what you attach to it:
- Conversion names. “Detox intake booked” tells Google what that person sought help for. Use neutral names like “Lead form A” or “Call 60s+”.
- Values and order IDs. Don’t let them encode a service line or diagnosis, such as a different value per program.
- Enhanced conversions. Hashing scrambles an email address, but Google can still match it to a real account. That’s the point of the feature. Sending hashed contact details tied to a sensitive action deserves an explicit yes or no from your legal team before it’s switched on.
- The keyword. Google already knows which search led to the click. That’s on Google’s side regardless of your setup, which is one more reason Google restricts personalized advertising based on health, such as Customer Match and lookalike audiences in sensitive categories.
A conservative setup worth discussing with your legal team: store the gclid with the lead in your CRM, then upload only the click ID, a neutral conversion name and the timestamp, with no contact details.
This goes back into Google Ads as an offline conversion import. Here’s how it works:
- Capture the click ID. When someone clicks an ad, Google adds a
gclidto the landing page URL. A hidden field on your form saves it, and it goes into the CRM with the lead. - Create a conversion action for imports. In Google Ads, go to Goals → Conversions → New conversion action → Import. Choose CRM, files or other data sources, then Track conversions from clicks. Give it a neutral name like “Qualified lead,” not anything that hints at a condition or treatment.
- Upload the file. Go to Goals → Uploads and upload a CSV with just three columns:
- Google Click ID
- Conversion Name
- Conversion Time
You can do it by hand, schedule it from a Google Sheet, or let a CRM integration send it automatically. HubSpot and Salesforce both offer this.
A few things to know:
- Upload within 90 days of the click, or Google won’t match it.
- Some iPhone traffic arrives with
gbraidorwbraidinstead ofgclid. Capture those fields too, or you’ll miss a share of conversions. - Watch the setup prompts. Google Ads will nudge you toward “enhanced conversions for leads,” which uploads hashed emails or phone numbers to improve matching. That’s the step the conservative setup avoids. Uploading only the click ID keeps contact details out of Google entirely. Matching is a bit less complete, but there’s nothing patient-identifying to leak.
- CRM integrations can send more fields than you expect. Check exactly what they send before you turn them on. Some include contact details by default.
Your tracking/privacy options, from most cautious to most capable
You don’t have to choose between “track everything” and “track nothing.” Here are the main approaches, roughly in order from simplest to most sophisticated:
| Approach | What it does | Trade-off |
|---|---|---|
| Remove tags from sensitive pages | No GA4 or pixels on patient portals, forms, assessments and thank-you pages | Nothing leaks from those pages, but you lose conversion data where it matters most |
| Turn off ad pixels, upload conversions instead | Ads are measured by uploading click IDs from your CRM with neutral names and no contact details | Keeps campaign optimization working; your CRM has to capture the gclid with each lead |
| Server-side tagging | The browser sends data to a server you control, which decides what gets forwarded to each platform | Very flexible and powerful, but someone has to configure and maintain it correctly |
| Healthcare privacy platforms | Purpose-built tools that filter, mask or remove sensitive data before it reaches ad and analytics platforms, and sign a BAA | The most complete option, at a higher cost than doing it yourself |
What are “obfuscation platforms”?
This is the term your legal team may hear for the last two options. They sit between your website and platforms like Google and Meta. Instead of the visitor’s browser talking to those platforms directly, data goes to the privacy layer first, which strips or masks things like IP addresses, URLs and contact details, then passes along only what you’ve approved. Because the vendor itself handles the raw data, the ones built for healthcare will sign a BAA.
Three names come up often:
| Platform | What it is | Signs a BAA? | Best fit |
|---|---|---|---|
| Ours Privacy | A healthcare-focused tag manager and data platform. Data is routed through your own domain and sent to destinations server-side, with options to redact or hash sensitive fields first. It keeps ad click IDs like the gclid for attribution | Yes, for every customer | Teams that want a GTM-style tag manager rebuilt for healthcare |
| Freshpaint | A healthcare privacy platform that filters data before it reaches vendors, records that a form was used without capturing what was typed, and adds state-by-state consent controls and privacy-safe ad audiences | Yes | Health systems and multi-location providers that want an all-in-one, managed approach |
| Stape | Hosting for server-side Google Tag Manager. You decide what each platform receives, and its Anonymizer can remove or mask fields in GA4 data before it reaches Google | Yes, on its Custom plan | Teams with in-house or agency GTM expertise who want control at a lower cost |
Two cautions apply to all of them. First, no tool makes you compliant by itself. They’re only as safe as their configuration, and the final decisions about what each platform receives still belong to you and your legal team. Second, even with a privacy layer in place, Google still won’t sign a BAA for GA4, so PHI must be removed before anything reaches it.
A checklist to take to your legal team
Use this to structure your next conversation with legal and compliance:
- Inventory every tag. List each analytics tag, pixel and script, and which pages it fires on.
- Clear the logged-in pages. No third-party tags on patient portals or any page behind a login.
- Protect forms and assessments. Never send what people type. Remove tags from these pages, or route them through a privacy layer with a BAA.
- Keep health information out of URLs. Adopt a neutral UTM naming code, use one generic thank-you page, make forms submit with POST, and turn off site search tracking in GA4.
- Neutralize conversion names. Rename any conversion that describes a condition or service, and decide explicitly whether enhanced conversions are allowed.
- Turn off automatic data capture. Review pixel features that pick up form fields or contact details automatically, and GA4’s form interaction tracking.
- Get BAAs in place with any vendor that could receive PHI, and confirm which services each BAA covers.
- Check consent requirements, including state laws like Washington’s My Health My Data Act.
- Review audience targeting. Don’t use remarketing lists or uploaded customer lists for sensitive health services.
- Re-audit regularly, at least quarterly and after any site redesign, new form or new tool.
Measure what matters, safely
Privacy and performance aren’t opposites. With the right setup, sensitive healthcare brands can still see which campaigns bring in real patients without handing health information to ad platforms. We did exactly that for a national behavioral health provider, cutting cost per inquiry 16% with every lead traced from first click to Salesforce.
If your legal team is asking these questions, we’re happy to help you work through them.
Platform Sources