Nearly three in four major U.S. hospital and clinic websites kept running advertising or marketing trackers even when a visitor's browser explicitly signaled that it did not want personal data sold or shared. That is the headline finding of a new audit of 59 hospital and clinic sites, which found 43 of them, or 73 percent, continued running those trackers despite the opt-out signal being active.
The audit, conducted by Piwik PRO and Verified Data, analyzed up to 25 pages per hospital website using a California-based browser with Global Privacy Control enabled, according to WDBO. Global Privacy Control is a browser-based signal that communicates a user's preference to opt out of the sale or sharing of their personal data, as described by HIPAA Journal. Twelve states currently require certain businesses to honor those requests.
What the Trackers Were Doing
Researchers counted 75 different tracking tools active across the sites they scanned, split between 38 analytics tools and 37 advertising tools, roughly half the total built for advertising rather than basic site analytics, per Piwik PRO's own report on the audit. The same report found Google Marketing Platform on 33 of the 59 sites and Google Analytics on 20, while the audit separately found that 41 of 59 sites, or 69 percent, placed marketing or advertising cookies, the station's report notes. Facebook, Microsoft, and Adobe tools also turned up on hospital websites examined in the audit.
These trackers can collect details like pages viewed, clicks, and device information. Crucially, the audit did not test whether any individual patient's health information was actually passed along to third parties, WDBO reported, and HIPAA Journal similarly noted that the study did not investigate whether protected health information was being disclosed. The findings describe which tools were running and whether they responded to opt-out signals, not what specific data, if any, left a given hospital's site about a given visitor.
A Pattern That Predates This Audit
This is not the first time hospital trackers have drawn scrutiny. A Rutgers-led study that reviewed 12 years of website data from 1,201 hospitals found that 66 percent used third-party tracking pixels, and reported that pixel use kept climbing through 2023, according to Rutgers Business School. The same research found hospitals using third-party tracking pixels were 46 percent more likely to experience a data breach, while hospitals relying on their own in-house analytics tools showed no comparable increase in breach likelihood.
Back in 2022, The Markup found the Meta Pixel sending Facebook a packet of data whenever someone clicked a button to schedule a doctor's appointment on 33 of the top 100 U.S. hospital websites it tested. On five of seven health systems where it found the pixel installed inside password-protected patient portals, The Markup documented it sending Facebook data tied to real patients. Rutgers Business School's report also pointed to real-world fallout from that era: Advocate Aurora Health disclosed in 2022 that tracking pixels on its website had exposed data from roughly 3 million patients, and Community Health Network disclosed a pixel-related breach affecting about 1.5 million patients the following year.
Where the Legal Line Sits
The federal government has weighed in on hospital tracking before. The U.S. Department of Health and Human Services issued a 2022 bulletin that it said highlighted HIPAA obligations for covered entities and business associates using online tracking technologies, according to the agency. HHS's own guidance page notes that a federal court later vacated that guidance specifically where it treated HIPAA obligations as triggered simply because an online tool linked an individual's IP address to a visit to an unauthenticated public webpage about a specific health condition or provider — a narrow carve-out, not a wholesale reversal of hospital tracking rules.
Hospitals still need a permitted reason to share protected health information through tracking tools, and some disclosures require a HIPAA-compliant authorization. Improper sharing of patient information can expose hospitals to regulatory investigations, financial penalties, lawsuits, and reputational damage, and HHS has warned that hospitals remain responsible for protecting patient information when they use third-party tracking technologies, regardless of who built the tool.
Why This Keeps Happening
Part of the problem may be inertia rather than intent. Healthcare organizations often inherit their analytics setup rather than actively choose it, Brian Clifton said in comments tied to the audit. Even where hospitals use cookie consent platforms meant to stop certain trackers when users decline, those tools only work if they are configured correctly — and the audit's findings suggest many are not catching every advertising or marketing tool running in the background.
The audit's authors recommend hospitals remove advertising pixels from pages dealing with medical conditions, appointment booking, and patient portals, and configure their sites so that a do-not-sell-or-share signal actually switches trackers off rather than just displaying a banner. They also recommend hospitals review which tracking tools operate on their sites, what information those tools collect, whether tracking providers receive patient data, and whether business associate agreements are required as a result.
What Visitors Can Do
Not every browser handles Global Privacy Control the same way. Brave and DuckDuckGo enable it automatically, while Firefox users can turn it on in settings, and Chrome and Safari users can add it through a browser extension such as Privacy Badger. Incognito mode will not help here; it only hides browsing history from others who share the same device and does not block website trackers.
Piwik PRO's report also counted 19 enforcement cases involving healthcare tracking tools between 2023 and 2025 that resulted in more than $100 million in penalties, underscoring that regulators have already begun pursuing cases in this space. The timing adds some weight to the findings: millions of Americans are currently weighing health insurance choices for 2027, with Medicare open enrollment running through December 7 and marketplace enrollment underway through January 15, meaning many people are actively researching hospitals and health plans online right as these tracking questions resurface.
