In June 2026, Australia’s Privacy Commissioner found that two health providers had collected sensitive information through tracking pixels on their websites. That matters to any clinic with a Meta Pixel or TikTok pixel installed.
A pixel is a small piece of code that sends details about each website visit to a third party, such as Meta. Clinics often add one to measure ads or website traffic, and many don’t know exactly what it sends.
So, is your medical website tracking patients illegally? Not by default, but it can be. In this guide, we’ll cover what the regulator decided, what your pixels may reveal, and seven checks you can run on your own site.
The Short Answer
Tracking pixels aren’t banned in Australia. But if a pixel sends health-related visits to an ad platform without consent, your clinic may be collecting sensitive information the Privacy Act protects. Check what each pixel collects, tell patients plainly, and get consent where it’s needed.
Remember, this guide is only for general information, not legal advice.
What the OAIC Found About Tracking Pixels on Health Websites
The Office of the Australian Information Commissioner (OAIC) is the national privacy regulator. On 24 June 2026, it announced decisions against Medmate Australia and Monash IVF. The Commissioner found that tracking visitors to a health website and targeting them with social media ads is a collection of sensitive information. That means the provider must get consent first.
The decisions followed an OAIC scan of 50 health provider websites in late 2024. It found that 52% used a third-party pixel, and 77% of those didn’t mention it in their privacy policy. Law firm summaries say both providers were told to stop using the pixels until proper consent was in place. They also had to delete the sensitive information collected.
Compliance note: The Privacy Act covers private health service providers whatever their turnover, so a small GP clinic isn’t exempt. Health information is sensitive information, and the OAIC says it should only be collected through a pixel with the person’s express consent.
The OAIC is clear that the Act doesn’t ban pixels. But the responsibility for using them properly sits with your clinic, even if a web developer or agency set them up.
What Your Pixels Can Reveal About Patients
A page address alone can hint at why someone visited. A visit to a page about fertility or anxiety can signal a health interest, and the OAIC treats it that way. When it inspected 12 sites, it saw pixels send the full page address, website searches, button clicks, and device details to social media platforms. Some also sent hashed names, addresses, and phone numbers from forms.
Hashing scrambles details into a code, but the platform can still match that code to a profile. So if a visitor was logged in to Facebook or TikTok on that device, their activity could be linked to their account.
Picture a patient who reads about anxiety treatment on your site and leaves without booking. Days later, your clinic’s ads appear in their social feed, and they wonder how you knew. That’s a patient privacy problem, and it can cost you trust.
Why “It’s Anonymous” Doesn’t Protect Your Clinic
Many organisations the OAIC contacted argued that pixel data was hashed, so privacy rules didn’t apply. The OAIC’s guidance disagrees. A hashed email address or IP address can still be personal information if the platform can match it to a person.
Organisations also often didn’t know what was on their site. One health provider found 50 pixels it didn’t need, which had built up over time on a site a vendor managed. None of the 12 organisations the OAIC engaged with had completed a Privacy Impact Assessment before using pixels.
A standard cookie consent banner may not fix this either. Law firm summaries say the Commissioner found a general banner gave too little notice about the pixels in use. Your website privacy policy should also say which pixels you run and what they collect.
Related: Planning a rebuild? See our medical website redesign checklist for what to fix before you relaunch.
7 Checks for the Tracking Pixels on Your Clinic Website
You don’t need to be technical to start. These checks follow the OAIC’s guidance.
- Scan your site. Open your key pages in Chrome with the Meta Pixel Helper, which shows whether a page has a Meta Pixel installed. The OAIC also names free scanners such as Blacklight.
- List every tag and its owner. Write down each pixel, why it’s there, who added it, and where it sends data. Ask your web developer and your Meta ads team for their lists too.
- Remove what you don’t need. If nobody can explain a pixel, switch it off, because the OAIC expects you to collect only what is reasonably necessary.
- Keep pixels off health pages. Page addresses and button text can reveal a condition, so limit pixels to pages that don’t, and avoid passing form fields.
- Ask for consent where it matters. The OAIC generally expects express opt-in consent before sensitive information goes to a platform. On sites where a visit alone reveals health information, it says avoiding third-party pixels may be preferable.
- Update your notices. Name your pixels and platforms in your privacy policy and at the point of collection. Give people a simple way to opt out of targeted ads.
- Review on a schedule. Complete a Privacy Impact Assessment with the OAIC’s PIA tool, then recheck your tags regularly. The OAIC says pixels are not a “set and forget” tool.
If this list turns up surprises, you’re not alone. The OAIC found many organisations weren’t aware of every pixel on their websites.
Ready to Check the Tracking Pixels on Your Clinic Website?
Tracking pixels aren’t illegal in themselves. But the OAIC’s June 2026 decisions show they can breach the Privacy Act when they collect health information without consent. Know what runs on your site, collect only what you need, and tell patients plainly.
Let’s help your clinic take a closer look at how its website is built. At Medical Marketing Australia, we help GP clinics and medical centres with website design and development. We can also talk through what your site is doing today.
Book a consultation if you’d like to review your website’s tracking with our team.
Frequently Asked Questions
Are Tracking Pixels Illegal in Australia?
No. The OAIC says the Privacy Act doesn’t ban them. But they can breach the Act if they collect personal or sensitive information without consent, clear notice, or a good reason. In June 2026, the Commissioner found two health providers had collected sensitive information through pixels without consent.
Does the Privacy Act Apply to a Small Medical Clinic?
Yes. Health information privacy obligations under the Privacy Act apply to private health service providers regardless of annual turnover, including medical practitioners and allied health professionals. If your clinic provides a health service and holds health information, you need to follow the Australian Privacy Principles.
Is a Cookie Banner Enough for Tracking Pixels?
Not on its own, according to law firm summaries of the OAIC decisions. A cookie consent banner may not give enough notice about the pixels you use. Sensitive information generally needs express opt-in consent, and your privacy policy should say which pixels you run.
What Is a Meta Pixel on a Medical Website?
It’s a snippet of code from Meta, the company behind Facebook and Instagram. It records actions such as page views and button clicks and sends them to Meta to measure and target ads. All 12 health sites the OAIC inspected closely used it.
Can My Clinic Still Run Meta Ads?
Yes, but how you track matters. The OAIC suggests considering more privacy-protective options, such as emailing people who have clearly consented. If you do use pixels, keep them off health pages and ask a privacy lawyer to review your setup.
How Do I Find Out Which Pixels Are on My Website?
Install Meta’s pixel helper extension in Chrome and browse your key pages. For other platforms, try a free scanner such as Blacklight, which the OAIC names. Then ask your web developer and your ads team for a full list of the tags on your site.
