Website Tracker Checker: See What Your Health Site Loads

To see which trackers a healthcare website loads, run Curve Compliance's free website scan, which lists the pixels and trackers on a page, then confirm in Chrome DevTools' Network panel and the ad platforms' own browser extensions, such as Google Tag Assistant and Meta Ads Data Advisor. Check booking, intake and patient portal pages first, because HHS's guidance names scheduling pages, symptom checkers and logged-in portals as places where tracking can reach PHI (HHS). If the check turns up ad pixels, Curve Compliance replaces them with server-side conversions under a BAA it signs on every plan, and Curve's team does the setup.

Book a call. Not sure what your site sends today? Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Book a call with Curve.

Which pages to check first

Meta says most developers add its pixel to the site's “persistent header, so it can be used on all pages” (Meta), so start with the pages where that matters most. HHS's bulletin points to these (HHS):

• Booking and scheduling pages, including embedded widgets. HHS says tracking on a public page that lets people “schedule appointments or use a symptom-checker tool without entering credentials” may have access to PHI. See booking widgets: a PHI leak audit.
• Intake, contact and lead forms. HHS says tracking “might collect an individual's email address, or reason for seeking health care typed or selected by an individual.”
• Thank-you and confirmation pages, where a booking or form ends and conversion events fire.
• Patient portal pages. HHS says tracking on logged-in pages “may even have access to an individual's diagnosis and treatment information, prescription information, billing information” and other portal data.
• Ad landing pages and service pages that lead to a booking.

HHS's page opens with a June 20, 2024 note: in Am. Hosp. Ass'n v. Becerra, a federal court in Texas vacated the part of the guidance saying HIPAA applies when a tool connects a visitor's IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers (HHS). For what still applies, see the HHS tracking bulletin after AHA v. Becerra.

Method 1: Chrome DevTools, Network panel

Chrome's developer tools list every request a page makes, including the ones that go to ad platforms. Chrome notes that “DevTools only logs network activity while it's open,” so open it before you load the page (Chrome).

1. Open the page in Chrome. Press Command+Option+I on a Mac or Control+Shift+I on Windows, then click the Network tab (Chrome).
2. Check Preserve log, so requests stay listed as you move to the booking page, and Disable cache, to “emulate how a first-time user experiences your site” (Chrome).
3. Reload the page. Each row in the log is one request. Right-click the column headers and add the Domain column so you can read who receives each one (Chrome).
4. Open More filters and choose 3rd-party requests. Chrome then shows only “the requests with origin that differs from page origin” (Chrome).
5. To check one vendor, type part of its domain, such as facebook, into the Filter box. Chrome matches the text against “the request URL, domain, hostname, or port” (Chrome). The table below lists the domains Meta and Google publish.
6. Click a request and open the Payload tab, which shows “its query string parameters and form data” (Chrome). Look for page URLs, service names, form answers or email addresses.
7. Fill in your booking or intake form with made-up test details, never a real patient's, submit it and watch which requests fire.
8. If the booking tool is embedded, open the Network panel settings and check Group by frame to see requests from inside each iframe (Chrome).
9. For cookies, open Application, then Storage, then Cookies. Chrome marks third-party cookies there with a warning icon (Chrome).

Vendor	What to filter for	Where the vendor says so
Meta Pixel	connect.facebook.net (the script) and facebook.com/tr (the address in the base code's image tag)	Meta base code
Google tag	googletagmanager.com	Google: “If you see requests to googletagmanager.com, your tag is firing.”
Google Ads	googleadservices.com or googlesyndication.com	Google
Google Analytics	google-analytics.com or analytics.google.com	Google
Floodlight	doubleclick.net	Google
Any other vendor	The 3rd-party requests filter, then read the Domain column	Chrome

Method 2: the platforms' own extensions

Google calls Tag Assistant “a troubleshooting tool that helps you verify the implementation and functionality of tags on your website,” and its Chrome extension lets you “see a list of all the tags that have been implemented on that specific page” (Google). If your site uses Google Tag Manager, Preview mode connects your site to Tag Assistant “so that you can inspect which tags fired and in which order” (Google). Check the container too: Google says a container can replace manually coded tags “including tags from Google Ads, Google Analytics, Floodlight, and 3rd party tags” (Google).

Meta Ads Data Advisor, formerly Meta Pixel Helper, shows a badge with the number of pixel events fired on the page, and Meta says “If the icon does not have a badge on it, no Meta Pixels are installed on the webpage.” Basic detection works without logging in. The extension now runs automated setup too, and Meta says that “Starting August 3, 2026, when you set up a new Pixel through Data Advisor, the option to automatically detect and add standard events is pre-selected during the setup flow” (Meta). On a healthcare site, use it to look, and review any setup or fix it offers before you approve it. See Meta Ads Data Advisor on a healthcare website.

TikTok points advertisers to its own extension: “Download TikTok Pixel Helper in the Chrome Store and check for any errors” (TikTok). Use these extensions to confirm what the Network panel shows for each platform.

Method 3: Curve's free website scan

Curve's free website scan does the listing for you. Enter a public URL and, per the scanner's page, it “loads the page, matches its HTML against 75 known tracking scripts in 11 categories, and lists each one it finds with a risk level.” The categories are advertising pixels, analytics, session recording, marketing automation, chat, visitor identification, A/B testing, call tracking, tag managers, consent management and performance monitoring. The overall rating is critical, high, medium or low. You see the overall risk level straight away and can unlock the full list of scripts with a work email.

You can also run it from an AI assistant: request curvecompliance.com/scan/ with a bare domain and .md on the end, and it returns a markdown report of the trackers found on that site's homepage. To compare scanners, see free HIPAA website scanners compared.

What to do with each finding

What you found	Question to ask	Next step
Ad pixels (Meta Pixel, Google Ads tag, TikTok Pixel, LinkedIn Insight Tag)	Does it load on booking, intake or portal pages, and does the vendor sign a BAA?	The BAA Directory lists Meta, Google Ads, TikTok and LinkedIn Ads as not signing one. See how to remove the Meta pixel and what replaces it.
Analytics	Does the vendor sign a BAA for this product, and do page URLs carry health details?	Look the tool up in the BAA Directory; Google Analytics 4 is listed as not signing one. See UTM parameters and PHI.
Session recording and heatmaps	Does it capture what people type? HHS says session replay records “mouse movements, clicks, and typing” (HHS).	Session replay and heatmap tools compared
Chat and support widgets	Do visitors type health questions into it, and is a BAA in place?	Chat widgets on health sites
Call tracking	Does the vendor sign a BAA on your plan?	Call tracking BAAs by plan
Tag managers	Which tags does the container load, and on which pages?	Open Preview mode and list every tag. See Google Tag Manager in the BAA Directory.
Video and map embeds	Do they load vendor scripts on patient pages?	YouTube and Google Maps embeds
Consent banners	Is the banner being treated as HIPAA authorization?	HHS says banners “do not constitute a valid HIPAA authorization” (HHS). See is a cookie banner enough.

For the definitions behind each row, see what is a tracking pixel. For a full audit, work through the healthcare pixel audit checklist. Which rules apply to each finding depends on your setup, so talk to your counsel.

How Curve Compliance helps

Curve Compliance turns the check into a fix. Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Curve then replaces your browser ad pixels with one script and sends conversions server-side from Curve's servers to the Meta Conversions API, Google Ads, TikTok, Microsoft Advertising, LinkedIn and ChatGPT Ads. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok.

Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted. If the check also finds session recording or a consent banner, Curve offers consent management and session replay and heatmaps under the same BAA. Curve is SOC 2 Type II, signs a BAA on every plan (Directory entry), and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: Chrome, Inspect network activity; Chrome, Network features reference; Chrome, View, add, edit, and delete cookies; Chrome, Open Chrome DevTools; Google, Set up the Google tag with gtag.js; Google, Troubleshoot with Tag Assistant; Google, Preview and debug containers; Google, Introduction to Tag Manager; Google, About Tags; Meta, Meta Ads Data Advisor; Meta, Get started with the Meta Pixel; TikTok, Set up and Verify Pixel; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.

Frequently Asked Questions

How do I check what tracking scripts are on my website?

Open the page in Chrome DevTools, reload it with the Network panel open and filter for third-party requests, or run Curve Compliance's free website scan, which lists the pixels and trackers on a page. Check booking, intake and portal pages first.

Is there a free website tracker checker?

Yes. Curve's free website scan checks a public page and shows the overall risk level straight away, and the full list of scripts unlocks with a work email. Meta calls Meta Ads Data Advisor “a free browser extension” (Meta).

How do I know if a script is safe on a healthcare site?

Ask three questions: does it load on pages where people book, fill in forms or log in, what does its Payload tab show it sends, and does the vendor sign a BAA for that product. In HHS's appointment example, a tracking vendor that receives PHI is a business associate and a BAA is required, so check the BAA Directory for each vendor (HHS).

What is the difference between a pixel and a tag?

Mostly the name. Google says “Tags are segments of code provided by analytics, marketing, and support vendors,” and that the word comes from vendor code often sitting inside HTML script or img tags (Google). A pixel is the image form HHS describes as “a tiny graphic image (usually 1 pixel)” (HHS); see what is a tracking pixel.

Does an ad blocker change what I see?

Yes. Google says “Ad blockers installed in your web browser may prevent the Google tag from running” and “Consent management tools may block Google tags” (Google), and Meta asks you to disable your ad blocker so Data Advisor can detect pixels (Meta). Turn blockers off for the site you check, and test before and after you accept the cookie banner.

Can a tracker hide inside a booking widget?

It can. A booking or form tool embedded in an iframe can load its own scripts, so turn on Group by frame in the Network panel to see each iframe's requests (Chrome). See booking widgets: a PHI leak audit.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, is SOC 2 Type II, and Curve's team does the setup, typically live in about a week (Directory entry).

Talk to Curve Compliance

Book a call. Want to know exactly what your site sends? Curve's team reviews it with you, then Curve Compliance replaces browser ad pixels with server-side conversions, strips PHI before data reaches an ad platform and signs a BAA on every plan. Book a call with Curve.