On this page
A cookie checker lists the cookies a website sets in a visitor's browser and the domain behind each one, and you can run one yourself in Chrome DevTools. On a healthcare site the cookies that matter come from ad, analytics and session replay vendors, because the scripts that set them can send what visitors view and type to those vendors. Curve Compliance offers a free website scan that takes the next step and lists the tracking scripts themselves, each with a risk level.
Book a call. Found ad cookies on your booking or form pages? Curve Compliance replaces browser ad pixels with one script, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What a cookie checker does
A cookie checker reads what a site has stored in the browser: each cookie's name, the domain it belongs to, when it expires and a few security flags. Online cookie scanners load a page and report the same list. On a health site the list is a clue, not the answer. HHS says “Websites commonly use tracking technologies such as cookies, web beacons or tracking pixels, session replay scripts, and fingerprinting scripts” (HHS). An ad or analytics cookie usually means that vendor's script ran on the site. What matters for patients is what that script sent.
Check cookies yourself in Chrome DevTools
Chrome's own instructions are short: open DevTools, then “Open Application > Storage > Cookies and select an origin.” The table shows each cookie's name and value, its Domain (“The hosts that are allowed to receive the cookie”) and its Expires / Max-Age (“The cookie's expiration date or maximum age”). You can “Use the Filter box to filter cookies by Name or Value” (Chrome for Developers).
For third-party cookies, Chrome says “Third-party cookies are those set by a site that's different from the current top-level page. Third-party cookies have the SameSite=None attribute,” and “You can also find third-party cookies in Network > click request > Cookies” (Chrome for Developers). In Firefox, the Storage Inspector lists “All the cookies created by the page or any iframes inside of the page” (Firefox Source Docs).
- Start clean. Clear the site's cookies first, so you see what each page sets on its own.
- Check the pages that matter. Booking pages, forms and their thank-you pages, condition and service pages, and any logged-in area.
- Note each cookie's domain. Your own domain, an ad platform, an analytics tool or an embedded widget.
- Match names to vendors. The table below covers the common ad and analytics cookies; check others against the vendor's own documentation.
First-party and third-party cookies
MDN explains that a cookie is first-party when its domain and scheme match the page in the address bar, and that “If the domain and scheme are different, the cookie is not considered to be from the same site, and is referred to as a third-party cookie” (MDN). First-party does not mean safe, because ad platforms store identifiers under your own domain too. For the full background, and where Chrome, Safari and Firefox stand in 2026, see third-party cookies on health websites.
Cookies that matter on a health site
Here are common ad and analytics cookies, described by the vendors that set them:
| Cookie | Vendor | What the vendor says | Source |
|---|---|---|---|
| _ga | Google Analytics | The main Google Analytics cookie “enables the service to distinguish one visitor from another and lasts for 2 years” | |
| _gcl_ (prefix) | Google Ads | Cookies starting with _gcl_ “are primarily used to help advertisers determine how many times users who click on their ads end up taking an action on their site”; they “last for 90 days” | |
| _fbp | Meta | “The Meta browser ID value is stored in the _fbp browser cookie under your domain.” | Meta for Developers |
| _fbc | Meta | “The Meta click ID value is stored in the _fbc browser cookie under your domain.” | Meta for Developers |
| _ttp, ttclid | TikTok | Listed as advertising cookies used “To measure and improve the performance of advertising campaigns and to personalize the customer experience (including ads) on TikTok” | TikTok |
If one of these appears right after you load a page that involves PHI, starting from cleared cookies, an ad or analytics script is likely running on that page. Meta, Google Ads and TikTok do not sign a BAA (Meta; Google Ads; TikTok). For what one of those scripts sends, see what the TikTok Pixel sends from a health site and what a tracking pixel is.
From cookies to scripts: run a tracker scan
A cookie list tells you which vendors left something in the browser. A tracker scan tells you whose code runs on the page. Curve's free website scan does the second job. In Curve's words: “Enter a public URL and it loads the page, matches its HTML against 75 known tracking scripts in 11 categories, and lists each one it finds with a risk level.” Its categories include consent management tools such as OneTrust and Cookiebot, alongside ad pixels, analytics, session recording and call tracking.
| Cookie checker | Tracker scan | |
|---|---|---|
| What it lists | Cookies stored in the browser, with domain and expiry | Tracking scripts on the page, with category and risk level |
| Best for | Seeing which vendors stored identifiers on a visitor's device | Seeing which vendors' code runs on the page, and which carry the most risk |
| How to run it | Chrome DevTools: Application, Storage, Cookies | Enter a public URL at Curve's free scan |
Curve's scanner page explains the rating: “Ad pixels, session recording and call tracking scripts carry the highest risk, because they send what visitors view, click and type to the company that runs them.” Want a second pair of eyes on the result? Book a call and Curve's team will review what your website sends to Meta, Google and TikTok with you. To compare free scanners, see free HIPAA website scanners compared, and for a manual method, how to check which trackers your website loads.
Cookie banners are not HIPAA authorization
A cookie checker often turns up a consent tool's own cookies. A banner still does not settle HIPAA. HHS says: “Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization” (HHS). See whether a cookie banner is enough for HIPAA and consent management vs HIPAA authorization.
What to fix
- Ad cookies on pages with PHI. Take the pixel or tag that sets them off logged-in pages, booking flows and forms.
- Session replay without a BAA. Remove it or move to a tool that signs one.
- Health details in URLs. TikTok warns that “URLs and UTM parameters may contain potentially prohibited data” (TikTok); see UTM parameters and PHI.
- Scripts added after launch. Re-run the cookie check and the scan after every site change or new tag.
Use the HIPAA compliant website checklist for the rest of the site. Which rules apply to your pages depends on your setup, so talk to your counsel.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted.
Curve also offers consent management, and session replay and heatmaps under the same BAA. It keeps ad attribution when a patient leaves to book in IntakeQ, Calendly, Acuity, Jane App and other schedulers. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry). Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: Chrome for Developers, View, add, edit, and delete cookies; Firefox Source Docs, Storage Inspector; MDN, Third-party cookies; Google, How Google uses cookies; Meta for Developers, customer information parameters; TikTok, About using cookies with TikTok Pixel; TikTok, About notifications of potentially prohibited data sharing; HHS, Use of Online Tracking Technologies; Curve Compliance, free website scan.
Frequently Asked Questions
What is a cookie checker?
A cookie checker lists the cookies a website sets in a visitor's browser, with the domain and expiry of each. On a health site it shows which ad and analytics vendors' scripts ran on a page.
How do I check what cookies a website uses?
In Chrome, open DevTools, go to Application, then Storage, then Cookies, and select the site's origin; the table lists each cookie with its domain and expiry (Chrome for Developers). Firefox shows the same list in its Storage Inspector (Firefox Source Docs).
Is a cookie scanner the same as a tracker scanner?
No. A cookie scanner lists what is stored in the browser, while a tracker scanner lists the scripts running on the page. Curve's free website scan lists tracking scripts with a risk level for each.
Can cookies send health data to vendors?
A cookie holds an identifier, and the script that set it sends data to its vendor along with that identifier. HHS notes cookies “can also be used to track a user's activities” (HHS), so the question is what the script sends from each page.
Does a cookie banner make a health site HIPAA compliant?
No. HHS says banners that ask users to accept or reject tracking technologies “do not constitute a valid HIPAA authorization” (HHS).
Which cookies should a clinic site look at first?
Start with ad platform cookies such as _fbp, _fbc, _gcl_ and _ttp, then analytics cookies such as _ga, on booking pages, forms and logged-in pages. Those show where ad and analytics scripts run.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the setup, typically live in about a week (Directory entry).
Talk to Curve Compliance
Book a call. Want the ad scripts off your patient pages without losing conversions? Curve Compliance sends conversions to your ad platforms from its own servers, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.