Told to Remove All Tracking Pixels? How to Still Measure Ads

When legal tells a clinic to remove all tracking pixels, the clinic keeps measuring its ads by sending conversions to the ad platforms server-side, with PHI stripped first, and Curve Compliance sets that up under a BAA: book a call to plan it, and run the free compliance scanner to confirm the pixels are gone. Conversions go from Curve's servers to Meta, Google Ads, TikTok, Microsoft and LinkedIn under neutral event names, booked appointments and calls stay tied to the ad that sent them, and Curve signs a BAA on every plan.

Book a call. Show Curve's team the pages legal flagged and how patients book, and see what each ad platform can receive with PHI stripped first. Book a call with Curve Compliance.

What stops working when the pixels come off

Browser pixels were how Meta, Google Ads, TikTok and Microsoft learned which ad clicks turned into bookings. Remove them and that reporting stops. Google says: "Google Ads only collects data on sites and apps where you have configured tracking" (Google Ads Help). Reported conversions fall, and campaigns set to optimize for a booking lose the signal they learn from.

The link between a click and a result is still there. Google Ads assigns "unique IDs, called Google Click ID (GCLID), for every click that comes to your website from an ad" (Google Ads Help). What changes is the route a conversion takes back to the platform, and what it carries.

If conversions fell and nobody removed anything, check for a restriction first: Meta conversions stopped: restriction or broken tracking?

What to show your legal team

Pixels usually come off because they can send health information to ad platforms that don't sign a BAA. Curve's BAA Directory lists Meta and Google Ads as not signing one (background: why healthcare sites remove the Meta pixel). Any replacement answers to the same terms, which cover server connections too.

Meta's Business Tools Terms list "Meta Pixel, Conversions API, Facebook SDK for App Events, Offline Conversions and App Events API" among its tools. Section 1.h bars data that "includes or is based on, directly or otherwise, health information," and adds: "The names you choose and criteria you establish for your events, conversions, and any custom audiences you create must not reflect, imply or be based on any category of information described in this Section 1.h" (Meta Business Tools Terms, effective November 3, 2025). More in what Meta's terms say about health data.

Google's customer data policy "applies to advertisers using enhanced conversions for web, enhanced conversions for leads, store sales uploads, or Google-engaged audiences." It says "Conversions related to sensitive categories can't be used for measurement in enhanced conversions or store sales (uploads)," and its list of sensitive categories includes "Health or medical information, like purchases of medical services, prescription drugs or medical devices" (Google Ads customer data policies). Those features use customer information, which is one reason the conversion sent to Google carries a click ID, a neutral name and a time, and no contact details.

For HIPAA covered entities, HHS's bulletin on online tracking says: "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI." When an ad platform won't sign one, HHS says the regulated entity "can choose to establish a BAA with another vendor," for example a customer data platform, that de-identifies the tracking information and will "subsequently disclose only de-identified information to tracking technology vendors that are unwilling to enter into a BAA with a regulated entity" (HHS bulletin). That describes a vendor with a BAA sitting between your website and the ad platforms that don't sign one. Curve Compliance works in that position.

On June 20, 2024, a federal court in American Hospital Association v. Becerra vacated one part of the bulletin: the part saying an IP address plus a visit to a public page about a health condition or provider is enough to trigger HIPAA (HHS bulletin). HHS's appeal was dismissed at HHS's request on September 4, 2024 (court docket), and the booking example below still stands. More in the bulletin, annotated. For which rules apply to your clinic, talk to your counsel.

Seven questions legal tends to ask about the replacement, and what to show them:

What legal asks	What to show them
Is there a BAA with the tracking vendor?	Curve signs a BAA on every plan. HHS expects one from every tracking vendor that receives PHI (HHS bulletin).
What does each ad platform receive?	A fixed list of fields per platform.
Do event names reveal anything?	Events go to Meta as generic custom events such as event_1, and every platform can receive neutral names. Meta's terms bar names that reflect health information (Meta).
Are emails or phone numbers sent?	Contact identifiers are off by default on Meta, Google Ads and TikTok.
What if a form or URL leaks something?	Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and flags them so they can be stopped at the source.
Can we see what was sent?	Event Logs show what Curve sent to each platform and what the platform accepted.
Are the old pixels gone?	The free compliance scanner lists the pixels and trackers on a page.

Step 1: confirm the pixels are gone

Start with proof the order was carried out. Run the free compliance scanner on your home page, a service page and your booking page. It lists the pixels and trackers on each page, so you and legal look at the same list. Run it again after any site or tag change.

Step 2: send website conversions server-side

Server-side means the conversion travels from a server to the platform's API, not from the visitor's browser. Each platform has its own route.

Platform	Browser tag you removed	Server-side route	In the platform's words
Meta	Meta Pixel	Conversions API	"a connection between an advertiser's server and Meta's Conversions API endpoint" (Meta)
Google Ads	Google tag	Offline conversion import keyed on the GCLID	Google says "Starting June 15, 2026, offline conversions import ... will be migrated to the Data Manager API" (Google)
TikTok	TikTok Pixel	Events API	"a reliable connection between TikTok and advertiser's marketing data, across web, app, and offline (eg. Store, CRM) channels" (TikTok)
Microsoft Advertising	UET tag	Conversions API or offline conversion import	"Microsoft Advertising's server-side solution for sending conversion and customer interaction data directly from an advertiser's systems to Microsoft Advertising" (Microsoft)
LinkedIn	Insight Tag	Conversion tracking by API	Its analytics use "Insight Tags, pixels and APIs" (LinkedIn Ads Agreement)

The route is half of it. What each event carries is what legal will look at, because a condition in an event name breaks the terms above from a server too. Curve Compliance sends conversions from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and strips PHI before data reaches an ad platform. For the Meta side on its own, see Meta Pixel or Conversions API.

Step 3: tie booked appointments and calls to the ad

For most clinics the result that matters is a booked appointment or a call. HHS uses booking as its example: when a covered clinic's website sends a tracking vendor "information regarding the appointment and the individual's IP address," the vendor "is a business associate, and a BAA is required" (HHS bulletin).

Curve keeps the ad click attached when a visitor leaves to book in IntakeQ, Calendly, Acuity, Jane App, OptiMantra, Boulevard, ZocDoc, Mindbody, Vagaro, Square, Setmore or Booker, and bookings made days later still match. Curve's team sets up GoHighLevel and embedded booking widgets. See scheduling software with BAAs and ad attribution.

Calls are often a clinic's most valuable conversion. Curve's BAA Directory lists CallRail as signing a BAA on its Healthcare plans and CallTrackingMetrics on its Marketing Pro plan and above. Curve Compliance receives call outcomes through an incoming webhook and credits each one to the original ad click, so the ad platform gets a neutral conversion instead of caller details. Compare tools in HIPAA compliant call tracking software.

Patients who book by phone or show up for a visit finish the journey off the website, and offline imports send those results back. Google explains: "To track offline conversions from clicks, you'll save these IDs along with whatever lead information you collect from the person who clicked your ad." Later you give "that GCLID back to Google Ads along with a few details about the type of conversion it was and when it happened" (Google Ads Help).

The upload needs the click ID, a conversion name and a time. The diagnosis, the treatment and the intake answers stay out of the upload. Curve takes offline uploads from a CRM or EHR, connects EHR and intake tools such as Healthie, Athenahealth and Jane through Keragon, and credits each outcome to the original ad click. The Google steps are in offline conversions for booked appointments.

Step 4: report on booked appointments

Once conversions flow again, give legal and marketing one weekly number: what a booked appointment cost, by campaign. Curve's Campaign Reporting puts Meta and Google Ads spend next to Curve-tracked conversions per platform and campaign, shows the cost per booking or call you pick, and lists the conversions behind any number.

How Curve Compliance helps

Curve Compliance replaces the browser ad pixels with one script and sends conversions from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, with PHI stripped before data reaches an ad platform. Bookings, calls and CRM outcomes are credited to the original ad click, and Event Logs give legal a record of what each platform received. Curve signs a BAA on every plan and is SOC 2 Type II. Curve's team does the setup. To check the old pixels are gone, run the free compliance scanner.

Sources, checked October 21, 2026: Meta Business Tools Terms; Meta Conversions API documentation; Meta Business Help Center, reviewing custom events; Google Ads Help, about offline conversion imports; Google Ads customer data policies; TikTok, about Events API; Microsoft Advertising, Conversions API; Microsoft Advertising, tracking offline conversions; LinkedIn Ads Agreement; HHS bulletin on online tracking technologies; American Hospital Association v. Becerra docket.

Frequently Asked Questions

Our legal team told us to remove all tracking pixels from our clinic website. How do we still measure our ads?

Send conversions to the ad platforms server-side with PHI stripped first: Meta's Conversions API, Google Ads offline imports keyed on the click ID, and the server routes TikTok, Microsoft and LinkedIn offer. Curve Compliance sets this up under a BAA it signs on every plan, and its free compliance scanner confirms the old pixels are gone.

Isn't server-side tracking just the pixel moved to a server?

It moves the route. What counts is what each event carries: Curve Compliance sends each platform a fixed list of fields under neutral event names, keeps contact identifiers off by default on Meta, Google Ads and TikTok, and strips PHI before data reaches an ad platform.

Why did our conversions drop after we removed the Meta pixel?

The pixel was how Meta saw conversions on your site, so without it or a server-side replacement, Meta receives no website events and campaigns optimizing on them lose their signal. If nobody changed the tags, check for a restriction first: restriction or broken tracking?

Will Meta still optimize without the pixel?

Yes, when conversions arrive through the Conversions API. Meta says server events "may be used in measurement, reporting, or optimization in a similar way as other connection channels" (Meta), and confirmed custom events work with "ad campaigns" (Meta). Curve Compliance sends them as generic custom events.

Can we send booked appointments to Google Ads without PHI?

Yes. An offline import matches on the GCLID plus "a few details about the type of conversion it was and when it happened" (Google), so the reason for the visit stays in your systems. Curve Compliance credits bookings to the original click and sends a neutral conversion.

How do we track phone calls from ads without a pixel?

Use a call tracker that signs a BAA, such as CallRail on its Healthcare plans or CallTrackingMetrics on Marketing Pro and above, per Curve's BAA Directory. Curve Compliance credits each call to the original ad click and sends a neutral conversion.

How do we confirm every tracking pixel is gone?

Run the free compliance scanner, which lists the pixels and trackers on a page. Check booking and intake pages too.

Talk to Curve Compliance

Book a call. Get conversions flowing back to Meta, Google Ads, TikTok, Microsoft and LinkedIn with PHI stripped first, under the BAA Curve signs on every plan. Curve's team does the setup. Book a call with Curve Compliance.