Meta CAPI Parameter Builder on Health Sites: What It Sends

Meta's Conversions API Parameter Builder is an open-source library that can fill in the page URL, the referrer, the visitor's IP address and Meta's click and browser IDs on your Conversions API events, and it normalizes and hashes the customer details you pass to it (Meta), so on health sites Curve Compliance sends each ad platform only a fixed list of fields instead. On a healthcare website a page URL or a referrer can name a condition, a treatment or a booking step, so Curve, which signs a BAA on every plan for HIPAA-compliant ad tracking, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.

Book a call. Not sure what your Conversions API events carry today? Curve's team will review what your website sends to Meta, Google and TikTok with you and set up server-side conversions under a BAA on every plan. Book a call with Curve.

What Parameter Builder is and how it reaches your site

Meta calls it "a list of open-source SDKs in both client-side (browser JavaScript) and server-side (PHP, Java, Python, Node.js, Ruby)" and says it "can help you create, manage, and send certain customer information parameters, which may lead to performance improvements through increased event match quality (EMQ) scores" (Meta). It can end up on a site in three ways:

• Through Meta's Business SDK. Meta's v26 changelog says "The Business SDK is now integrated with open sourced Conversions API Parameter Builder." It "Auto-generates (gated by preference set by advertisers) and enhances parameters fbc, fbp, event_source_url, referrer_url, client_ip_address and automatic PII normalization/hashing for supported languages." Graph API v26 was "Released July 29, 2026," and the SDK "will be published shortly after the release of Graph API v26" (Meta changelog). A routine SDK update can bring it in.
• As a browser script. Meta's client-side guide says "The unversioned URL follows the latest npm release so integrations receive SDK updates automatically" (Meta on GitHub). Loaded that way, the script on your booking pages changes when Meta ships a release.
• In your server code. Meta tells server-side users to "Use the new processRequestFromContext API instead of processRequest (deprecated)," because the new API "retrieves richer Conversions API payload data (for example, event_source_url)" (Meta).

Meta recommends running both halves together: "Use the client-side parameter builder to retrieve client_ip_address and save to a cookie first," then "use the server-side parameter builder to get the best available client_ip_address from both cookie and request to send to Meta using the Conversions API" (Meta). So moving events to a server does not remove these fields. It changes where they are filled in, which is why server-side tracking alone is not HIPAA compliance. For the wider setup, see Meta Conversions API for healthcare.

The six things Parameter Builder fills in

Parameter	What Meta says	What it can carry on a health site
fbc (click ID)	"The Meta click ID value is stored in the _fbc browser cookie under your domain" (Meta)	A code for one ad click. HIPAA's identifier list includes "Any other unique identifying number, characteristic, or code" (45 CFR 164.514).
fbp (browser ID)	"The Meta browser ID value is stored in the _fbp browser cookie under your domain" (Meta)	A code for one browser. Treat it like the click ID.
client_ip_address	"The IP address of the browser corresponding to the event," which "must never be hashed" (Meta)	HHS lists "IP address or geographic location, device IDs, or any unique identifying code" among what trackers may receive (HHS).
referrer_url	"The address of the web page that referred the user to the current page," "captured from the Referrer request header" (Meta)	The page before: a condition page, a site search for a symptom or a quiz result.
event_source_url	"The URL of the web page where the event happened, reconstructed from the incoming request" (Meta)	The full address, such as a booking confirmation page for a named service.
Customer details (email, phone, name, date of birth, gender, city, state, ZIP, country, external ID)	"The library adopts the best practice to normalize and hash the customer information parameters" (Meta)	Names, email addresses, phone numbers, birth dates and ZIP codes are on HIPAA's identifier list (45 CFR 164.514).

Why page URLs and referrers are the risk

Meta's own example of an event_source_url is "https://www.example.com/checkout?productID=123" (Meta), so the query string comes along, and the browser script reads the page address and document.referrer when it looks for a click ID (Meta on GitHub). On a clinic site the address can be a path like /weight-loss/book, a utm_campaign named after a drug, a site search for a symptom, or a form that writes answers into the URL. The referrer does the same for the page before. See are UTM parameters PHI for how campaign links leak.

HHS's appointment example shows why this matters. When trackers "collect an individual's email address, or reason for seeking health care typed or selected by an individual" while someone books, "the regulated entity is disclosing PHI to the tracking technology vendor" (HHS). Behind a login, such as "a patient or health plan beneficiary portal or a telehealth platform," HHS says "Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI" (HHS). HHS notes that on June 20, 2024 a federal court vacated part of this guidance about IP addresses and public pages (HHS); the annotated bulletin shows what still stands. For the full identifier list, see the 18 HIPAA identifiers.

Hashing does not make the data safe

Meta says "The library adopts the best practice to normalize and hash the customer information parameters. No further action is needed." The aim is matching: Meta wants details "formatted correctly to increase the likelihood of matching to Meta users" (Meta). HIPAA asks a different question. HHS's de-identification guidance says a code derived from a secure hash function without a secret key "would be considered an identifying element" (HHS). Meta's own example turns an email into a SHA-256 value built to match a Meta user. For the full answer, see is a hashed email PHI.

What Meta's terms still say

Parameter Builder changes how fields are filled in, not what Meta allows. Meta's Business Tools Terms bar sharing data that "includes or is based on, directly or otherwise, health information," and say the names of events and conversions "must not reflect, imply or be based on" that information. Advertisers also represent that they have "all of the necessary rights and permissions and a lawful basis" for what they send (Meta Business Tools Terms). For a clause-by-clause read, see Meta's Business Tools Terms and health data. Curve's BAA Directory lists Meta as not signing a BAA.

The January 21, 2027 date

Meta's v26 changelog lists "January 21, 2027: Graph API v21.0 is deprecated and removed." The same changelog is where the v26 Business SDK's Parameter Builder integration is announced (Meta), so teams updating SDKs ahead of that date will meet it. Meta's versioning guide adds that "once a version is no longer usable, any calls made to it will be defaulted to the next oldest, usable version" (Meta), and its changelog says "Marketing API version auto-upgrade will be released on July 29, 2026" (Meta). Either way, find out what a new SDK fills in, and how the advertiser preference that gates auto-generation is set for your integration, before it runs on pages where patients book or log in.

A safer setup on a health site

1. Find out whether it is already there. Search your code, packages and tag manager for capi-param-builder, capi_param_builder, clientParamBuilder and processRequestFromContext, check whether your Meta Business SDK is v26 or later, and run the free Curve Compliance website scan on landing, booking and thank-you pages to list the trackers that load.
2. Decide field by field. For each row in the table above, write down whether it may leave your site, from which pages, and why, in line with the minimum necessary rule.
3. Clean URLs before any tool reads them: neutral campaign codes, forms that do not write answers into the address, and no names or emails in redirects.
4. Name events neutrally, as Meta's terms require.
5. Check what was actually sent, event by event, in your own logs.
6. If the Meta Pixel is the tag reading those pages, see how to remove it and the alternatives.

How these rules apply to your site depends on your facts, so talk to your counsel. If you want help reading what your events carry, book a call with Curve.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta's Conversions API, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, so what Meta receives from Curve is set by that list, not by a library default. Events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok.

Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and flags them so they can be stopped at the source. It strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Curve keeps ad attribution when a visitor leaves to book in tools such as IntakeQ, Calendly, Acuity and Jane App, and bookings made days later still match the original ad click. Curve collects this data under the BAA it signs on every plan (BAA Directory entry), Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: Meta, Parameter Builder Library; Meta, Graph API v26.0 changelog; Meta, Graph API changelog; Meta, Graph API versioning; Meta, capi-param-builder client JS guide on GitHub; Meta, server event parameters; Meta Business Tools Terms; Meta, about measuring conversions on customer devices; HHS, online tracking technologies bulletin; HHS, guidance on de-identification; 45 CFR 164.514.

Frequently Asked Questions

What is Meta's Conversions API Parameter Builder?

It is Meta's open-source library, in browser JavaScript and in PHP, Java, Python, Node.js and Ruby, that fills in the click ID and browser ID and, depending on the language, the IP address, referrer and page URL on Conversions API events, and normalizes and hashes customer details (Meta). Meta's Business SDK v26 integrates it (Meta).

Is Parameter Builder safe on a HIPAA-covered website?

It depends on the pages and the fields. It fills in the page URL, the referrer, the IP address and hashed customer details (Meta), and on a booking page or behind a patient login those can add up to PHI under HHS guidance (HHS). Meta's terms also bar sharing health information (Meta).

Does Parameter Builder send the page URL to Meta?

Its server libraries can fill in event_source_url, "reconstructed from the incoming request," when you use processRequestFromContext (Meta). Meta says "The event_source_url is required for website events shared using the Conversions API" (Meta), so clean the URL before it is sent; see the missing event_source_url warning.

Does hashing an email make it safe to send to Meta?

No. HHS says a code derived from a secure hash function without a secret key "would be considered an identifying element" (HHS). See is a hashed email PHI.

Do I have to upgrade before Graph API v21 is removed on January 21, 2027?

Meta lists that removal date (Meta) and says calls to a version that is no longer usable "will be defaulted to the next oldest, usable version." For SDKs, Meta adds that "you should assume an end-of-life SDK is no longer functional" (Meta). If you do update, check what the new SDK fills in before it runs on patient pages.

Is Parameter Builder the same as Meta's on-device conversion measurement?

No. On-device measurement is a separate pixel setting that Meta says is "turned on by default" (Meta); see Meta on-device conversion measurement for health sites and, for the browser side, Safari 27 and clinic ad tracking.

How does Curve Compliance send Meta conversions without PHI?

Curve sends conversions from its servers to Meta's Conversions API with a fixed list of fields, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Contact identifiers are off by default, events can use neutral names, and Curve signs a BAA on every plan.

Talk to Curve Compliance

Book a call. Curve Compliance sends each ad platform a fixed list of fields and checks every event for PHI-like patterns, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.