Meta On-Device Conversion Measurement for Health Sites

Meta's on-device conversion measurement, the "Measure conversions on customer devices" setting in Events Manager, matches an ad view to a website conversion on the customer's own device, and Meta says it is "turned on by default" (Meta). It is meant for sites that "require people to log in to an account using an email or mobile phone number" (Meta), which on a health site means a patient portal or a telehealth account, so Curve Compliance, which signs a BAA on every plan for HIPAA-compliant ad tracking, replaces the browser pixel with server-side conversions sent from Curve's servers.

Book a call. Not sure whether a Meta Pixel runs on your login or portal pages? Curve's team will review what your website sends to Meta, Google and TikTok with you and set up server-side conversions under a BAA on every plan. Book a call with Curve.

What the setting does, in Meta's words

Meta describes the feature this way: "When you turn on Measure conversions on customer devices in Meta Events Manager, the system measures conversions on your customer's device. It uses information they already shared with you (like an email) and temporary, non-identifying device information." Meta's example is a shopper who sees an ad on Instagram and buys on the website later. Meta "can't always connect them," and with the setting on "that match happens on the customer's device, where both the ad view and the purchase are present" (Meta). Meta's help pages give no start date, and the rest is in this table.

Question	What Meta says	Source
Is it on by default?	"Measure conversions on customer devices is turned on by default." Also: "It's on by default for eligible pixels, but you can turn it off at any time."	About; How to turn on
Which sites qualify?	"You must install the Meta Pixel on your website. Install the pixel directly on your page, not inside an iframe or as an image-only (img) pixel." And: "Your website must require people to log in to an account using an email or mobile phone number."	How to turn on
What does it use?	"information they already shared with you (like an email) and temporary, non-identifying device information"	About
What does Meta receive?	"No identifying customer information is shared with Meta. Meta only receives confirmation that a purchase happened and which campaign to attribute it to."	About
Does it replace the Conversions API?	"works alongside your existing Pixel and Conversions API setup and doesn't replace it"	About
Does attribution change?	"Your attribution window and attribution model don't change."	About
Where is it active?	"not active for people located in the EU and UK"	About
Who is responsible?	"It's your responsibility to make sure your integration doesn't share prohibited information with Meta."	About

Which sites are eligible

Meta sets two conditions: the Meta Pixel is installed directly on the page, and the site requires a login with an email or mobile phone number (Meta). A site with no login does not meet the second condition. In healthcare, the sites that do qualify are the ones with accounts: patient portals, telehealth platforms, refill and membership dashboards, and online pharmacies where patients sign in. Those are the pages HHS singles out, below. For the wider question of a pixel on public pages, see how to remove the Meta Pixel from a healthcare website.

Why it matters on a health site

HHS describes logged-in pages, "such as a patient or health plan beneficiary portal or a telehealth platform," and says "Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI." It adds that such PHI may include "an individual's IP address, medical record number, home or email addresses, dates of appointments, or other identifying information," and that a regulated entity "must configure any user-authenticated webpages that include tracking technologies to allow such technologies to only use and disclose PHI in compliance with the HIPAA Privacy Rule" (HHS). The part of the bulletin a federal court vacated on June 20, 2024 concerns IP addresses and visits to unauthenticated public pages, not logged-in pages (HHS); see the annotated bulletin.

Of the on-device match, Meta says "No identifying customer information is shared with Meta" (Meta). Even taking that at face value, the question for a covered clinic is the pixel itself: the feature only works with a Meta Pixel installed directly on a site with logins, and Meta leaves it to you to make sure "your integration doesn't share prohibited information with Meta" (Meta). Meta's Business Tools Terms also bar sharing data that "includes or is based on, directly or otherwise, health information" (Meta Business Tools Terms; see what those terms mean for health data). Curve's BAA Directory lists Meta as not signing a BAA.

How to check it and turn it off

Meta's steps for the setting (Meta):

1. Go to Meta Events Manager.
2. Click Data sources.
3. Select the name and ID of your pixel.
4. Click Settings.
5. Find Measure conversions on customer devices below the Meta Pixel settings section, and turn it off if you decide it should not run.

Then check where the pixel actually loads. Run the free Curve Compliance website scan on your login page, your portal or account pages and your booking and checkout pages; it lists the pixels and trackers on each page. Note every place the Meta Pixel sits inside a logged-in area. Whether a pixel may stay on any of those pages depends on your facts, so talk to your counsel.

Measuring Meta ads without a pixel on logged-in pages

Meta says its Conversions API "is designed to create a connection between an advertiser's marketing data (such as website events, app events, business messaging events and offline conversions) from an advertiser's server, website platform, mobile app, or CRM to Meta systems" (Meta). That lets a health business report a booking, a completed consult or a first refill as a conversion without a Meta script on the page where it happened. Three habits keep it clean:

• Send a short, fixed list of fields. Decide which fields each platform may receive and keep everything else, including page URLs from inside the portal, on your side.
• Use neutral event names. Meta's terms say event and conversion names "must not reflect, imply or be based on" health information (Meta).
• Credit outcomes to the click, not the page. Tie the conversion to the original ad click when the visitor arrived, so it still counts when the patient books or signs in days later.

For the options side by side, see HIPAA-compliant Meta Pixel alternatives and how to measure ads without tracking pixels.

Other changes that touch Meta measurement

On October 19, 2026 WebKit wrote: "In our iOS, iPadOS, macOS, and visionOS 27 releases, Safari and WebKit block network access to identity resolution infrastructure to prevent cross-site tracking." Its target is third parties that "invisibly collect your email address when you log in or sign up for a newsletter" (WebKit). The post names no companies. What that means for clinic ads is in Safari 27 and clinic ad tracking. On the server side, Meta's v26 changelog says the Business SDK "is now integrated with open sourced Conversions API Parameter Builder" (Meta), a library that can fill in page URLs, referrers and IP addresses; see Meta's Conversions API Parameter Builder on health sites.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta's Conversions API, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, flags them so they can be stopped at the source, and strips PHI before data reaches an ad platform.

Curve keeps ad attribution when a visitor leaves to book in tools such as IntakeQ, Calendly, Acuity and Jane App, and bookings made days later still match the original ad click. It also receives outcomes from booking systems, CRMs and call tracking through incoming webhooks, from EHR and intake tools such as Healthie and IntakeQ through Keragon, and from offline conversion uploads from a CRM or EHR. Event Logs show what Curve sent to each platform and what the platform accepted. Curve collects this data under the BAA it signs on every plan (BAA Directory entry), Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: Meta, about measuring conversions on customer devices; Meta, how to turn on measuring conversions on customer devices; Meta, Commercial Terms update preview; Meta, Conversions API; Meta Business Tools Terms; HHS, online tracking technologies bulletin; WebKit, blocking identity resolution infrastructure; Meta, Graph API v26.0 changelog.

Frequently Asked Questions

What is Meta's on-device conversion measurement?

It is a Meta Pixel setting, "Measure conversions on customer devices," that matches an ad view to a website conversion on the customer's own device, using "information they already shared with you (like an email) and temporary, non-identifying device information" (Meta). It needs a site where people log in with an email or mobile phone number (Meta).

Is Meta's on-device conversion measurement on by default?

Yes. Meta says it "is turned on by default" (Meta) and is "on by default for eligible pixels, but you can turn it off at any time" (Meta).

Does it send my patients' email addresses to Meta?

Meta says "No identifying customer information is shared with Meta" and that Meta "only receives confirmation that a purchase happened and which campaign to attribute it to" (Meta). The feature still needs a Meta Pixel installed on a site with logins, and HHS says trackers on logged-in pages "generally have access to PHI" (HHS).

Does it apply if my site has no patient login?

By Meta's conditions, no: the site "must require people to log in to an account using an email or mobile phone number" (Meta). A Meta Pixel on public pages raises its own questions; see removing the Meta Pixel.

Does it replace the Conversions API?

No. Meta says it "works alongside your existing Pixel and Conversions API setup and doesn't replace it" (Meta).

Should a telehealth company turn it off?

Meta says you can turn it off at any time (Meta). The larger question is whether a Meta Pixel belongs on logged-in telehealth pages at all, since HHS says a regulated entity "must configure any user-authenticated webpages that include tracking technologies" to use and disclose PHI only as the Privacy Rule allows (HHS).

What do Meta's November 20, 2026 terms add for sites with logins?

Meta's preview says "These updates will go into effect on November 20, 2026," and has advertisers authorize Meta to use crawlers "and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl the domains, web pages, or URLs" tied to their products (Meta). The preview says this is "in order to provide, develop, improve, research, and maintain advertising and business products" and does not say how Meta would create the test credentials (Meta); see which crawlers to allow on a healthcare website.

How do I measure Meta conversions without the Meta Pixel?

Send them from a server through Meta's Conversions API, which connects data "from an advertiser's server, website platform, mobile app, or CRM" to Meta (Meta). Curve Compliance does this with a fixed list of fields and PHI checks, under a BAA on every plan.

Talk to Curve Compliance

Book a call. Curve Compliance sends Meta conversions from its servers with a fixed list of fields and checks every event for PHI-like patterns, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.