What Is a Tracking Pixel? What It Means on a Health Site

A tracking pixel is a small piece of code on a web page that reports what a visitor does there to the company that runs it, such as Meta, Google or TikTok, and on a healthcare website Curve Compliance replaces browser ad pixels with server-side conversions. HHS describes a tracking pixel as “a tiny graphic image (usually 1 pixel) placed on a webpage that allows the website owner or a third party to collect information regarding the use of the webpage that contains the web beacon” (HHS), and Meta calls its own pixel “a snippet of JavaScript code that allows you to track visitor activity on your website” (Meta). On a healthcare website, a pixel on a booking, intake or patient portal page can send identifiable health information to that company, which is why HHS treats tracking vendors that receive PHI for a covered entity as business associates. Curve uses one script and sends conversions from its own servers, with PHI stripped before data reaches an ad platform, under a BAA it signs on every plan.

Book a call. Keep your ad conversions without browser pixels on patient pages. Curve Compliance sends conversions server-side to Meta, Google Ads, TikTok and other platforms and checks every event for PHI-like patterns first. Curve's team does the setup for you. Book a call with Curve.

Tracking pixel, defined

The name comes from the image. Meta's base code still carries one: a noscript image, 1 pixel high and 1 pixel wide, that loads from facebook.com/tr with your pixel ID, next to a script that loads Meta's library from connect.facebook.net. Meta says the code “automatically tracks a single PageView conversion by calling the fbq() function each time it loads” (Meta). Most developers, Meta adds, put it in the site's “persistent header, so it can be used on all pages.”

Vendors use different names for the same idea. Google calls its code the Google tag (Google), and LinkedIn calls its version the Insight Tag (LinkedIn). Google explains the word: “Tags are segments of code provided by analytics, marketing, and support vendors to help you integrate their products into your websites or mobile apps” (Google). Pixel, tag, beacon and Insight Tag all name code that sends visitor activity to a vendor.

Tracking technologies: HHS's own definitions

HHS's bulletin on online tracking defines a tracking technology as “a script or code on a website or mobile app used to gather information about users or their actions as they interact with a website or mobile app.” It names the kinds websites commonly use and defines each in a footnote (HHS). In the pixel and session replay rows, the examples are tools Curve's free website scan names in those categories.

Technology	HHS's definition	Examples on websites
Web beacon or tracking pixel	A tiny image, usually 1 pixel, that lets the website owner or a third party collect information about use of the page	Meta Pixel, Google Ads conversion tag, TikTok Pixel, LinkedIn Insight Tag
Cookies	“files placed on a user's device to customize a user's browsing experience but can also be used to track a user's activities”	The _fbp cookie, where the Meta Pixel “automatically saves a unique identifier” (Meta)
Session replay scripts	“record a user's activities (e.g., mouse movements, clicks, and typing) when using a webpage or app”	Hotjar, FullStory, Microsoft Clarity, Mouseflow
Fingerprinting scripts	“uses a browser's and/or device's unique configurations and settings to track user activity”	HHS names the technique, not a product
Tracking in mobile apps	Apps “include/embed tracking code within the app”	Facebook SDK for iOS or Android (Meta)

HHS adds that third-party tracking technologies “send information directly to the third parties who developed such technologies and may continue to track users and gather information about them even after they navigate away from the original website to other websites” (HHS).

What a pixel sends

Meta lists what its pixel can collect (Meta):

• HTTP headers. Meta says these “may include data like IP addresses, information about the web browser, page location, document, referrer and person using the website.”
• Pixel-specific data. The pixel ID and “the Facebook Cookie.”
• Button click data. “any buttons clicked by site visitors, the labels of those buttons and any pages visited as a result of the button clicks.”
• Optional values. Extra details a site chooses to send, such as “conversion value, page type and more.”
• Form field names. “website field names like email, address, quantity”

Meta's setup guide adds: “By default, the Pixel will track URLs visited, domains visited, and the devices your visitors use” (Meta). Ad clicks add an identifier too. Meta passes a ClickID, fbclid, in the landing page URL, and the pixel “automatically stores ClickID value in the _fbc browser cookie” (Meta). Google's auto-tagging adds a parameter called GCLID, the Google Click Identifier, to the URL a visitor lands on (Google).

On a clinic site, the page location and button labels are where health details show up. A URL or a button can name the service or condition a visitor looked at or booked. For the identifiers HIPAA lists, see the 18 HIPAA identifiers in website data; for campaign tags in URLs, see UTM parameters and PHI; for IP addresses, see are IP addresses PHI.

A new Meta pixel can also send events nobody wrote code for. Meta says that “Starting August 3, 2026, when you set up a new Pixel through Data Advisor, the option to automatically detect and add standard events is pre-selected during the setup flow” (Meta). See Meta Ads Data Advisor on a healthcare website.

Why health pages are different

HHS's bulletin opens with a dated note. On June 20, 2024, a federal court in Texas vacated part of it in Am. Hosp. Ass'n v. Becerra: the part about an online technology connecting an IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers. HHS says it “is evaluating its next steps in light of that order” (HHS). For what still applies, see the HHS tracking bulletin after AHA v. Becerra.

The rest of the bulletin is still posted. It says “Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures” of PHI to tracking vendors. It points to logged-in pages such as a patient portal, where tracking “may even have access to an individual's diagnosis and treatment information, prescription information, billing information, or other information within the portal,” and to public pages that let people “schedule appointments or use a symptom-checker tool without entering credentials.” In its appointment example, HHS says the tracking vendor “is a business associate, and a BAA is required.” It also says “Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization” (HHS). See is a cookie banner enough for HIPAA.

The ad platforms set their own limits. Meta says “Prohibited information includes health, financial, or children's data” (Meta). It also says “Certain data source categories may have additional data sharing restrictions,” and its health and wellness examples include “a patient portal, wellness tracker, telemedicine platform, pharmacy, health insurance marketplace, or condition-specific support group” (Meta). LinkedIn says its Insight Tag “should not be installed on web pages that collect or contain Sensitive Data” (LinkedIn). The BAA Directory lists Meta, Google Ads, TikTok, LinkedIn Ads and Microsoft Advertising as not signing a BAA; which ad platforms sign a BAA covers each one. How this applies to your pages depends on your setup, so talk to your counsel.

How to see which pixels a page loads

The quickest check is Curve's free website scan, which lists the pixels and trackers on a page. Your browser's developer tools and the ad platforms' own extensions show the rest. The step-by-step version, with what to do about each finding, is how to see which trackers your website loads. For a full audit, use the healthcare pixel audit checklist.

Measuring ads without a browser pixel

Ad platforms also accept conversions sent from a server. Meta says server events “are processed like events sent using the Meta Pixel” and “may be used in measurement, reporting, or optimization in a similar way as other connection channels” (Meta). For why healthcare sites remove the Meta pixel, see is the Meta Pixel HIPAA compliant; for the steps, how to remove the Meta pixel; for measurement after removal, how to still measure ads; and for tools, HIPAA-compliant server-side tracking tools.

How Curve Compliance helps

Curve Compliance gives a clinic the ad measurement a pixel provides, without the browser pixel on patient pages. Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Curve then replaces your browser ad pixels with one script and sends conversions server-side from Curve's servers to the Meta Conversions API, Google Ads, TikTok, Microsoft Advertising, LinkedIn and ChatGPT Ads.

Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II, signs a BAA on every plan (Directory entry), and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; Meta, Meta Pixel; Meta, Get started with the Meta Pixel; Meta, Learn about Meta Pixel; Meta, ClickID and the fbp and fbc Parameters; Meta, Conversions API; Meta, data source categories; Meta, Meta Ads Data Advisor; Google, Set up the Google tag with gtag.js; Google, About Tags; Google, About auto-tagging; LinkedIn, Add the LinkedIn Insight Tag to your website.

Frequently Asked Questions

What is a tracking pixel?

A tracking pixel is a small piece of code on a web page that reports what visitors do there to the company that runs it, such as Meta or Google (HHS). On a healthcare site, a pixel on a booking or portal page can send health information to that company.

Is a tracking pixel the same as a cookie?

No. HHS lists them as separate tracking technologies: a cookie is a file stored on the visitor's device, while a pixel is an image or code on the page (HHS). They often work together; when it uses first-party cookies, the Meta Pixel saves a unique identifier in an _fbp cookie on your domain (Meta).

What does the Meta pixel collect?

Meta says its pixel can collect HTTP headers, including IP addresses, page location and referrer, plus the pixel ID and Facebook cookie, button clicks and their labels, optional values and form field names (Meta). By default it also tracks URLs visited, domains visited and visitors' devices (Meta).

Are tracking pixels illegal on healthcare websites?

HHS treats pixels as one kind of tracking technology. It says regulated entities may not use tracking technologies in a way that results in impermissible disclosures of PHI, and that a tracking vendor that receives PHI on a booking page is a business associate that needs a BAA. Part of that guidance was vacated on June 20, 2024 (HHS).

How do I find the pixels on my website?

Run Curve's free website scan on your booking, intake and thank-you pages, then confirm in your browser's Network panel. The full method is in how to see which trackers your website loads.

Can I measure ads without a pixel?

Yes. Ad platforms accept conversions sent from a server, and Meta says server events are processed like pixel events (Meta). See how to still measure ads.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, is SOC 2 Type II, and Curve's team does the setup, typically live in about a week (Directory entry).

Talk to Curve Compliance

Book a call. Found pixels on your patient pages? Curve Compliance replaces them with server-side conversions, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.