Nearly three-quarters of major hospital and clinic websites are running advertising or marketing trackers even when visitors have activated a legally recognized opt-out signal, according to a new study that should get the attention of anyone working with healthcare provider clients.
The research, commissioned by analytics platform Piwik PRO and conducted by Verified Data, scanned 59 major U.S. hospital and clinic websites from a California location with a Global Privacy Control signal active. GPC communicates a do-not-sell-or-share request under privacy laws in California and 11 other states, including New Jersey, Texas, and Colorado.
Why it matters: Between 2023 and 2025, healthcare organizations paid more than $100 million in settlements tied to tracking technologies and alleged improper disclosures of patient information, according to the study. Major breaches involving these tools have already been reported to the HHS Office for Civil Rights by Advocate Aurora Health, Kaiser Permanente, Novant Health, and Atrium Health.
The numbers: 73% of scanned sites had advertising or marketing trackers active despite the opt-out signal, and 69% were using marketing or advertising cookies, a strong indicator of data flowing to third-party ad platforms. Researchers identified 75 unique tracking tools across the sites, including Google Analytics, Meta Pixel, Microsoft Advertising, and session replay technologies that can capture what users type into forms before submitting them. The narrow gap between the tracker and cookie figures suggests some tools operate without cookies, meaning traditional cookie-blocking would not fully address the exposure.
The study did not attempt to determine whether PHI was actually transmitted. It looked at the presence and behavior of tracking scripts, cookies, pixels, and consent systems.
The bigger picture:
