You’re sitting at home. You’ve just noticed a lump. You go to your hospital’s website — the one your doctor is affiliated with, the one that sends you appointment reminders and stores your discharge summaries — and you search for an oncologist. You click through to the breast cancer care page. You check the appointment availability. You’re scared and you’re alone and you think you’re doing something private.
You’re not.
At the exact moment you click through those pages, a small piece of JavaScript code embedded in the hospital’s website is sending a record of your visit — the URLs you opened, the search terms you typed, the buttons you clicked — to Facebook’s advertising servers. You never agreed to this. In most cases, you were never told.
What The Markup found in 2022
In June 2022, investigative news organisation The Markup published a report that should have caused a national reckoning. Researchers analysed the top 100 US hospital systems by revenue and found that 33 of them had installed the Meta Pixel — Facebook’s tracking code — directly on their patient-facing websites and portals.
The data being sent wasn’t abstract. It included the name of the physician a patient had searched for, the condition-specific pages they had visited, and in some cases the specific appointment type they had tried to book. One hospital’s portal was transmitting a patient’s medication name alongside the name of their doctor, directly to Facebook’s ad infrastructure. Combined, those two facts paint a precise medical portrait.
This wasn’t a hack. Nobody broke into anything. Hospitals installed the Pixel themselves, willingly, because it helped their marketing teams understand which Facebook ad campaigns were driving website visits. The privacy catastrophe was a side effect nobody had thought through — or had thought through and decided was acceptable.
What the Meta Pixel actually does
The Pixel is a snippet of JavaScript. You paste it into your website and it starts reporting back to Facebook: who visited, what they did, where they came from. For a retailer, this is how you know that your Facebook campaign drove 400 people to your product page and 12 of them bought something. It’s genuinely useful for advertising measurement.
The problem is that the Pixel is indiscriminate. It doesn’t know the difference between a shoe store and a hospital. It automatically captures URLs visited, form interactions, and button clicks. On a hospital website, those interactions encode medical information. The URL hospital.com/conditions/hiv-care tells you what a person was researching. The URL hospital.com/doctors/oncology/book-appointment tells you that someone is trying to see a cancer specialist. The Pixel captures that and sends it to Facebook.
The Pixel doesn’t ask what kind of website it’s sitting on. Nobody at Meta reviewed whether installing it on a patient portal was appropriate. The hospitals didn’t check what data it was collecting before they installed it. This is how medical information ends up in an advertising database: through carelessness, not malice. That arguably makes it worse, because at least malice has a clear target.
The hospitals named — and what it cost them
Advocate Aurora Health is one of the largest health systems in the US, operating across Wisconsin and Illinois. In October 2022 it disclosed that the Meta Pixel and Google Tag Manager had been installed on its patient portal. Together they had transmitted data for approximately three million patients. That figure makes it one of the largest health data exposure events of the year it was disclosed.
In 2024, Advocate Aurora Health settled a class action lawsuit for $12.225 million. The settlement didn’t require the health system to admit wrongdoing. Three million patients. Years of browsing data transmitted to advertising servers. Twelve million dollars split across a class of millions. Do that arithmetic.
Dignity Health, Premera Blue Cross, and Stanford Health Care were among the other institutions identified in The Markup’s investigation and subsequent reporting. The pattern was consistent: pixel installed by a marketing or IT team, privacy implications not assessed, data flowing to Facebook for months or years before anyone noticed.
How it keeps happening
Hospital marketing teams operate under the same pressures as any other marketing team. They need to justify ad spend. They need to show that Facebook campaigns drive appointment bookings. The Meta Pixel is the standard way to do this — it’s what every agency recommends, it’s what every platform tutorial explains, and it takes about ten minutes to install.
Nobody in that workflow is thinking about what the Pixel captures on a patient portal login page. The IT team installs what the marketing team asks for. The marketing team installs what their agency recommends. The agency recommends what works for their other clients. And so, quietly, medical data starts flowing to Menlo Park.
This is a governance failure, not a technical one. The code does exactly what it says it does. The question nobody asked was whether it should be running on a page where patients search for their HIV medications.
What this means in India
Indian hospital websites use tracking code routinely. Google Analytics, Facebook Pixel, and similar tools are standard components of digital marketing for major health systems — sophisticated operations running paid campaigns, retargeting website visitors, and measuring conversion funnels. The same Pixel that caused the US lawsuits runs on health-related pages across the Indian internet.
There is no Indian equivalent of HIPAA — the US law that restricted what the hospitals were permitted to share with third parties. When The Markup’s investigation triggered enforcement in the US, it was under HIPAA, a law with teeth and a specific prohibition on sharing protected health information without patient authorisation. India has no such law for health data.
The Digital Personal Data Protection Act classifies health-related data as sensitive personal data and imposes stricter obligations around consent and processing. But enforcement has not begun. The specific question of whether tracking pixels on hospital websites constitute unlawful processing of sensitive data under DPDPA has not been tested. Until it is, the practice continues without consequence.
What you can do
Use a tracker blocker. uBlock Origin and Privacy Badger both block the Meta Pixel. Install one. They work, they’re free, and they stop this particular data pipeline at the source.
Use private browsing for health searches. It doesn’t block trackers on its own, but combined with a tracker blocker it limits the fingerprint left on any given device. Better: use a different device from the one you use for social media.
Use a VPN when visiting health-related websites. Your IP address is itself a data point that links sessions together. A VPN prevents IP-based profiling across sites.
Call to book appointments. The Pixel can’t capture a phone call. If you’re booking something sensitive, the telephone is still the most private channel.
Search for health information on general search engines in private mode, not on hospital portals. The hospital website is where the Pixel lives. The search engine result is not. Keep the sensitive research off the hospital’s tracking infrastructure.
If you’re in the EU: you have the right to file a complaint with your national data protection authority if a hospital website tracked you without valid consent. The GDPR requires explicit, informed consent before placing tracking pixels — consent that pop-up banners buried in cookie notices don’t cleanly satisfy.
The Meta Pixel investigation proved one thing clearly: the medical information you think is private because it’s on your hospital’s website is not private at all. It is, in the absence of deliberate protective action, advertising data. That’s worth sitting with.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.