Ask a marketing team which tags run on their website and you’ll usually get a confident answer. Ask them to prove it, page by page, with the cookie banner unanswered, rejected and accepted, and the room goes quiet. That gap between what a company thinks its pixels do and what they actually send has turned into one of the more expensive blind spots in corporate compliance.
The Meta Pixel, the TikTok Pixel, Google’s tags and LinkedIn’s Insight Tag are small pieces of JavaScript. They get pasted into a template once, often by an agency, and then forgotten. Each one reports page addresses, button clicks, form events and identifiers back to an ad platform. On a shoe store that’s a retargeting campaign. On a hospital portal, a pharmacy, a lender or a therapy app, the same data can be a health record, a financial record or a viewing history, and the law treats it that way.
Class action lawyers and regulators noticed years ago. So did attackers. Most site owners still haven’t.
Hospitals Learned It First, and Paid for It
Health care took the first wave. Advocate Aurora Health notified about 3 million people in 2022 that pixels on its patient portal and websites had sent data to third parties, and later agreed to a $12.225 million class settlement. Novant Health settled for $6.6 million over disclosures affecting about 1.36 million people between May 2020 and August 2022. Kaiser Permanente reported in April 2024 that tracking code on its sites and apps may have exposed details of how 13.4 million members used them, including names and IP addresses; in late 2025 it agreed to a $46 million settlement in federal court in Northern California, which could rise to $47.5 million.
The federal government moved in parallel. In February 2023 the FTC brought its first case under the Health Breach Notification Rule against GoodRx, which paid a $1.5 million civil penalty for sharing prescription and health condition data with Facebook, Google and Criteo. A month later BetterHelp, the online therapy company, agreed to pay $7.8 million after the FTC said it passed email addresses, IP addresses and intake questionnaire answers to Facebook and Criteo for advertising. Both companies had promised users the opposite in their privacy policies.
The HHS Office for Civil Rights went further. Its December 2022 bulletin told hospitals that tracking technologies on their websites could violate HIPAA, even on public pages without a login. The American Hospital Association sued. On June 20, 2024, Judge Mark Pittman in the Northern District of Texas ruled that the part of the revised March 2024 bulletin covering the “proscribed combination” (an IP address plus a visit to a public page about a health condition) went beyond the agency’s authority, and vacated it. Hospitals cheered. But the ruling only narrowed the federal theory for public, unauthenticated pages. Patient portals, appointment flows and logged-in pages are still squarely covered, and the class actions run on state privacy and consumer laws anyway.
Video, Wiretap and Cookie Law Keep Widening the Net
Outside health care, plaintiffs found older statutes. The Video Privacy Protection Act dates from 1988 and was written about video rental stores. Lawyers now use it against any site that embeds video and runs the Meta Pixel, because the pixel can send Facebook the title of the video a logged-in user just watched. The Supreme Court heard argument on October 14, 2026 in Salazar v. Paramount Global, a case built on exactly that setup: a newsletter subscriber to 247Sports.com, a Paramount sports site, watched videos there while logged into Facebook. The question is who counts as a “consumer” under the law. If the Court reads it broadly, any site with a newsletter and a video player and a pixel inherits real exposure, at $2,500 per violation.
California went the other way, partly. Thousands of suits have been filed under the California Invasion of Privacy Act, treating pixels and chat widgets as illegal wiretaps or as “pen registers” that log who is talking to whom. Governor Newsom signed SB 690 on September 30, 2026. From January 1, 2027, only the state attorney general can sue a private business over pen register and trap and trace claims arising from a website or app, and the limit reaches back to pending suits filed since the start of 2025. It doesn’t touch the wiretap section, Section 631, so plaintiffs are expected to replead under it. The flood slows. It doesn’t stop.
Europe enforces through regulators rather than juries. Sweden’s data protection authority fined the pharmacy chain Apoteket SEK 37 million and the online pharmacy Apohem SEK 8 million in 2024 after a Meta Pixel feature sent details of customers’ purchases to Meta. In September 2025 France’s CNIL fined Google €325 million and Shein €150 million in cookie cases, with Shein penalised for placing cookies without consent. The European rule is simple to state and hard to follow: no non-essential tracker before a valid yes, and a no has to actually mean no.
The Security Problem Hiding in the Marketing Stack
Compliance teams see pixels as a privacy issue. Security teams should see them as third-party code running with full access to the page, including checkout and login forms. Nobody reviews most of it.
The Magecart pattern shows why that matters. In 2018 attackers compromised a chatbot from the vendor Inbenta that Ticketmaster had placed on its payment page; the injected code skimmed card data for months, and the UK Information Commissioner’s Office fined Ticketmaster £1.25 million in November 2020 for failing to secure it. In June 2024 the polyfill.io domain, bought earlier that year by a company called Funnull, began serving a script that redirected mobile visitors to scam sites. Sansec raised the alarm. More than 100,000 websites were loading it. We recently covered the Brevo supply chain attack, where an email platform’s script became the delivery route for ClickFix malware.
A tag manager is a remote code execution channel you’ve handed to marketing. Every vendor in it is a supply chain dependency, every container change is a deploy, and few companies log either one.
What an Audit Actually Looks Like
The good news is that this is checkable. A real audit has four parts, and none needs a consultant to begin.
Inventory every tag on every template. Start from what the browser actually loads, then compare it with the tag manager’s list. Hard-coded snippets, plugin-injected scripts, tags firing from inside other tags. Check the templates that matter most: search results, condition or product pages, forms, account areas, order confirmation pages. Those are where the sensitive data lives.
Map what leaves. Record the outgoing requests and read them. Look for email addresses and phone numbers (hashed or not; a hash of an email is still an identifier for matching), page URLs with search terms or condition names, form field values and user IDs. Features such as automatic advanced matching can pick up form fields nobody meant to share.
Test the consent gate three ways. Load the site with the banner unanswered, after a reject and after an accept. Trackers firing before an answer, or still firing after a reject, are the findings regulators and plaintiffs look for first. Don’t trust what a consent platform’s dashboard reports; check the traffic.
Weigh server-side tagging honestly. Moving tags to a server container gives you one place to strip fields, drop identifiers and enforce consent before data goes to a vendor. It also makes the data flow invisible to the browser and to your own auditors. Done well it reduces leakage. Done lazily it just hides the same leak behind your own domain, and the legal liability doesn’t move.
Repeat the audit after every site redesign, consent platform migration or agency handover. Tags drift.
Free tooling has caught up with the problem. PXTA (Pixel Tracking Audit) is an open-source command-line tool, Apache 2.0 licensed and at version 0.1, that drives an installed Chrome, Chromium or Edge browser through a site three times, unanswered, rejected and accepted. It recognises ten named trackers, among them Meta, Google, TikTok, LinkedIn, Microsoft, Pinterest, Snap and X, flags unknown beacons, and writes an HTML report, a JSON findings file and a HAR file of every request, pointing to the personal data inside each one. It reports evidence rather than a score. It’s young and its tracker list is finite, so treat it as a first pass that produces evidence a lawyer can read. A clean run is no certificate of compliance.
The companies that paid out in these cases rarely set out to sell patient or customer data. They installed a marketing tag, never looked at what it sent, and found out from a plaintiff’s complaint or a regulator’s letter. Looking costs an afternoon.