PIPEDA and marketing pixels: what a health clinic can and cannot track

Most clinic websites carry at least one marketing pixel: a small script that reports what a visitor did to an ad platform such as Meta or Google. On a retail site that is routine. On a site where the pages are named after conditions and treatments, the same script can describe a person’s health to a third party. This guide separates what the published rules say from what a clinic in Richmond Hill, Markham or Vaughan still has to decide for itself. It is general information, not legal advice, and a clinic’s privacy officer or advisor should review how its own site is set up.

What a marketing pixel actually sends

A pixel runs in the visitor’s browser and reports events to the platform that issued it: a page was viewed, a button was clicked, a form was submitted. Each event can include the page address, the page title and an identifier the platform can match to an account or device. On a clinic site, a page address such as one ending in a treatment or condition name is itself a description of why the visitor came. That is the core of the privacy problem, and it does not depend on the visitor typing anything into a form.

What the OPC has said about health information and ad targeting

PIPEDA is the federal private-sector privacy law, and the OPC publishes how it reads it. Two published positions matter here. In its policy position on online behavioural advertising, the OPC says information generally considered sensitive, such as medical or health information, should be avoided when tracking for advertising. In its findings on a complaint about health-related ads shown after a person searched for medical information, it held that implied consent was not appropriate and that express consent was required.

The OPC has also said that an opt-out model of consent is not appropriate where the information used for behavioural advertising could be sensitive. These are the Commissioner’s positions and findings, not a checklist that approves any setup, and some of the documents are older, so the current versions should be read before relying on them. The OPC’s materials we reviewed do not include a bulletin written specifically about tracking pixels on health sites.

Where Ontario health privacy law comes in

Ontario’s Personal Health Information Protection Act (PHIPA) applies to health information custodians and defines personal health information as identifying information about an individual’s health or the care they receive. The Information and Privacy Commissioner of Ontario says custodians should not collect, use or disclose more personal health information than is reasonably necessary, and that they must publish a written statement describing their information practices. Whether an anonymous page view on a treatment page counts as personal health information is not something we can answer for a clinic, and we did not find Ontario guidance written specifically on pixels. That question belongs with the clinic’s privacy officer or counsel, and the answer can differ between a physician practice, a dental practice and a med spa.

What Meta’s rules say

Meta’s Business Tools Terms place the responsibility on the advertiser. They say the advertiser will not share health information, financial information or other sensitive categories through the tools. Meta’s help centre describes sensitive health information as including diseases, medical conditions and injuries, sexual and reproductive health, mental health, medications and supplements, and locations that identify a health condition or a place of treatment. Meta says it runs a filtering system meant to stop potentially sensitive health data from reaching its ad systems, and that sites sending data that breaks its terms can be blocked. Filtering is Meta’s safeguard, not a permission, and the terms still say the advertiser should not send the data in the first place.

The same terms say custom audience criteria and names cannot include, reflect or imply health information. For a clinic, that means an audience built from patient lists or from visitors to a condition page deserves a hard look before it is created.

What Google’s rules say

Google’s Health in personalized advertising policy covers physical and mental health conditions and procedures to treat or manage them. For advertisers promoting in that category, advertiser-curated audiences are not supported. Google’s support table lists Customer Match, your data segments and lookalike segments as unsupported, while in-market, affinity, demographic, life event, location and custom segments are supported. In practice, a standard remarketing list built from site visitors is the kind of audience this policy restricts for health promotion. Policy wording changes, and a clinic offering cosmetic or chronic-care services should read the live page for its market before planning a campaign. Our remarketing campaign service is scoped around exactly this question.

Tracking choices that carry less risk

The rules above are about what is sent and who is targeted. These are working practices that follow from them, offered as questions to put to a clinic’s privacy officer rather than as approval of any setup.

How this changes clinic advertising in practice

Restrained tracking does not mean no measurement. A clinic can usually still learn how many enquiries and calls came from search ads, which campaigns they came from and what each enquiry cost, using counts that do not describe the patient. What it gives up is the ability to retarget a person who read about a specific treatment, and to build audiences from health-related behaviour. For a clinic that wants a roster filled or a calendar booked, search ads and local visibility do much of the work without that data. See our guide to marketing for medical clinics in the GTA for how the pieces fit.

The same logic applies across practice types. A dental practice weighing marketing for dental practices and a spa weighing med spa marketing in the GTA both face the question of which pages and events a pixel should ever see. The answers differ with the regulator, the services and the clinic’s own privacy officer, which is why we review the setup with the clinic instead of installing a standard script. Clients own their ad and analytics accounts and work month to month, so any tracking decision can be reviewed or reversed. MetaBaz is based at 8888 Yonge St Unit 416 in Richmond Hill and works with clinics across the GTA.

What this guide cannot tell you

MetaBaz is a marketing agency and does not give legal or medical advice. This guide summarises published positions from the OPC, the Information and Privacy Commissioner of Ontario, Meta and Google as they read when it was written. Platform policies change often, and regulators issue new guidance. Whether a specific tracking setup is acceptable for a specific clinic is a decision for that clinic and its privacy officer or counsel. We will review any proposed setup against the published wording and flag what looks risky, and the clinic’s advisor makes the final call.