If your practice website runs a Meta Pixel, a Google Ads tag, or any other third-party tracking tool, the Privacy Act now expects three things most allied health sites do not do: a notice about the tracking the moment someone arrives, express consent before the pixel fires, and no advertising back to visitors without that consent. In June 2026 the Privacy Commissioner found that Monash IVF and Medmate had breached the Act on exactly those points. Nothing in the reasoning was specific to fertility or telehealth. It applies to any website offering a health service, and the small business exemption has never covered health service providers, so the size of your practice is no defence. The good news is that most practices get very little from these tools, and removing them is a smaller job than making them compliant.

This post is general guidance, not legal advice. The determinations are public, and so is the Office of the Australian Information Commissioner’s (OAIC) guidance on tracking pixels. How they apply to your practice may need advice from a privacy lawyer or your professional association.

What the Commissioner decided in June 2026

On 11 June 2026 Privacy Commissioner Carly Kind handed down two determinations, one against Monash IVF and one against Medmate, an online telehealth and prescription service. Monash IVF was running up to seven tracking tools at once, including the Meta Pixel, Google Ads, Google Analytics 4 and Hotjar, and pixels had been on its site since 2012. Medmate ran Meta and TikTok pixels with Meta’s Advanced Matching switched on, which sends hashed contact details from web forms so the platform can tie a visit to a named account.

The investigations grew out of a scan the OAIC ran in late 2024 across 50 Australian health service provider websites. Of those, 96% used some form of tracking technology, 52% used a third-party pixel, and 77% of the sites with pixels did not mention them in their privacy policy. Every one of the 12 sites the OAIC examined closely had a Meta Pixel. One provider, contacted after the scan, found 50 active pixels on its site that it had never authorised or known about.

Five findings matter for a practice website.

Visiting a health website is itself health information. When someone browses pages about conditions, treatments or appointments on a health service site, the record of that visit reveals, or lets a platform infer, something about their health. That makes it sensitive information under the Act, which cannot be collected without consent.

You are the collector, even though the data lands on Meta’s servers. The organisation that commissions and configures the pixel holds the information and is responsible for what it sends.

A privacy policy is not notice. The Commissioner expects a banner or pop-up at the point of entry that specifically mentions tracking pixels, names the platforms receiving the data, and says it is used for advertising. A generic cookie pop-up does not do the job.

Retargeting is direct marketing. Showing ads to people because they visited your site is direct marketing, and direct marketing that relies on sensitive information needs consent first.

Hashing does not help. Several providers in the scan assumed that hashing names and phone numbers before sending them meant no personal information left the site. The OAIC called that misguided: the platforms hash the same details on their side and match them.

The orders were not a fine. Both organisations must stop collecting sensitive information through pixels within 60 days, destroy what they already hold where the law allows, and put proper notice and consent in place before switching anything back on. A determination is a public finding that an organisation broke the law, and the OAIC has asked every organisation covered by the Act to review its own pixels in light of these two.

Why this covers a two-room practice in the suburbs

The Privacy Act’s $3 million small business exemption does not extend to health service providers. Any organisation that provides a health service and holds health information is covered regardless of turnover, and the OAIC’s own examples include psychology, physiotherapy, occupational therapy, speech pathology, podiatry, audiology, social work, and complementary therapies such as chiropractic and massage. A sole practitioner with a two-day diary has the same obligations on this point as Monash IVF.

It is worth being concrete about what a pixel sends. Every page a visitor opens is reported to the platform by its address, and on a practice website those addresses read like a case note: /services/anxiety-and-panic, /adhd-assessment-adults, /book/telehealth-psychology. Sent alongside a browser identifier, or a hashed email from your enquiry form, that is enough to attach “looking at ADHD assessment” to a named person’s profile. That is not a side effect. It is the whole purpose of the tool, and on a health site that purpose is the problem.

Meta has since tightened its own rules, classifying advertisers as health and wellness businesses from early 2025 and restricting what their pixels can send. That reduces the exposure, but it is Meta’s decision about Meta’s data, it depends on Meta classifying your site correctly, and it does nothing about the notice and consent the Act requires from you.

How pixels end up on practice websites without anyone deciding

Almost no practice owner chose to send patient browsing data to an advertising company. The pixels arrive by other routes.

A field in the website builder. Squarespace and Wix both have a settings box where you paste a Meta Pixel ID, and Google’s tags are one click away. Once filled in, they fire on every page, including the booking page.
A campaign that ended. An agency ran a Facebook or Google Ads campaign in 2022 and installed the pixel to measure it. The campaign ended. The pixel did not. Monash IVF’s tracking went back twelve years.
Google Tag Manager. A container installed once becomes a place where anyone with access can add tags, and nobody keeps a list.
“Just to see heatmaps.” Session recording tools such as Hotjar replay a visitor’s movements through a page, including a booking or intake form.
The booking widget. Cliniko and Zanda can pass booking events through to Google Analytics if that integration is switched on. Useful for measurement, but your booking flow is then reporting somewhere too.

None of these is malicious, and all of them are invisible from the front of the site. That is why the first step is to look.

Check what your site is sending

This takes about fifteen minutes and no technical skill.

Run a scan. Blacklight, a free tool from the newsroom The Markup, takes a web address and reports the ad trackers, third-party cookies, session recorders, and Meta or Google data sharing it finds. Run it on your home page, a service page, and your booking page separately, because pixels are often set to fire only on particular pages.
Check the builder. In Squarespace, look under Marketing for the Facebook Pixel and Google settings. In Wix, look under Marketing Integrations. In WordPress, look through the plugins for anything with “pixel”, “tag”, “analytics” or “ads” in the name.
Open Tag Manager and ask whoever built the site. List every tag in the container and every third-party script on every page, with who added each one and why. Expect blanks.

The result is a short table: the tool, the pages it runs on, who receives the data, and who asked for it.

If you keep a pixel, this is what the Act now expects

Some practices run advertising that genuinely depends on measurement, and this is a decision rather than a prohibition. If you keep an advertising pixel, this is what compliant looks like.

Notice at the door. A banner or pop-up on arrival that says, in plain words, that the site uses tracking pixels, names the platforms, and says the information is used for advertising. This is in addition to the privacy policy, not instead of it.
Consent before the pixel loads. “By continuing to use this site you agree” is not consent, and neither is a pre-ticked box. The pixel has to be held back until the visitor opts in, which a consent management tool or Tag Manager’s consent settings can do.
Advanced Matching off. Do not send hashed names, emails or phone numbers from your forms to an advertising platform.
No audiences built from visitors without consent. Custom and lookalike audiences built from site traffic are direct marketing. If people did not opt in, do not build them.
A privacy policy that names the tools. Which tools, what they collect, who receives it, how to opt out, and when it was last reviewed. From 10 December 2026 the policy must also describe any computer program that makes, or substantially contributes to, decisions that significantly affect a person. A calendar embed does not qualify; an automated intake tool that screens who can be seen might.

Do the same review for analytics. Google Analytics was one of the seven tools on the Monash IVF site. The determinations do not say analytics is unlawful, but “it is only analytics” is not a defence when the tool receives page addresses that reveal what a visitor was looking at. Configure it to collect less, or use a tool built not to identify anyone.

The simpler option is to take it off

For most allied health practices the honest answer is that the pixel is not earning its keep. A practice with full books and referral-driven intake gains nothing from retargeting, and retargeting people who looked at a psychology website is precisely the conduct the Commissioner found unlawful. What you lose by removing it is a measurement most practices were not looking at anyway.

What you keep is a faster site, because every one of these scripts adds weight a visitor’s phone has to download before the booking button works. Our guide to page speed for practice websites covers why third-party widgets are usually the first thing to cut.

If you want to know where bookings come from, there are ways to learn that without following anyone around the internet.

Privacy-preserving analytics. Cloudflare Web Analytics, Plausible and Fathom count visits without cookies or identifying individual visitors, for nothing or a small monthly fee, and show which pages people read and where they came from. That is nearly everything a practice actually uses.
Tagged links. Tag the links in your Google Business Profile, directory listings and ads so your analytics shows which ones bring bookings.
Ask. A “how did you hear about us” field in the intake form your booking system already sends is the most reliable attribution a practice can get, and it involves no third party at all.

If you run paid ads and need conversion measurement, Google Ads can record a conversion on the booking confirmation page without remarketing, and Google’s consent mode keeps its tags dormant until someone opts in. That is the compliant version, and it still needs the notice and consent above.

A 20-minute audit

Run Blacklight on your home page, one service page, and your booking page. Keep the reports.
List every tag in your builder settings, Tag Manager container and plugin list, with an owner and a purpose for each.
Remove anything with no current owner or purpose. This will be most of the list.
If you keep an advertising pixel, gate it behind an opt-in banner that names the platforms, switch off Advanced Matching, and stop building audiences from visitors.
Replace Google Analytics with a cookieless tool, or configure it to collect the minimum.
Rewrite the tracking section of your privacy policy to name every tool that survived, date it, and set a six-monthly reminder. Add the 10 December 2026 automated decision-making note while you are there.
Check the booking page on its own. It is where the person has decided to trust you, and the page most likely to carry a tag someone forgot.

Patients arrive at a practice website at a vulnerable moment and assume the visit is between them and you. Since June 2026 that assumption has a public finding behind it, and making it true is mostly a matter of removing things, which is a rare and welcome shape for a compliance job to take.

At ABCS we build practice sites so that what runs on them is a decision rather than a default: no third-party tracking unless there is a reason for it, cookieless analytics where measurement is wanted, and an advertising pixel only behind a consent layer built for it.

Tracking pixels on allied health websites: what the OAIC's 2026 rulings mean for your practice