A 2026 audit of 59 major U.S. hospital and clinic websites found that 73% continued running advertising or marketing trackers even when visitors' browsers signaled that they didn't want their personal information sold or shared.

The findings come as millions of Americans prepare to choose health insurance for 2027. With Medicare open enrollment running through December 7 and marketplace enrollment underway, many will visit hospital websites to check whether their doctors are covered, search for specialists, or schedule appointments, often without realizing that advertising tools may be collecting information about their visits.

Clym reviewed the audit alongside academic research and previous investigations to examine how hospital websites handle visitors' information.

What did the audit find?

Piwik PRO and Verified Data analyzed up to 25 pages per hospital website using a California-based browser with Global Privacy Control enabled.

Global Privacy Control is a browser setting that tells websites not to sell or share your personal data. Twelve states, including California and Colorado, require certain businesses to honor that request.

Here is what the researchers found with the switch turned on:

• 43 of 59 hospital sites, or 73%, still ran advertising or marketing trackers.
• 41 of 59, or 69%, placed marketing or advertising cookies, the small files that let advertisers recognize your browser later.
• The researchers counted 75 different tracking tools across the sites, about half of them built for advertising.
• Google's advertising platform appeared on 33 of the 59 sites, more than half. Tools from Facebook, Microsoft and Adobe also showed up.

The audit looked at which tools were running. It did not test whether any individual patient's health information was actually passed along.

What can a tracker on a hospital website see?

Tracking pixels are small pieces of code that collect information about your website visits, including pages viewed, clicks, and device details. Companies use them to measure website activity and target advertising.

On a shopping website, tracking might lead to an ad for shoes you viewed. On a hospital website, it could reveal visits to pages about cancer treatment, fertility specialists, or medical appointments.

This has happened before. In 2022, the nonprofit newsroom The Markup tested the websites of Newsweek's top 100 U.S. hospitals and found that 1 in 3 sent details to Facebook when someone booked an appointment. It also found Facebook's tracking code inside the password-protected patient portals of seven health systems.

The same advertising tools are common across the web, so the lesson isn't limited to hospitals. Health insurers, pharmacies, clinics and telehealth services are all places people visit during enrollment season, and any of them can carry the same kind of code.

Does tracking put patient data at greater risk?

A Rutgers Business School study of 1,201 hospitals found that roughly 2 in 3 used third-party tracking pixels. Those hospitals were 46% more likely to experience a data breach, while hospitals using their own analytics tools showed no such increase.

The cost of getting this wrong has been high. The Piwik PRO report counts 19 enforcement cases involving health care tracking tools from 2023 to 2025, with more than $100 million in penalties.

Why do hospitals still use these tools?

Hospitals may inherit tracking tools from outside agencies or past advertising campaigns. “Healthcare organizations often inherit their analytics setup rather than actively choose it,” said Brian Clifton, founder of Verified Data.

The audit's authors recommend that hospitals remove advertising pixels from pages about medical conditions, appointment booking, and patient portals, and set up their sites so the "don't sell or share" signal actually switches trackers off.

What can hospitals do to protect visitor privacy?

Hospitals can start by reviewing which tracking tools operate on their websites and what information those tools collect. Advertising pixels, analytics software, and third-party scripts may be active on pages involving medical conditions, appointment scheduling, or patient portals.

A few steps can help reduce the risks:

• Review website trackers. Identify which tools collect visitor information, where that information goes, and whether each tool is necessary.
• Check consent settings. Test whether tracking tools respond to visitors' privacy choices and browser signals. A cookie banner alone does not mean tracking has stopped.
• Understand HIPAA requirements. When tracking involves protected health information, hospitals must have a permitted reason to share that information. Some disclosures require a HIPAA-compliant authorization, which a standard cookie banner cannot replace.
• Review third-party vendors. Check whether tracking providers receive patient information and whether business associate agreements are required.

The consequences can extend beyond privacy complaints. Improperly sharing patient information may expose hospitals to regulatory investigations, financial penalties, lawsuits, and reputational damage.

The Department of Health and Human Services warns that hospitals remain responsible for protecting patient information when using third-party tracking technologies.

How can you protect yourself while shopping for a plan?

The audit shows the browser signal is often ignored, so it works best as one layer among several:

• Turn on the signal anyway. Brave and DuckDuckGo enable Global Privacy Control automatically, while Firefox users can turn it on in settings. Chrome and Safari users can add it through a browser extension such as Privacy Badger.
• Say no to the cookie pop-up, too. Cookie pop-ups typically use a consent management platform, a software designed to manage visitors' privacy choices and control tracking tools. When properly configured, these platforms should stop certain trackers when you decline. However, if the website's tracking tools aren't configured correctly, some may continue running even after you click "no."
• Block third-party cookies, but don't count on that alone. The small gap between the audit's 73% and 69% figures suggests some trackers work without cookies.
• Know what private browsing does. Incognito mode hides your browsing history from other users of your device, not from website trackers.
• Read the privacy notice. Hospital websites typically link to one at the bottom of the page, and it should explain which outside companies receive visitor data.

Medicare open enrollment runs Oct. 15 through Dec. 7, and marketplace enrollment runs Nov. 1 through Jan. 15. That's a lot of time spent on health websites. For now, the audit suggests that clicking "no" online doesn't always stop tracking.

This story was produced by Clym and reviewed and distributed by Stacker.