Pixel Tracking Lawsuits: What Medical Spas Need to Know
By Patrick O’Brien, JD, and Derek Hauk, American Med Spa Association
Many medical spas, physician practices, and healthcare providers rely on website analytics and advertising tools to better understand how patients interact with their websites. Platforms such as Meta Pixel, Google Analytics, and similar tracking technologies have become commonplace across the healthcare industry. Recently, however, these tools have become the focus of a growing wave of demand letters and privacy lawsuits.
What are pixels?
When web sites began to move from being mostly text into the more graphic and content heavy designs we have now, it required more processing to load those sites into browsers. Particularly for URLs that a user returns to often or visits multiple pages during a single session, keeping portions of that page in the browser’s memory helps speed up loading times. Web browsers handle this through “cookies,” a coding term for an easily shareable batch of data. These cookies include elements like recurring graphics, the menu options, and user account information. Basically, the cookie helps the computer remember the web page so the user can access it more easily later.
Already by the late 90s, digital advertising companies recognized the capability to use these data transfers in reverse and allow the web pages to remember the user to track their customer journey across the internet. Instead of a singular cookie for a singular page, an advertising pixel attempts to recognize a user’s IP address as it triggers multiple pages. This allows platforms like Google, Amazon, Meta, and display ad companies to identify your interests and recent activity to better tailor your ads and platform experience.
Pixels are also the way that businesses, including med spas, can remarket to existing customers, attempt to fulfill abandoned carts and appointment forms, and determine the effectiveness of their advertising through conversion tracking. This technology has been in place for decades, growing more sophisticated in the kind of information it can retain, and more recently solutions have arisen that consolidate the information from separate pixels to create a truly holistic view of an internet user.
The issue
As should be clear from the previous section, the data packets being stored as cookies and pixels potentially contain very delicate information about your patients. You may have a privacy policy in place about how you manage that data within your system, but recent lawsuits show that all business owners should consider how much of their information is tracked.
The claims generally allege that these website tracking technologies improperly transmit patient information or website communications to third parties. Plaintiffs’ attorneys often argue that the use of these tools violates federal and state privacy laws, including the federal Wiretap Act, state medical privacy statutes, and, in some cases, HIPAA. According to many of these allegations, tracking tools embedded on appointment scheduling pages, patient portals, or webpages discussing medical conditions and treatments may capture information that should remain private.
Notably, the legal theories behind many of these cases remain unsettled. Several healthcare organizations have successfully challenged these claims, and courts have not uniformly accepted the argument that the routine use of website analytics constitutes unlawful interception of patient communications. Nevertheless, litigation risk remains significant because defending even a weak claim can be costly. As a result, many cases resolve through settlement before a court ever reaches the underlying merits.
For medical spas and aesthetic practices, the practical concern may not be whether a plaintiff ultimately prevails, but whether the practice becomes the target of a demand letter. Reports suggest that some law firms use automated tools to identify websites utilizing tracking technologies and then pursue claims based on alleged privacy violations. In many respects, the trend resembles prior waves of ADA accessibility claims where the expense of defending the claim often created pressure to settle.
Practices should not assume that simply having a website privacy policy and cookie consent completely eliminates the risk. Instead, providers should evaluate how tracking tools are being used, what information may be collected, whether patient-related webpages contain tracking technologies, and whether website visitors are receiving meaningful notice and consent options. Cookie consent banners, enhanced privacy disclosures, and careful review of patient-facing website functionality may help reduce exposure, although no single approach guarantees immunity from receiving a demand letter.
The bottom line is that medical spas should treat website tracking compliance as a risk area. While the law continues to develop, practices would be well served to review their websites, understand what tracking technologies are in place, and work with qualified legal counsel and website vendors to assess potential exposure before a demand letter arrives.
To stay updated on this issue and learn about many others, become an AmSpa Member and schedule a complimentary initial consult with our partners at ByrdAdatto.
