Answers · HIPAA & Tracking
Do consent banners make tracking pixels legal on health insurance sites?
Last reviewed: · Strategic AI Architects Data Desk · reviewed by Mike Moore
Only if the banner actually blocks every tracker until the visitor affirmatively consents — and on most sites it doesn't: the tag fires on page load, milliseconds before anyone can click, a pattern privacy litigators now describe as the dominant driver of website wiretapping suits (Loeb & Loeb, "The Millisecond Problem," April 2026). A banner displayed next to a pixel that already fired provides no consent defense at all.
And the deeper qualifier for a health insurance site: consent is only one of four frameworks in play. A correctly wired banner helps with consent-based claims like California's CIPA. It does nothing about HIPAA's Business Associate Agreement requirement, nothing about CMS's one-to-one consent rule for Medicare marketing, and it is not the separate authorization Washington's My Health My Data Act demands before consumer health data is sold. "We have a cookie banner" answers a different question than the ones regulators are asking.
What a consent banner fixes, framework by framework
| Framework | Does a banner fix it? | Why |
|---|---|---|
| CIPA / wiretapping (Cal. Penal Code §631, §637.2) | Largely, if consent precedes any firing | Consent defeats an interception claim — but only prior consent; the $5,000-per-violation exposure attaches to pre-consent firing |
| HIPAA (where the site is regulated) | No | A visitor clicking a banner is not a HIPAA authorization, and no banner creates the required BAA — Meta and Google won't sign one for Pixel/GA4 (HHS OCR guidance; Google's HIPAA policy) |
| CMS TPMO rule (CMS-4205-F, CY2025) | No | Requires prior express written consent naming each recipient TPMO individually — a banner or blanket "marketing partners" checkbox doesn't meet it |
| Washington MHMD (RCW 19.373) | Partly | Collection/sharing beyond necessity needs opt-in consent; selling health data needs a separate signed authorization; enforceable by any Washington consumer via the CPA (RCW 19.86.090) |
So the honest sequencing for a health or Medicare agency site is: first decide which tools belong on the site at all (BAA-signing or self-hosted on health pages; ad-platform tags only where Google's and HHS's own lines permit), then wire consent so nothing fires before it is given — which in practice means a server-side gate, not a JavaScript banner racing a JavaScript pixel. The FTC's GoodRx ($1.5 million) and BetterHelp ($7.8 million) orders in 2023 both involved companies whose sites had privacy policies; what they lacked was an architecture that made the promises true.
Sources
- Loeb & Loeb LLP. "The Millisecond Problem: How Pre-Consent Tracking Is Driving CIPA Lawsuits in 2026," April 2026. loeb.com.
- California Legislative Information. Penal Code §637.2, $5,000 per violation. Verified live 2026-08-17. leginfo.legislature.ca.gov.
- U.S. Department of Health and Human Services, Office for Civil Rights. "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates," revised 2024-03-18. hhs.gov.
- Google. "HIPAA and Google Analytics" — no BAA offered. Verified live 2026-08-17. support.google.com.
- Centers for Medicare and Medicaid Services. "Contract Year 2025 Medicare Advantage and Part D Final Rule (CMS-4205-F)," one-to-one consent. cms.gov.
- Washington State Legislature. RCW 19.373.030 (collection/sharing of consumer health data) and RCW 19.86.090 (Consumer Protection Act civil action). Current text. app.leg.wa.gov.
- Federal Trade Commission. GoodRx enforcement action, 2023-02-01; BetterHelp final order, 2023-07-14. ftc.gov.
This page is sourced information, not legal advice. For a compliance decision about your agency, talk to counsel who knows your state and your book of business.
Related questions
How do I check whether my banner actually blocks the pixel?
Open your site with your browser's developer tools on the Network tab, filter for facebook.com/tr, google-analytics.com, and googletagmanager.com, and reload without clicking anything on the banner. Requests appearing before you accept mean the tag fires regardless of the banner — the exact pre-consent pattern driving current wiretapping suits.
If my banner works perfectly, am I done?
Not on a health or Medicare site. A working banner addresses consent-based theories like CIPA. It does not create the Business Associate Agreement HIPAA requires of a vendor handling PHI, it does not satisfy CMS's requirement of one-to-one prior express written consent naming each data recipient, and under Washington's My Health My Data Act, selling consumer health data requires a separate signed authorization beyond consent.
Does a 'cookies policy' page or implied consent count?
For the frameworks that matter here, no. CIPA claims turn on prior consent to the interception itself; CMS-4205-F requires express written consent naming each recipient; and Washington's MHMD requires opt-in consent for collecting or sharing consumer health data beyond what's necessary for a requested service. A passive notice that tracking exists is not any of those.
Want to know where your own site stands? Run the free Audit — a live AEO audit plus a HIPAA tracking scan — or browse all answers.