We Scanned 1,286 Insurance Agency Websites for Tracking Pixels

What we did

The regulatory story is well documented: the FTC's GoodRx and BetterHelp actions², OCR's tracking-technology guidance and its partial vacatur³, Meta's and Google's refusal to sign BAAs for their standard tags⁴, and the $5,000-per-violation wiretapping claims working through California courts. What was missing was a base rate. How many ordinary insurance agency websites are actually in the exposed configuration?

So we took a working list of 1,350 U.S. insurance agency domains from our audit pipeline, fetched each site's homepage plus one quote- or contact-like interior page with a standard browser user agent, and checked the served HTML for tracking-technology signatures. 1,286 sites answered. Everything below is from that snapshot, taken August 17, 2026, and the aggregate dataset is published for anyone to check¹.

The headline numbers

Context columns: 79.0% of the sites carry health-topic vocabulary, Medicare, health insurance, ACA, life insurance, and 63.1% have a lead form on a scanned page. The population that matters for exposure analysis is the intersection: 647 sites, 50.3% of the sample, are health-topic sites with a lead form.

The 48.8% problem

Of those 647 health-topic-plus-form sites, 316, or 48.8%, run at least one client-side tracking technology: GA4, a GTM container, an ad-platform pixel, or session replay. That is the single most important number in this study. Roughly half of the agency websites built to collect health-adjacent lead information are running third-party JavaScript that can observe the visitor on those pages, and as our consent-banner answer page covers, most consent banners do not actually stop those tags from firing first.

To be precise about what this is and is not: presence of a tag is an exposure indicator, not a violation finding. Whether HIPAA itself attaches to any given agency is fact-specific. But the exposure that has actually produced enforcement and settlements, FTC Act claims, state wiretapping suits, state health-privacy statutes with private rights of action, does not require HIPAA covered-entity status at all, which is exactly why the base rate matters².

The 57 sites running a Meta Pixel

57 of the 647 health-topic-plus-form sites, 8.8%, run a Meta Pixel. The Pixel deserves its own line because it is the tag with the clearest paper trail: it is the technology named in the FTC's GoodRx and BetterHelp actions², in the joint FTC/HHS warning letter to roughly 130 health organizations, and in OCR's tracking guidance³, and Meta does not offer a Business Associate Agreement for it, so there is no configuration of the standard Pixel that satisfies HIPAA's vendor rule where that rule applies. Our answer page on the Meta Pixel on a Medicare quote form walks the full liability analysis.

The 24 sites running session replay on health-topic-plus-form pages face a different theory: wiretapping claims arguing the recording script intercepted the visitor's communications without all-party consent, at $5,000 per violation in statutory damages with no actual harm required.

What this exposure actually means

The optimistic reading of 48.8% is that half the industry has this right. The realistic reading is that most of the tracked half has never had the conversation at all: the tags were installed by a website vendor for ordinary marketing reasons, nobody mapped them against which pages collect health-adjacent information, and the rules that survived the 2024 court ruling were never checked. The fix is not abandoning analytics, it is choosing tools an agency can actually defend and keeping ad pixels off the pages where health information moves.

Why these numbers are probably undercounts

Three reasons. First, the 254 GTM sites: a Tag Manager container can load any tag its manager configures, and this scan detected the container, not its contents. Second, the scan read served HTML, so tags injected purely at runtime were not counted. Third, we scanned two pages per site; a pixel installed only on a deeper quote funnel page would be missed. Every one of those limitations biases the count downward.

Methodology and limitations

Sample: 1,350 U.S. insurance agency domains from our audit pipeline's working list, of which 1,286 served a fetchable HTML homepage. Collection: August 17, 2026; homepage plus one same-site interior page whose link matched quote/contact/medicare/coverage/apply/enroll patterns; standard Chrome user agent; 15-second timeout. Detection: HTML signature matching for fbevents.js/fbq (Meta), gtag.js (GA4), gtm.js or GTM- IDs (Tag Manager), snap.licdn.com (LinkedIn), analytics.tiktok.com (TikTok), the major session-replay script hosts, and doubleclick or AW- IDs (Google Ads). Classifications: "health topic" is a vocabulary match (Medicare, health insurance, ACA, life insurance, and related terms); "lead form" is an HTML form element on a scanned page. Limitations: static HTML only, GTM containers unresolved, two pages per site, single snapshot in time. The per-domain raw data is deliberately unpublished, see the FAQ, and available to researchers and journalists on request for verification.

Check your own site

The ten-minute manual version: developer tools, Network tab, filter for facebook.com/tr and google-analytics.com, reload without touching the cookie banner, and watch what fires. The one-minute version is our free Audit, which runs this exact tracking scan, plus an AI-visibility audit, against any domain⁵.

Questions about this study