You are not a hospital. That did not save them.
Two FTC actions, five weeks apart, $9.3 million between them. Neither company was covered by HIPAA. Both were undone by tracking code sitting on an intake page.
Almost every clinic owner I speak to believes the same thing: HIPAA applies to doctors and hospitals, and a marketing pixel is a marketing problem, not a legal one.
The FTC spent early 2023 dismantling that assumption. It did not need HIPAA. It used its own authority, and it went after the exact setup that sits on most clinic websites right now — a plug-and-play pixel dropped on every page, including the pages where patients answer questions about their bodies.
FTC v. GoodRx Holdings
The first enforcement action ever brought under the Health Breach Notification Rule — a rule on the books since 2009 that had never been used. The agency alleged GoodRx used off-the-shelf tracking pixels and SDKs that handed identifiable health information to Facebook, Google and Criteo, after telling users in its own privacy policy that it would never share health information with advertisers.
The order carried a remedy the FTC had never imposed before: a flat prohibition on sharing user health data with third parties for advertising, permanently.
FTC v. BetterHelp
The agency alleged the online therapy company disclosed email addresses, IP addresses and intake questionnaire answers to Facebook, Snapchat, Pinterest and Criteo for advertising. In one stretch it allegedly handed Facebook lists of over seven million email addresses; Facebook matched more than four million of them to real accounts and targeted those people and lookalikes.
The $7.8 million went back to consumers — the first time the FTC returned money directly to people whose health data was exposed.
The part that should stop you cold
In the BetterHelp matter the FTC took the position that a consumer's email address was itself health information — not because the email contained anything medical, but because of where it came from. Anyone receiving it could tell the owner had been seeking mental health services. Context made ordinary data into health data.
That single move is what puts a med spa in the same category as a telehealth platform. You do not have to transmit a diagnosis. You only have to transmit an identifier from a page whose subject matter is obvious.
Where the pixel goes, and where it does not
None of this means running without tracking. It means the tracking stops at the door of the clinical conversation. Here is the difference between a setup that would draw a look and one that would not.
Every line above ties a real person to a health context and hands it to an ad platform. Two of them do it in plain text, inside the event name and the URL.
You still measure what an ad produced. What you stop sending is the pairing of a named person with the medical reason they showed up.
The event name and the URL matter more than people expect. Both travel to the ad platform as text. A campaign structure organized around condition names is a written record of who came looking for what.
Three questions worth answering this week
- Does your privacy policy already promise something you are not doing? Both cases turned on the gap between the promise and the code. GoodRx's policy said health information would never go to advertisers. That sentence became the violation. Read your own policy against your actual tag setup before anyone else does.
- Where exactly does the pixel stop firing? Not "we have a pixel" — the specific page. If the answer is that it runs everywhere because that is the default install, it is running on your intake.
- Who at your practice decided what gets sent to Meta? In the BetterHelp complaint the FTC pointed out the decision sat with someone with almost no marketing training. Nobody sets out to leak health data. It leaks because the decision was never really made by anyone.
The cost of getting this right is an afternoon of tag configuration. The cost of getting it wrong is a civil penalty, a permanent prohibition on how you advertise, and the letter that tells your patients what happened.