Every clinic website we inherit has a Meta pixel on it. Almost none of them have anything else — no consent mechanism, no opt-out link, no limits on what the pixel is allowed to see.
In California that is a gap with a specific shape, and it is worth understanding what the gap is before you panic about it.
Start with what HIPAA does and doesn't do
There is a widespread belief that HIPAA governs your website. Usually it does not, and the reason is worth knowing.
In December 2022 the HHS Office for Civil Rights published a bulletin saying that tracking technologies on unauthenticated pages — your public website, not the patient portal — could create HIPAA liability, because the combination of an IP address and a visit to, say, an oncology page could itself be protected health information.
In June 2024 a federal court in the Northern District of Texas vacated that portion of the bulletin, finding HHS had exceeded its authority under HIPAA. The guidance on authenticated pages — portals, anything behind a login — was not disturbed.
First: does it even apply to you?
This is the question most articles on the subject skip, and for a lot of clinics the honest answer is no.
The CCPA applies to a for-profit business that meets at least one of three thresholds, per the California Privacy Protection Agency:
- Annual gross revenue above $26,625,000. The statute says $25 million; it is adjusted for inflation every two years, and this is the figure from January 2025.
- Buying, selling or sharing the personal information of 100,000 or more California consumers, households or devices a year.
- Deriving half or more of annual revenue from selling or sharing personal information.
A single-location med spa is usually under all three.
If it applies: what California requires
The CCPA, as amended by the CPRA, treats health information as sensitive personal information. That brings a set of obligations that most clinic sites do not meet:
Notice at collection. People have to be told, at or before the point of collection, what categories you are collecting and what you do with them. A privacy policy linked in the footer is the minimum, and it has to actually describe the pixel.
The right to limit. Consumers can direct a business to limit use of sensitive personal information. That implies a mechanism. In practice this is the "Limit the Use of My Sensitive Personal Information" link people see on larger sites.
Do Not Sell or Share. Sending data to Meta for advertising purposes is, under the CPRA's definitions, generally a "share" for cross-context behavioral advertising. That triggers an opt-out.
Opt-out preference signals. California requires businesses to honor Global Privacy Control. This one is invisible and almost universally ignored, and it is the easiest to get right because a decent consent platform does it for you.
The question is not whether you may run a pixel. It is whether someone can tell you are running it and stop you.
What we set up, in order — whether or not the CCPA binds you
Below the thresholds, none of the following is a CCPA obligation. We do it anyway, for three reasons: HIPAA and the FTC do not share the CCPA's size limits, a clinic that grows crosses the device threshold without noticing, and a lean pixel produces cleaner data than a greedy one.
1. Strip the pixel back. The default Meta pixel fires on everything. On a
clinic site it should not be reading form fields, and it should not be sending
page URLs that name a condition. If your booking page is
/book/hormone-therapy, the URL itself is the disclosure.
2. Move conversions server-side. The Conversions API lets you decide exactly what is sent rather than letting a browser script decide for you. We use it on every clinic we run, and the privacy posture is a side benefit — the main reason is that roughly a quarter of browser pixel events never arrive at all.
3. Hash everything that identifies a person. Email and phone go to Meta as SHA-256 hashes, normalized first, or the match silently fails. This is Meta's requirement, not California's, but it means raw values are not in transit.
4. Put a real consent banner up. Not a cookie notice that does nothing. One that actually gates the pixel, honors GPC, and records what the visitor chose.
5. Write the privacy policy to match what you do. The most common failure we see is a policy that describes a website nobody built.
What we don't do
We do not send condition-level data to an ad platform, and we do not build audiences out of who visited which treatment page. It is technically straightforward, it works, and it is the single clearest way to end up in a news story.
Interest and behavior targeting inside Meta gets you most of the way there without any of it. Our clinic campaigns are built on the offer and the creative doing the qualifying, not on knowing something about the person before they arrive.
If you have a pixel on a California clinic site and nobody has ever talked to you about any of this, that is worth a look. We will tell you what is actually on your site, and you can take that to whoever you like.