Can a Treatment Center Use Meta Pixel or GA4 on Its Website in 2026?

A 2024 federal ruling narrowed OCR's guidance on tracking under HIPAA, and it is easy to read as clearing the Meta Pixel and Google Analytics 4 on public pages. The ruling did less than that. For a federally assisted substance use program, 42 CFR Part 2 still covers applicants' intake records, Washington's My Health My Data Act reaches browsing data HIPAA may not, and Google's and Meta's terms bar sending health information. Here is each rule, page by page, for Oregon and Washington programs, and the setup we use.

What did the 2024 court ruling actually change?

The HHS Office for Civil Rights (OCR) set out its view of pixels in its bulletin on online tracking technologies, revised March 18, 2024. On June 20, 2024, in American Hospital Association v. Becerra, the Northern District of Texas declared one piece unlawful and vacated it: the position that HIPAA applies where a tool connects a visitor's IP address with a visit to a public page about specific health conditions or providers. The government appealed on August 19, 2024, moved to dismiss its own appeal on August 29, and the Fifth Circuit dismissed it as of September 4. The bulletin now carries a notice of the order and says HHS is evaluating its next steps.

The court said the vacatur does not limit the rest of the guidance, which is where a program's HIPAA exposure sits:

• Logged in pages generally carry PHI. Tracking on authenticated pages, such as a patient portal or telehealth platform, generally has access to protected health information.
• Some public pages do too. A page where people schedule an appointment without logging in may let a tracker collect PHI, such as an email address or the reason someone is seeking care.
• A vendor that receives PHI needs a business associate agreement. A BAA and a Privacy Rule permission must come first; a privacy policy notice does not permit it.
• A cookie banner is not an authorization. Sending PHI to tracking vendors for marketing without a HIPAA authorization is impermissible, and a vendor's promise to strip out PHI after it arrives is not enough.
• Security Rule first. OCR says it prioritizes Security Rule compliance in tracking investigations, so we list every tag in the Security Rule risk analysis.

Which pages on a treatment center website can carry tracking?

Why does 42 CFR Part 2 raise the bar for substance use programs?

The Texas ruling interpreted HIPAA and says nothing about 42 CFR Part 2. A program is covered when it holds itself out as providing, and provides, SUD diagnosis, treatment or referral and is federally assisted, which includes Medicare participation, a federal registration to dispense controlled substances for SUD treatment, and tax exempt status. In the 2024 final rule, HHS wrote that most SUD programs are federally assisted and that holding out can depend on how a program publicizes its services, so your site can be evidence. Four provisions matter:

• Applicants are patients. A patient is anyone who has applied for or been given SUD diagnosis, treatment or referral at the program, and the rule expressly covers referral and intake information.
• Disclosure is about identification. To disclose means to communicate information identifying a patient as having an SUD or as referred for treatment, and a facility publicly known as SUD only may not acknowledge an identified patient's presence without written consent or a court order. In our view, an intake lead event that an ad platform matches to a person can be a disclosure.
• Consent is a signed document. It must name the patient, recipients and purposes and carry an expiration and a signature; each disclosure adds a redisclosure notice. HHS refused even verbal consent for intake disclosures.
• A bad disclosure is presumed a breach. Since February 16, 2026, HIPAA's breach rules cover unsecured Part 2 records, and a disclosure Part 2 does not permit is presumed a breach unless a risk assessment shows otherwise. Patients get notice without unreasonable delay and within 60 days; OCR uses HIPAA penalty tiers.

A Part 2 program whose website provides information about its services or benefits must also post its Part 2 patient notice prominently on the site. Our guide to the 2024 Part 2 rule covers the rest.

What do Washington and Oregon add?

Washington's My Health My Data Act (chapter 19.373 RCW) has no size floor. Consumer health data includes data identifying a consumer seeking health care services and health inferences from nonhealth data; personal information includes a cookie ID, IP address or device identifier. Any Washington resident counts, so an Oregon program marketing to Clark County may be in scope. Unless the data is needed for a service the consumer asked for, a program needs consent for a specified purpose before collecting it and a separate consent before sharing it, and accepting general terms of use is not consent. A consumer health data privacy policy must be linked from every page that collects personal information. The act exempts PHI, Part 2 information and health care information under Washington's health records law; whether the public page data the Texas ruling addressed falls outside all three is unsettled, so ask counsel first. The Washington Attorney General treats a violation as a per se Consumer Protection Act violation, enforceable by the state and by private lawsuit. The act also bans geofences within 2,000 feet of an in person health care facility used to track people seeking care or send them health ads, so a geofenced campaign around a competitor's facility is unlawful in Washington. Our Washington work starts here.

The Oregon Consumer Privacy Act (ORS 646A.570 to 646A.589) applies only above its thresholds: personal data of 100,000 Oregon consumers a year, or 25,000 while earning 25 percent of revenue from selling data, with nonprofits covered since July 1, 2025. It excludes PHI and Part 2 information handled under those rules. Where it applies, data revealing a mental or physical condition or diagnosis needs consent first, and inaction is not consent. Visitors can opt out of targeted advertising, and the Oregon Department of Justice says opt out preference signals must be honored since January 1, 2026, when the cure period ended. Only the Attorney General enforces it, at up to $7,500 per violation.

What do Google's and Meta's own rules say?

• Google Analytics. Google's HIPAA and Google Analytics page offers no BAA, tells HIPAA regulated entities not to expose data that may be PHI, and bars tags on authenticated and other HIPAA covered pages. Google reads PII as information that could on its own directly identify, contact or precisely locate someone, and says to withhold PHI even when it is not PII.
• Google Ads. Google treats health as a sensitive interest category, naming counseling for mental health and addiction, and advertisers in it cannot use remarketing segments, Customer Match or lookalike segments.
• Meta. The Meta Business Tools Terms cover the Pixel and the Conversions API and bar data that includes or is based on health information, including in event, conversion and audience names. Meta's prohibited information list names mental health, medical treatments and locations that identify places of treatment and counseling, Meta may block events from domains that mainly serve people likely to be suffering from addiction, and from September 2, 2025 it said it would flag custom conversions that may suggest prohibited information.

What has enforcement looked like?

The Federal Trade Commission brought three of the cases below, and the Opioid Addiction Recovery Fraud Prevention Act gives it civil penalties for unfair or deceptive practices in SUD treatment services, including referrals and recovery housing.

It has not stopped: on July 29, 2026 the FTC, Utah and California sued Hims & Hers, alleging it shared health information with ad platforms, including through website tracking. That case is pending.

How should a treatment program set up tracking in 2026?

• Inventory every tag. List each pixel, analytics tag, chat widget and call tracking script, where it fires and what it sends.
• Clear the intake path. Remove ad and analytics tags from insurance verification, callback, intake, scheduling, chat, portal and thank you pages, and send submissions to your admissions CRM under a BAA or qualified service organization agreement, never to an ad platform.
• Strip meaning from what remains. Keep URLs, titles, search terms, UTM values and event names free of names, contact details, substances and levels of care.
• Measure admissions in your own systems. Count inquiries and admissions by campaign in your CRM instead of sending lead events back to the ad platform.
• Get consent right by state. Collect opt in consent, with a separate sharing consent, from Washington visitors, honor opt out signals for Oregon, and post the Washington consumer health data privacy policy and your Part 2 notice.
• Write it into vendor contracts. No geofencing in Washington, a BAA or qualified service organization agreement wherever data flows, and compensation not tied to admissions, which our EKRA guide explains.
• Drop the badge. Do not call your site HIPAA compliant. A seal suggesting HIPAA compliance was part of the FTC's 2023 case against GoodRx, and Monument's HIPAA claim was part of its case.

Frequently asked questions

Is Google Analytics HIPAA compliant?

Google makes no representation that it is and offers no business associate agreement for Google Analytics. It tells HIPAA regulated entities not to expose data that may be protected health information through Analytics and not to place Analytics tags on authenticated pages or other HIPAA covered pages, which can include public pages related to providing care.

Did the 2024 court ruling make pixels on public pages safe?

Not by itself. The court vacated only the part of OCR's bulletin that treated an IP address plus a visit to a public page about specific health conditions or providers as triggering HIPAA, and left the rest in place. Part 2 for substance use programs, the FTC Act, Washington's My Health My Data Act and the platforms' terms can still apply.

Does moving to Meta's Conversions API avoid the problem?

No. Meta's Business Tools Terms cover the Pixel and the Conversions API alike and bar sending data that includes or is based on health information. Sending events from your server changes how the data travels, not what you may send.

Does Washington's My Health My Data Act apply to a small treatment program?

Yes, if it does business in Washington or markets to Washington residents. There is no size floor; a small business only had a later compliance date, June 30, 2024. It exempts HIPAA PHI, Part 2 data and RCW 70.02 health care information, not other consumer health data a website collects.

Can we retarget website visitors with Google Ads?

Not with your own audience lists. Google treats health, including counseling for mental health and addiction, as a sensitive interest category, and advertisers in it cannot use remarketing segments, Customer Match or lookalike segments. Addiction treatment advertisers also need LegitScript and Google certification.

Market the program without exposing the people it serves

A tag setup is a compliance decision before it is a marketing one. We build admissions and marketing infrastructure in that order: consent, contracts and the tag inventory first, then campaigns, including the LegitScript certification Google requires for addiction treatment ads. Our marketing and admissions team reviews your tags, tracking and intake workflows against these rules, rebuilds them, writes the policies and trains the admissions staff who work them.