What a Tracking Pixel on a Health Website Sends

Answer first: the address of the page is the information

A tracking tag is code a site loads from somebody else. Your browser fetches it, runs it, and sends a small report back to whoever wrote it.

On an ordinary retail page that report is dull. It says a browser looked at a product.

On a health page the same report is not dull at all. The address of the page can name a medication, a condition, or a step in an intake, and the report carries that address.

So the interesting question is rarely whether a company typed your diagnosis into a form field and mailed it somewhere. It is whether an identifier and a page address left together, and what the receiving company was allowed to do with the pair.

Two state definitions of the thing being collected

Washington's health data statute defines personal information as information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with a particular consumer.

It then names the examples, and the examples are the ordinary furniture of web measurement. The definition includes data associated with a persistent unique identifier, such as a cookie identifier, an internet protocol address, a device identifier, or any other form of persistent unique identifier.

California's consumer privacy statute reaches the same equipment by a different route. Its definition of a unique personal identifier names cookies, beacons, pixel tags and mobile advertising identifiers among the persistent identifiers that can recognize a consumer or a device over time and across different services.

Neither definition asks whether the identifier is a name. Both ask whether it can be used to recognize the same person or device again, which is what these identifiers exist to do.

Collecting, under a definition written to be hard to escape

The Washington act defines collect as to buy, rent, access, retain, receive, acquire, infer, derive, or otherwise process consumer health data in any manner.

Read the verbs. Access is in there, retain is in there, and so are infer and derive. A definition built that way does not turn on whether a company meant to gather anything.

Consumer health data under the same act means personal information linked or reasonably linkable to a consumer that identifies past, present or future physical or mental health status.

The statute then lists what health status includes, and one item names this market directly: use or purchase of prescribed medication. Individual health conditions, treatment, diagnoses and diagnostic testing are on the list too.

A separate item on that list covers information that is derived or extrapolated from nonhealth information. The statute spells out what it means by that: proxy, derivative, inferred or emergent data produced by any means, including algorithms or machine learning.

That clause is the one worth sitting with. Under it, information that was not about health when it was gathered becomes consumer health data at the moment somebody uses it to associate you with something on the list.

Why "we do not sell your data" can be true and beside the point

The California statute defines selling in familiar terms. It covers making personal information available to a third party for monetary or other valuable consideration.

Then it defines a second word, and the second word is the one that matters here. Sharing means making personal information available to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.

The definition closes the obvious gap in its own text. It expressly includes transactions between a business and a third party for cross-context behavioral advertising for the benefit of the business in which no money is exchanged.

Cross-context behavioral advertising is itself defined. It means targeting advertising to a consumer based on personal information obtained from that consumer's activity across businesses, websites, applications or services other than the one the consumer intentionally interacts with.

So a sentence promising that a company does not sell your information can be completely accurate while the arrangement a reader worries about is happening under the other word.

Washington draws its own line in the same place. Sharing there means to release, disclose, disseminate, divulge, make available, provide access to, license or otherwise communicate consumer health data to a third party or an affiliate.

Who counts as a third party, and who does not

Both statutes carve out the vendors a company hires to run its own operations, and both draw the carve-out narrowly.

In California a third party is a person who is not the business the consumer intentionally interacts with, not a service provider to that business, and not a contractor. The service provider definition then requires a written contract that prohibits selling or sharing the information, prohibits retaining or using it for any other purpose, and prohibits combining it with information received from other clients.

Washington excludes a disclosure to a processor where the sharing is to provide goods or services consistent with the purpose the data was collected for and disclosed to the consumer.

It also excludes a disclosure to a third party the consumer has a direct relationship with, but only where three things hold at once. The disclosure is to provide a product or service the consumer requested. The regulated entity keeps control and ownership of the data. And the third party uses it only at that entity's direction, consistently with the purpose the consumer consented to.

The label a company uses does not decide this. Whether an advertising platform is a service provider or a third party turns on the contract terms the definitions describe, not on the word in a policy page.

What the Washington act says consent is, and what it says consent is not

The act defines consent as a clear affirmative act signifying a freely given, specific, informed, opt-in, voluntary and unambiguous agreement, which may include written consent given electronically.

It then lists three ways consent may not be obtained, and the list reads like a description of ordinary web design.

Consent may not be obtained by a consumer's acceptance of a general or broad terms of use agreement, or a similar document, that contains descriptions of personal data processing alongside other unrelated information.

It may not be obtained by a consumer hovering over, muting, pausing or closing a piece of content. California says the same about the same four gestures in its definition of intentionally interacting.

And it may not be obtained through the use of deceptive designs. The act defines a deceptive design as a user interface designed or manipulated with the effect of subverting or impairing user autonomy, decision making or choice.

The consent architecture is then split in two. A regulated entity may not collect consumer health data without consent for a specified purpose, and may not share it without a consent that is separate and distinct from the one obtained to collect.

The consent request has required contents

A request for consent under that act has to clearly and conspicuously disclose four things before the collecting or sharing happens.

The categories of consumer health data being collected or shared. The purpose, including the specific ways the data will be used. The categories of entities it is shared with. And how the consumer can withdraw consent from future collection or sharing.

Either alternative to consent is narrow. The act permits collection or sharing without consent only to the extent necessary to provide a product or service the consumer has requested.

Necessary to provide the product is a demanding standard on its own terms. A measurement or advertising arrangement is a different kind of purpose from filling an order, and the statute makes the distinction the hinge.

The rule about standing outside a clinic

One section of the Washington act is about physical space, and it is short enough to quote almost whole.

It is unlawful for any person to implement a geofence around an entity that provides in-person health care services, where the geofence is used for three named purposes. To identify or track consumers seeking health care services. To collect consumer health data from consumers. Or to send notifications, messages or advertisements related to their consumer health data or health care services.

A geofence is defined by the same act as technology that establishes a virtual boundary around a physical location, or that locates a consumer inside one. The technologies it names include positioning coordinates, cell tower connectivity, cellular data, radio frequency identification and wireless network data, along with any other form of spatial or location detection.

The definition puts a number on it. For this purpose a geofence means a virtual boundary of two thousand feet or less from the perimeter of the physical location.

This one matters even for a service delivered entirely online, because location data does not care how you buy your medication. The act's definition of consumer health data separately includes precise location information that could reasonably indicate an attempt to acquire or receive health services.

What a reader can actually look at

Whether the site publishes a document that names categories of third parties it shares health information with, rather than describing sharing in general terms.

Whether the page that collects your information has a visible link to that document. The Washington act requires a regulated entity to prominently publish a link to its consumer health data privacy policy on its homepage. It then defines homepage to include any web page where personal information is collected.

Whether anything in the flow asks separately about sharing, or whether one box at signup is expected to carry everything.

Whether there is a stated way to withdraw consent and a stated way to ask what has been shared and with whom.

And whether the policy distinguishes selling from sharing at all. A document that only ever denies selling has not answered the question the second definition asks.

What this does not decide

It does not say that any company runs any tag, or that any company does not. Nothing here is a finding about a business.

It does not say either statute applies to a company you are looking at. Both are state laws with their own reach and their own exemptions, and scope is a separate question with a separate answer.

It does not describe the law of any state other than the two named. Other states have passed health privacy and consumer privacy statutes with different definitions, and none of them is quoted here.

And it is not legal advice. It reports what four provisions say, which is a different thing from advice about your situation.