In June 2022, reporters at The Markup found that searching "pregnancy termination" on a top hospital's website sent that phrase to Facebook. Most health websites and apps you use are not covered by HIPAA, the federal health privacy law, so what you search, buy or type there can reach advertisers unless the site chooses otherwise. The 5 free checks below, none of which take long, show you what a site is doing before you type a diagnosis, a medicine or a symptom into it.
Does HIPAA Protect What You Type Into Health Websites and Apps?
HIPAA usually does not cover health websites and apps. It applies to health plans, health care clearinghouses and providers that bill electronically, plus the businesses that work for them, according to the US Department of Health and Human Services (HHS). HHS also says HIPAA generally does not protect health information you enter into apps for your own use, unless a covered provider or plan gave you the app.
That leaves a large gap: symptom checkers, pharmacy discount sites, therapy and telehealth startups, period trackers and disease information sites like this one. The Federal Trade Commission (FTC) fills part of it. Its updated Health Breach Notification Rule, in force since July 29, 2024, says health apps outside HIPAA must tell users and the FTC when health data is disclosed without permission, not only when it is hacked (FTC, April 2024).
Real Cases of Health Data Shared With Advertisers
Every case below comes from a federal enforcement action, a court record or a published investigation. In the FTC settlements, the companies did not admit the allegations, and each one's own response is noted where it gave one.
- GoodRxFeb 2023 · FTCPrescription medicinesHealth conditionsContact details used to target ads→FacebookGoogleCriteo$1.5 million penalty and a ban on sharing health data for ads. GoodRx said it disagreed and admitted no wrongdoing.
- BetterHelpMar 2023 · FTCEmail and IP addressesAnswers to mental health questions→FacebookSnapchatCriteoPinterest$7.8 million for refunds; the FTC notified about 800,000 eligible customers in 2024. BetterHelp did not admit the allegations.
- Flo Health2021 and 2025 · FTC and a federal juryPeriod and pregnancy data from the app→FacebookGoogleOthersFTC order in 2021 with no payment. In August 2025 a federal jury found Meta violated California's wiretap law for California users; Meta argued users had consented, and the judge refused to overturn the verdict. Flo, Google and Flurry settled for $59.5 million in total.
- CerebralApr 2024 · FTCMedical and prescription historiesNames and addressesInsurance details→LinkedInSnapchatTikTokOthersData on nearly 3.2 million people. More than $7 million in total, mostly refunds for separate cancellation problems. Cerebral did not admit the allegations.
- MonumentApr 2024 · FTCSignals such as "Paid: Weekly Therapy"Email and IP addresses→MetaGoogleUp to 84,000 users of an alcohol treatment service. $2.5 million penalty, suspended because the company could not pay. Monument did not admit the allegations.
- 33 of 100 top hospitalsJun 2022 · The MarkupAppointment clicksSearch terms such as "pregnancy termination"→FacebookFound by reporters' testing, not a legal ruling. Meta told The Markup its filters remove sensitive data they detect.
In the 5 FTC cases here, the data went to the big ad and social platforms, usually through a tracking pixel or an uploaded customer list, and in 4 of them the FTC barred the company from sharing health data for advertising. Sources are the FTC press releases and orders for GoodRx, BetterHelp, Cerebral, Monument and Flo Health, the class counsel's court filing in Frasco v. Flo Health, The Record's report on the verdict, and The Markup's June 16, 2022 hospital investigation.
A tracking pixel is the usual route. It is a small piece of code from a company such as Meta or Google that a site adds to its pages, and it reports what you do there, often with the page address and your IP address. The Markup's December 2022 test of 50 telehealth sites found that 49 shared data with big tech companies through trackers, and on 13 of them the trackers collected answers to medical intake questions (The Markup and STAT, 2022).
Hospitals have notified patients too. Kaiser Permanente told members in 2024 that code on its websites and apps may have sent Google, Microsoft Bing and X details such as search terms typed into its health encyclopedia, and said it was not aware of any misuse (Kaiser Permanente notice, 2024). Federal guidance on this has shifted: in June 2024 a federal court in Texas struck the part of HHS's tracking guidance that covered public hospital pages viewed with an IP address, while the rest, including patient portals, still stands (American Hospital Association v. Becerra, 2024).
Data brokers are a separate market. A Duke University study asked 37 brokers for mental health data in 2023; 11 were willing and able to sell it, 1 offered names and postal addresses of people with depression, bipolar disorder and PTSD, and another quoted $275 per 1,000 records with a 5,000-record minimum (Kim, Duke Sanford School of Public Policy, 2023).
The newest federal case is still open. On July 29, 2026 the FTC, Utah and California sued Hims & Hers, alleging that it shared health information with Meta, Snap and others; the lawsuit is pending, and none of its allegations has been proven in court (FTC, July 2026).
Free Checks That Show Whether a Health Website Is Tracking You
The 5 checks are a Blacklight scan, Safari's Privacy Report, the free Privacy Badger extension for Chrome and Edge, a look at the address bar, and a search of the privacy policy. None needs technical skill, and each shows a different part of the picture, so we lined up what each tool's own documentation says it detects to show which kinds of tracking each check can and cannot reveal.
Blacklight shows 4 of the 6 kinds of tracking on its own, but only the address bar shows whether your health words travel in the web address, and only the privacy policy tells you whether the site sells or shares your data, so those 3 checks together cover all 6.
Check 1: Scan the health website with Blacklight
Blacklight, a free tool from The Markup, now part of CalMatters, loads a site in its own browser and reports ad trackers, third-party cookies, Facebook, TikTok and X pixels, session recording, keystroke capture and hidden ways of identifying your device. It starts from the site's homepage and 1 randomly chosen page, so it cannot see what happens after you log in, and The Markup says its results are a first look rather than the final word.
Check 2: Open Safari's Privacy Report
On a Mac, open Safari's menu and choose Privacy Report to see which cross-site trackers Safari blocked on each site; Safari on iPhone and iPad keeps the same report.
Check 3: Add the free Privacy Badger extension to Chrome or Edge
Chrome has no built-in tracker report, so the closest free equivalent is Privacy Badger, an extension from the Electronic Frontier Foundation, a digital rights nonprofit, with more than 1 million users in the Chrome Web Store. Click its badger icon in the toolbar on any page to see each third-party tracker it found there. Red means blocked, yellow means loaded with its cookies stripped, and green means left alone (EFF). Privacy Badger spots tracking cookies and canvas fingerprinting, one common way of identifying a device without cookies, though the EFF says detecting other kinds of fingerprinting is still in progress.
It works in Chrome, Edge, Firefox, Brave and Opera on a computer, and in Firefox and Edge on Android. Safari is not supported, and Chrome on Android does not allow extensions at all. Any tracker extension can read the pages you visit, and the EFF itself says to install only extensions from organizations you trust, so add it from the official store link on privacybadger.org and skip lookalikes. Firefox users already have a similar view without an extension by clicking the shield to the left of the address bar. Chrome blocks third-party cookies by default only in Incognito windows, though you can turn that on for all browsing under Privacy and security, then Third-party cookies.
Check 4: Watch the web address after you search or sign up
Look at the address bar after you search a symptom or submit a form. If your search words, condition or email appear in the address, any tracking code on that page can send them along, because Meta's pixel, for one, records the page address it fires on (Meta developer documentation). A disease page whose address names the disease is normal; your own typed words or email showing up there is the warning sign.
Check 5: Search the privacy policy for 5 words
Use your browser's find command on the privacy policy and search for "sell," "share," "targeted advertising," "partners" and "affiliates." Look also for a link called "Do Not Sell or Share My Personal Information" or "Your Privacy Choices," and in Washington state, a separate Consumer Health Data Privacy Policy linked from the homepage, which the state's My Health My Data Act requires of covered sites (Washington Attorney General).
Ways to Protect Your Health Data Online Starting Today
Turn on Global Privacy Control, a browser setting that tells every site you visit not to sell or share your data. Brave and DuckDuckGo turn it on by default, and Firefox offers it in Privacy and Security settings as "Tell websites not to sell or share my data" (Global Privacy Control; Mozilla). California, Colorado and Connecticut require businesses to honor it, and the California Privacy Protection Agency says California is 1 of a dozen states that require businesses to honor signals like it.
California goes further in 2027. Under the Opt Me Out Act, signed in October 2025, web browsers must offer an easy-to-find opt-out signal starting January 1, 2027 (California Privacy Protection Agency).
Consider a separate email address for health apps, newsletters and symptom checkers, such as Apple's Hide My Email, part of iCloud+, or Firefox Relay, so a leaked list does not lead back to your main inbox. Mozilla's own advice is to give your real address to your doctor, bank and lawyer, so keep your care team on your usual email (Firefox Relay FAQ).
Trial Friend Privacy Results From the Same 5 Checks
We ran Blacklight on trialfriend.com on October 13, 2026, and you can run the same scan yourself. It found no ad trackers, against an average of 7 on popular sites in The Markup's survey, and no third-party cookies, against an average of 3. It also found no hidden device fingerprinting, no session recording, no keystroke capture, no Facebook, TikTok or X pixel and no Google Analytics advertising feature (Blacklight scan of trialfriend.com, October 13, 2026).
Some data does leave your browser here, and we list it on our privacy policy. Plausible, a visit counter that uses no cookies and stores no IP addresses, receives the address of each page you view, and on a disease page that address names the disease. Trial searches go from your browser to ClinicalTrials.gov, a US government service. Our own records keep an email only if you sign up for alerts, and chats for 90 days under a random ID, with emails, phone numbers and Social Security numbers removed before a chat is saved.
Run the same checks on any site you use, including this one, and on any health app before you hand it a diagnosis. Washington residents can read what we collect and how to delete it on our Consumer Health Data Privacy Policy.
Does HIPAA protect health apps and health websites?
Most health apps and websites are not covered by HIPAA. It covers health plans, clearinghouses and providers that bill electronically, plus their business associates, and HHS says it generally does not protect health information you enter into apps for your own use. Many of those apps fall under the FTC's Health Breach Notification Rule instead, which requires notice when health data is shared without permission.
How can I tell if a website has a Facebook pixel?
Scan it with The Markup's free Blacklight tool, which reports Facebook, TikTok and X pixels along with other ad trackers. The EFF's free Privacy Badger extension for Chrome and Edge also lists the third-party trackers on the page you are viewing, and in Firefox the shield icon next to the address bar lists the social media trackers it blocked.
Can health apps sell my data?
Some can, depending on their privacy policy and state law. A 2023 Duke University study found 11 of 37 data brokers it contacted willing to sell mental health data, and Washington and Connecticut now require consent before a business sells consumer health data.
What is Global Privacy Control and does it work?
Global Privacy Control is a browser setting that tells websites not to sell or share your data. It is a request rather than a blocker, but California, Colorado and Connecticut require businesses to honor it, and those 3 states announced a joint enforcement sweep on it in September 2025.
Do hospital websites track patients?
Some hospital websites have sent visitors' data to ad companies through tracking code. The Markup found the Meta Pixel sending appointment and search data to Facebook from 33 of Newsweek's top 100 hospitals in 2022, and Kaiser Permanente notified members in 2024 that tracking code may have sent search terms to Google, Microsoft Bing and X. HHS guidance on tracking still applies to patient portals.