CookieGate
Start free trial

Australia’s privacy regulator treats tracking pixels as a consent problem, not a cookie problem

4 min read By Comply Ark

In this post

What happened

Australia’s Privacy Commissioner has found that two health providers interfered with individuals’ privacy by running third-party tracking pixels on their websites. The determinations, against telehealth provider Medmate Australia Pty Ltd ([2026] AICmr 41) and fertility provider Monash IVF Pty Ltd ([2026] AICmr 40), are dated 11 June 2026 and were published by the Office of the Australian Information Commissioner (OAIC) on 24 June 2026.

Both entities were found to have breached three Australian Privacy Principles: APP 3.3, by collecting sensitive information without consent; APP 5.1, by failing to take reasonable steps to notify individuals of the collection; and APP 7.1, by using or disclosing sensitive information for direct marketing without consent.

Monash IVF ran seven third-party pixels at various times: Meta, Google Ads, Google Analytics 4, Matomo, Jet Interactive, Hotjar and Pinterest, some from as early as July 2012 through to December 2024. The data sent included full URLs, among them pages about specific fertility and reproductive health services, along with IP addresses and device and browser information. Medmate’s site carried Meta and TikTok pixels, which sent full URLs, phone numbers and hashed email addresses. Those URLs sometimes included the health condition or medication a visitor was looking for.

The Commissioner ordered both providers to stop collecting sensitive information through tracking pixels within 60 days, until compliant consent and notification measures are in place; to destroy, where legally permitted, the sensitive information held in their pixel provider dashboards; and to confirm compliance to the OAIC within 90 days. No financial penalty was imposed.

The sweep behind the rulings

Alongside the determinations, the OAIC published Your life, pixelated: how tracking pixels watch your every click, reporting on a sweep of 50 health service provider websites in October and November 2024. 96 percent used tracking technologies, 52 percent used a third-party tracking pixel, and of those, 77 percent did not mention third-party tracking pixels in their privacy policy. Of 12 sites examined more closely, all used Meta’s pixel and half used TikTok’s.

One health service provider, after auditing its own site, found 50 active tracking pixels that a third-party vendor had added progressively over time, without the provider knowing they were there.

Why it matters beyond Australia

The leak here does not depend on a cookie. A tracking pixel is a network request, an <img> tag or a script call to an ad platform’s collection endpoint, and the sensitive data travels in the request itself: the page URL, a query parameter, a form event. A cookie may or may not also be set. A consent tool that only intercepts cookie writes can watch this happen and do nothing, because from the cookie jar’s point of view nothing happened.

That is why “no cookies were set” is no answer under APP 3.3. The question is whether sensitive information was collected without consent, not which browser API carried it. The GDPR and the DPDPA frame the obligation the same way, as a rule about processing personal data, not about storage mechanisms. A pixel that sends a URL naming a medication to Meta or TikTok before consent is a collection event whether or not a cookie is involved.

This is also why CookieGate’s crawler inventories pixels and third-party scripts, not only cookies, and why its SDK holds network calls to known tracking endpoints until the visitor decides.

For health, fertility, mental health and other sensitive verticals, the OAIC’s own recommendations are the practical starting point: know every tracking technology on the site, audit it regularly, configure pixels with the sensitivity of the data in mind, and obtain valid consent where sensitive information is used for direct marketing. The 77 percent disclosure gap, and the provider with 50 unknown pixels, suggest many teams do not know their own tag inventory.

Sources

enforcementtracking-pixelshealth-dataadtech

Comply Ark Regulatory infrastructure company. Builds CookieGate.

If this applies to your site.

CookieGate holds non-essential tags until the visitor decides, resolves the right law by location, and prints a receipt per decision.

Start free trial

15 days. Card required. Nothing is charged before day 15.

How CookieGate handles each regulation