"Your health data and the tracking pixel: what the OAIC's Medmate and Monash IVF decisions mean for Australian web users"
Your health data and the tracking pixel: what the OAIC's Medmate and Monash IVF decisions mean for Australian web users
If you have ever searched for a fertility clinic, a telehealth service or a medication, and then seen an eerily relevant ad on Facebook, that is probably not coincidence. It is a tracking pixel: a snippet of third-party code embedded in a website that reports your activity, page names, button clicks, sometimes form contents, back to an advertising platform. On 24 June 2026 the Privacy Commissioner confirmed that when those pixels watch health websites, the law requires consent, and that two Australian health providers had broken it.
The two determinations, Commissioner Initiated Investigation into Medmate Australia Pty Ltd [2026] AICmr 41 and Monash IVF Pty Ltd [2026] AICmr 40, both dated 11 June 2026, concluded a year-long OAIC investigation. The finding in plain terms: using tracking pixels to collect information about visitors to health-related websites, and to target those visitors with advertising on social media, amounts to collecting sensitive information, and sensitive information requires consent. Neither provider had it.
Why this is a bigger deal than a cookie banner
Under the Australian Privacy Principles, health information is sensitive information, the category with the highest protection in the Privacy Act. Collecting it generally needs consent, and it can only be collected if reasonably necessary for the provider's functions. Sending a list of pages a visitor browsed on a telehealth site, which may reveal conditions, medications or intentions, to Meta's or Google's advertising machinery is not delivering care. It is marketing built on data the visitor never agreed to share.
The OAIC's announcement quotes Privacy Commissioner Carly Kind making the cultural point directly: Australians have become accustomed to pervasive online tracking, but community attitudes research shows nine in ten consider it neither fair nor reasonable to be targeted on the basis of their sensitive health data. The decision also establishes something useful for everyone, not just health sites: advanced tracking technology still has to comply with the Privacy Act. Pixel use does not get a pass just because the code was dropped in by a marketing agency.
The inspection that put numbers on it
Alongside the determinations the OAIC published a report, Your life, pixelated: how tracking pixels watch your every click, from an inspection of 50 Australian health service provider websites. It documents how widely third-party tracking is deployed in a sector where visitors' browsing is itself often diagnostic, what pages you viewed on a sexual health clinic's site tells Meta something about you that no ordinary browsing history does. The report includes case studies and recommendations for organisations, and the OAIC is encouraging all APP entities to review their pixel usage.
For readers of this site the structural problem will look familiar: the information collected is not what the user sees. A pixel is invisible, the data leaves in the background, and the destination is an ad platform's profile of you rather than the provider's own record. Most visitors to a fertility site in 2024 did not know any of this was happening. Now there is a regulator's decision saying it was unlawful.
What actually happened to Medmate and Monash IVF
The determinations are enforceable decisions, not warnings. The OAIC's media release notes they concluded the investigation into how both providers collected sensitive information on their websites, telehealth in Medmate's case and fertility services in Monash IVF's. Both now sit in the same category as the 2Apply decision: named findings of interference with privacy, on the public record, with the OAIC signalling that the reasoning applies sector-wide. Australian businesses still treating pixels as a marketing-afterthought question should note that the OAIC lists advertising technology, including pixel tracking, among its 2025-26 regulatory priorities, alongside excessive collection and data brokerage.
What a pixel actually is
It is worth stripping the jargon, because "tracking pixel" sounds exotic and the mechanism is not. A pixel is a small piece of JavaScript, historically a 1x1 transparent image, loaded from a third party's servers when your browser renders the page. Modern versions are not just images: they are script tags that can read the page they sit on, including the title of the page you are viewing and, in the worst cases, values from forms. Every health page you open on an infected site fires an event to the ad platform, which adds it to the profile it keeps on your browser, your device and wherever possible your logged-in identity. The ad you later see is the ad platform monetising a profile you never knowingly built.
The reason this matters more on health sites than on shoe stores is inferential weight. Knowing you visited a page titled "IVF treatment options" or "telehealth prescription antidepressants" is itself health information about you, even if the site never typed your name into a field. Australian law has recognised that for decades: sensitive information includes health information, and it cannot be collected without consent. What the June 2026 determinations add is the application of that principle to the invisible layer of the web, the part that runs between your browser and an advertising platform while you think you are just reading a clinic's homepage. Regulators in the United States have run parallel cases on the same pattern, including actions by the FTC against telehealth and better-help-style providers, so the OAIC's findings put Australia in line with a growing international position rather than creating an outlier.
How to see the pixels on sites you use
You do not need to be a developer to check this, though a browser helps. A few practical steps:
- Look at the network requests. In any browser, open developer tools (usually F12), go to the Network tab, and load the page. Requests to
connect.facebook.net,google-analytics.com,googletagmanager.com,doubleclick.netortiktok.comwhile you are entering personal details mean third parties are receiving signals in real time. - Use a content blocker as a signal, not a guarantee. Extensions like uBlock Origin block the common trackers, and their panel will light up with the number of blocked requests. That count is a reasonable proxy for how much a site phones home.
- Watch for the health-specific pattern. The unlawful conduct in these decisions was pixels running on pages where sensitive information is entered or implied: symptom checkers, appointment booking, condition pages. A pixel on the homepage is bad practice; a pixel that fires when you submit a telehealth enquiry is the exact conduct the Commissioner found unlawful.
- Complain if it happens to you. The OAIC accepts privacy complaints, and the determinations give complainants a ready-made legal foundation.
For a more systematic approach to limiting what you leak while browsing, our guide to Tor in Australia covers the honest trade-offs of routing traffic away from ad networks altogether.
What organisations should take from it
If you run a website that touches health, and the reasoning extends naturally to anything sensitive, the checklist is short and now grounded in binding determinations:
- Audit every third-party script. Pixels, session replay tools and chat widgets all transmit data.
- Assume anything entered into a form may traverse a third-party script unless you have proven otherwise.
- Get explicit consent before any sensitive collection, which in practice means pixels off on sensitive pages, not a banner nobody reads.
- Document it. Both investigations were Commissioner-initiated, meaning the OAIC came looking, and an audit trail is your best defence.
This article is general information, not legal advice. But the direction of travel is clear: the same regulator that went after RentTech over-collection and data brokers is now inside the ad tech stack, and the tracking pixel, the most quietly invasive piece of the modern web, has been formally ruled out of bounds on Australian health websites without consent.
Sources: OAIC media release, 24 June 2026, Medmate Australia determination [2026] AICmr 41, Monash IVF determination [2026] AICmr 40, Your life, pixelated report, OAIC regulatory priorities 2025-26. This article is general information, not legal advice.