Australian Privacy Commissioner Finds Health Firms Track Patients’ Searches Without Obtaining Consent
By: Cameron Abbott, Rob Pulham and Emre Cakmakcioglu
The Australian Privacy Commissioner has determined that Monash IVF and a telehealth company have interfered with the privacy of website visitors via tracking pixels, without obtaining end-user consent.
What is a Tracking Pixel?
Also known as a web beacon, a tracking pixel is typically code embedded in a website that collects information about a user’s activity. Once loaded, it sends information to third party providers, including advertising agencies, to display targeted advertisements based on sites visited.
How Were the Tracking Pixels Used?
From July 2012 to December 2024, Monash IVF used tracking pixels on egg-freezing, sperm and egg donation and fertility health check pages. Women were subsequently targeted with ads for IVF, egg-freezing and nurse consultations after visiting these pages.
The telehealth provider deployed tracking pixels from April 2021 that transmitted URLs disclosing end-users’ conditions and medications. It also matched these users to their social media accounts despite not being logged in.
What did the Commissioner say?
The Commissioner found that both entities had breached the APPs:
- APP 3.3: collecting sensitive information without consent;
- APP 5.2: failing to take reasonable steps to notify or ensure individuals’ awareness of the relevant matters; and
- APP 7.1: using that sensitive information for direct marketing without consent.
Key Takeaways
The Commissioner contemplated in both determinations the possibility of presenting a banner or pop-up to website visitors including the relevant APP 5.2 matters or directing visitors to sections of the website and privacy policy.
As well as emphasising clear non-compliance, the determinations also indicate a sharp focus on websites that deploy tracking pixels rather than the platforms that receive the data. This is yet another timely reminder for entities to ensure they have compliant and updated privacy policies as well as appropriate notifications and consents.