A tracking pixel on a clinic website doesn't know it's on a clinic website. It fires the same way it fires on a shoe store — except the page it's reporting on is called /services/anxiety-treatment, and the URL alone says something about the person reading it that they never agreed to share.
This has stopped being theoretical.
Nobody is reading your website. Something is scanning it.
Here's the part small practices get wrong. They picture a lawsuit as a patient with a grievance — someone who was harmed, hired a lawyer, and came after them. That's not how this works.
Under California's Invasion of Privacy Act, a website that shares a visitor's activity with a third party without consent can be framed as wiretapping, and the statute carries $5,000 per violation — or three times actual damages, whichever is greater. That number is what built an industry. Reporting on the wave has found that more than 70% of these claims come from about four law firms, running high-volume, template-driven dockets, alongside serial pro se litigants mailing demand letters in bulk.
The workflow is automated. Load the site, watch what it transmits, see a Meta Pixel or a session-replay script firing before any consent, generate the letter. It doesn't need a real patient. It doesn't need harm. It needs your page to phone a third party while a California resident is looking at it.
That's why practice size is no defense. As one firm's guidance puts it, businesses of all sizes, industries, and locations are being targeted — if your site uses third-party tracking and gets California traffic, you're in the pool. A solo practitioner's site is easier to scan than a hospital's, and far less likely to have a privacy team.
Health sites are the richest target of all, because the page path is the diagnosis. /services/addiction-medicine doesn't need a patient name attached to be sensitive — the URL and the IP are the disclosure. The big settlements make the mechanism concrete: Kaiser Permanente agreed to $46 million over trackers on its web properties, Sutter Health $21.5 million, Inova $3.1 million. Same pixel, different zeros.
The mechanism is always mundane: marketing added a tag, nobody thought about what the page path revealed, and the data left the building.
The default is the whole story
A privacy control that's available is a privacy control that's off. Someone has to know it exists, find it, and turn it on — and the person building a clinic's website at 10pm is usually not thinking about pixel semantics.
So on OwnSites, sites in health industries — medical, dental, pediatric, veterinary, eyecare, pharmacy — turn compliance mode on by default.
In compliance mode, third-party tracking is blocked at render. Not deferred, not consent-gated — the analytics IDs are stripped before the page is built, so the tags never reach the browser at all. There's no configuration where a stray pixel loads anyway, because there's no code path that emits one.
Consent, for everything else
Outside health industries, the cookie consent banner is on by default and analytics wait behind it. Global Privacy Control signals are honored rather than ignored, and Privacy and Terms pages are generated and require your approval before publish — with the approval invalidated if the site later changes in a way that materially affects what those pages promise.
The guard that catches you later
Blocking trackers on day one is easy. The failure mode is month seven, when someone adds a marketing tag or switches on a chat widget and quietly changes what the site does with visitor data — while the privacy policy still describes the old site.
So the policy is pinned to the site's actual configuration. Change something privacy-material — add an analytics ID, enable a chatbot, turn compliance mode off — and your Privacy and Terms pages need re-approval before you can publish again. Not a warning you can click past: the publish stops until a human looks.
That's a narrow guarantee, and a real one. It means your published privacy policy always describes the site you actually shipped.
What we don't claim
We don't monitor the law for you. No product here watches for new privacy rulings and rewrites your site when the landscape shifts. If a vendor tells you their website builder keeps your practice continuously compliant with a moving target like CIPA, ask them exactly which code does that, and what happens the week a court changes its mind. What we do is narrower and checkable: a default posture that doesn't leak, and a publish gate that won't let your policy drift out of sync with your site.
Being equally direct about the bigger one: OwnSites does not claim HIPAA compliance, and does not offer a BAA.
Blocking trackers is not compliance. It removes one specific, well-documented, extremely common way that clinic websites leak patient information to advertisers. That's a genuinely useful thing to remove, and it's worth doing whether or not anyone is auditing you. But if a website builder tells you their marketing site makes your practice HIPAA compliant, you've learned something important about that vendor.
What does exist, described precisely: PHI fields on clinical records are encrypted at rest, access to those records is written to an append-only audit log, and TOTP MFA is available for accounts that turn it on. Clinical notes and the patient record system are opt-in per site and off unless you enable them.
The trade
Compliance mode costs you retargeting on your clinic site. That's the trade, stated plainly.
For a practice, it's rarely a close call. The upside of pixel-based retargeting for a local clinic is modest. The downside — being the practice that told an ad network which of its visitors read the oncology page — is not modest at all.