The Australian Privacy Commissioner has determined that Monash IVF and a telehealth company unlawfully interfered with the privacy of their website visitors through the use of tracking pixels.
The regulator found both companies deployed the tracking technology without obtaining proper consent from end-users, raising serious concerns about data practices in the Australian healthcare sector.
Tracking pixels, also known as web beacons, are typically small pieces of code embedded within a website that collect information about a user’s browsing activity.
Once loaded by a visitor’s browser, the pixels transmit data to third-party providers, including advertising agencies, which then use that information to display targeted advertisements based on sites previously visited.
Monash IVF used tracking pixels on pages related to egg-freezing, sperm and egg donation, and fertility health checks over a period spanning from July 2012 to December 2024.
Women who visited those sensitive health pages were subsequently targeted with advertisements for IVF treatments, egg-freezing services, and nurse consultations, without their knowledge or agreement.
The telehealth provider, separately investigated by the Commissioner, deployed tracking pixels from April 2021 that transmitted URLs disclosing end-users’ medical conditions and medications to third parties.
The formal determinations, dated 11 June 2026, are recorded as Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41 and Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40.
The cases highlight a growing regulatory focus on how health and medical organisations handle patient data in digital environments, particularly where third-party advertising technology is involved.
The use of tracking pixels across healthcare websites has become an increasingly contentious issue globally, as patients often share sensitive personal information while researching conditions and treatments online.
Regulators and privacy advocates argue that the healthcare sector must apply a higher standard of care when collecting and sharing data, given the inherently sensitive nature of the information involved.
The Commissioner’s findings serve as a clear warning to other health-related businesses operating websites that embed third-party tracking tools without transparent disclosure and explicit user consent.