The Federal Trade Commission (FTC) recently took enforcement action against digital healthcare companies for sharing user information via third-party tracking pixels, which enable the collection of user data. At the start of the year, the U.S. Health and Human Services Office of Civil Rights issued its own bulletin with guidance regarding tracking pixel technology for covered entities and business associates subject to the Health Insurance Portability and Accountability Act (HIPAA). However, the FTC’s new focus highlights that issues with pixel tracking are not only a concern for covered entities and business associates under HIPAA.

The following definition of pixel tracking from the FTC is helpful:

Tracking pixels have evolved from tiny, pixel-sized images on web pages for tracking purposes to include a broad range of HTML and JavaScript embedded in web sites (and email). Tracking pixels can be hidden from sight and can track and send all sorts of personal data such as how a user interacts with a web page including specific items a user has purchased or information users have typed within a form while on the site. Businesses often want to use them to track consumer behavior (pageviews, clicks, interactions with ads) and target ads to users who may be more likely to engage or purchase something based on that prior online behavior.

In its recent article about pixel tracking, the FTC discusses concerns about the practice:

• Ubiquity and persistence. The FTC cited to significant research indicating that thousands of the most visited websites have pixels potentially leaking personal information to third parties. And, unlike cookies which can be disabled, “[p]ixel tracking can still occur even if cookies are disabled.”

• Lack of clarity. The technology permits any kind of data to be shared and in some cases the providers of the technology are not sure what data is being shared. This can leave consumers in the dark about the categories of their personal information shared with third parties as a result of their activity on a website.

• Steps to remove personal information may be ineffective. The agency notes that some attempts to appropriately remove personal information may be inadequate. As an example, while some pixel technologies attempt to “hash” personal information to scramble personally identifiable information, that scrambling can be reversed.

The concerns raised by the FTC are more general than just HIPAA and go to consumer privacy and data protection. For example, the FTC observed:

Companies using tracking pixels that impermissibly disclose an individual’s personal information (which may include health information) to third parties may be violating the FTC Act, the FTC’s Health Breach Notification Rule, the HIPAA Privacy, Security, and Breach Notification Rules, other state or federal statutes involving the disclosure of personal information, and your privacy promises to consumers.

As such, even companies outside of healthcare need to consider their use of pixel technology to ensure compliance with state and federal laws on the protection of consumer data. And, in particular, businesses need to consider what promises they are making to consumers, such as in their website privacy policies and terms of use.