Answers

What is a tracking pixel, and does a service business's website need one?

Ascent Vision · Published October 25, 2026

A tracking pixel is a small piece of code from an ad or analytics company that reports visits and actions on your website back to that company. A service business usually needs one only if it runs ads and wants them measured. It sends visitor data to a third party, so your privacy policy should say so, and pages about health conditions carry extra risk under federal guidance. This is a plain summary, not legal advice.

What a pixel is

The U.S. Department of Health and Human Services (HHS) describes a tracking technology as "a script or code on a website or mobile app" used to gather information about users and what they do, and lists tracking pixels alongside cookies, web beacons, session replay scripts and fingerprinting scripts. It says technologies made by third parties send information directly to those third parties and may keep tracking people after they leave your site.

The FTC's Office of Technology wrote in March 2023 that pixels began as tiny images and now include a broad range of code embedded in websites and email, and that they can send how a person uses a page, including items bought or information typed into a form.

Why an ad platform asks for one

As general advice: ad platforms use a pixel to count what people do after clicking an ad, such as sending a form, and to build audiences for later ads. If you run ads, it is often worth having, set up under an account in the business's name, for the reasons the related answer on who should own your ad accounts gives. A pixel's counts are not your lead records; the related answer on website analytics covers why only your own records show who became a customer.

The privacy side

A pixel sends visitor data to another company, so your privacy policy should name the tools that collect data automatically and be updated when you add one, as the related answer on whether a website needs a privacy policy describes. As general advice, keep pixels off pages where people type sensitive details unless you have checked what is sent.

Pages about health topics

In HHS's position, the HIPAA Rules apply when information collected through tracking technologies, or disclosed to their vendors, includes protected health information, and HIPAA-regulated businesses may not use them in a way that discloses it improperly. The bulletin is addressed to HIPAA covered entities and business associates, not to every business.

HHS notes that on June 20, 2024, a federal court in the Northern District of Texas declared unlawful and vacated part of the guidance: the part saying HIPAA applies when a technology connects a visitor's IP address with a visit to a public page, one that needs no login, about specific health conditions or providers. HHS says it is evaluating its next steps.

In the FTC's August 2024 guidance, using "behind-the-scenes tracking technologies" that share sensitive health data against your privacy promises is a violation of the FTC Act, and the FTC says the Act also applies to companies that handle health information but are not covered by HIPAA. Pages about money or legal matters may deserve the same caution, though no guidance on them is summarized here. This is a plain summary, not legal advice.

Sources

1. U.S. Department of Health and Human Services, "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates" (accessed 2026-10-25)
2. Federal Trade Commission, "Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule" (August 2024)
3. FTC Office of Technology, "Lurking Beneath the Surface: Hidden Impacts of Pixel Tracking" (March 16, 2023)

Related answers

• Does a small business need website analytics?
• Does a small business website need a privacy policy?
• Who should own your Google Ads and Facebook ad accounts?
• What is lead attribution, and why does a small business need it?