Does your medical practice website need a cookie banner?

A dentist emailed us a screenshot last month. It was a news story about a health system paying millions because its website had been sending patient browsing data straight to Facebook without anyone noticing. Her one line question: "Do I need one of those cookie popups now, or am I about to get sued?"

Fair question, and a lot of practice owners are asking it right now. The short version is this. There is no US law that says every medical website must show a cookie banner. But there is a real and growing legal risk around what your website tracks, and a banner, on its own, does almost nothing to fix it. The popup is the part people can see. The part that gets practices in trouble is invisible, and it is running on most clinic sites right now without anyone noticing.

Let me walk through what is actually going on, because once you see it, the right move gets simple.

Why this became a thing in the first place

For years, practices did what every other business did. Drop the Google Analytics tag on the site to see your traffic. Add the Meta Pixel so your Facebook and Instagram ads can find the right people. Harmless, standard, everybody does it.

Then the lawyers noticed something. On a healthcare website, the pages a person visits can reveal a lot. Someone reading your page about anxiety treatment, or fertility, or addiction recovery, and then landing on your booking form, is telling a story. When a tracking pixel scoops up that page visit along with the person's IP address or device ID and ships it off to Meta or Google, you may have just sent protected health information to a third party that never signed anything.

The federal government agrees that is a problem. The HHS Office for Civil Rights, the agency that enforces HIPAA, put out specific guidance on online tracking technologies warning that combining an IP address with a visit to a health related page can count as PHI, and that using these trackers without proper authorization can break HIPAA. A court later narrowed part of that guidance in 2024, which made the picture murkier, not safer. The lawsuits did not slow down.

This is not just a big hospital problem. The class action lawyers filing these cases are not only chasing health systems. Any practice website running ad pixels on pages that touch a condition or a booking is sitting on the same risk. We dug into the broader trend in our piece on HIPAA tracking pixel lawsuits and what they mean for medical practices, and the pattern is clear: the tools are the same ones your competitors use every day, and most never checked what they were sending.

So where do cookie banners even come in?

Here is where people get confused. The cookie banner idea comes from Europe, where the GDPR rule really does require sites to ask before setting most cookies. That is why every site you visit now makes you click "accept" before you can read anything. The United States never passed a law like that. There is no national rule forcing a banner.

What the US has instead is a growing patchwork of state laws. As of 2026, close to twenty states have passed comprehensive consumer privacy laws, and you can watch the list grow on the IAPP state privacy law tracker. Most of these give residents the right to opt out of having their data sold or used for targeted advertising, and many require sites to honor a browser based "do not sell" signal.

Then there are the health specific ones, and these are the laws that should get a practice owner's attention. Washington's My Health My Data Act took effect in 2024 and is strict. It requires clear consent before collecting consumer health data, it reaches far beyond hospitals, and it lets individuals sue directly. Nevada passed a close cousin. The federal FTC has also gone after companies for sharing sensitive health data without permission. Even if your office sits in a state with none of these laws, a patient visiting your site from Washington might still be covered.

So yes, for some of your website visitors, a real consent choice is now a legal expectation, not a nicety. But notice what that consent is actually for. It is not a decorative popup. It is a gate that is supposed to stop certain tracking until the person agrees.

The trap: a banner that protects nothing

Here is the part almost nobody gets right, and it is the whole point of this article.

Most cookie banners are theater. The practice installs a generic popup, feels compliant, and moves on. But under the hood, the Meta Pixel and Google tags still fire the instant the page loads, before the visitor clicks a single button. By the time someone reads "we use cookies" and taps accept or decline, the data has already left the building. You have given yourself the annoyance of a popup and kept every bit of the risk.

A banner only does its job if it actually holds the non essential trackers back until the patient says yes, and actually turns them off if the patient says no. That is a real technical setup, not a line of copy. When we review a new client's existing site, this is one of the first things we check, and it is wrong far more often than it is right. The owner thinks they are covered. They are covered in paint.

What actually keeps a practice safe

Forget the popup for a second. The work that genuinely lowers your risk is not glamorous, but it is not complicated either. Four moves cover most practices.

One, know what is running on your site. You cannot protect what you cannot see. Most owners have no idea how many trackers are on their website, who added them, or what they send. A quick audit usually finds pixels from a campaign that ended two years ago, still reporting away in the background.

Two, keep ad trackers off your sensitive pages. Your page about depression, your page about a specific procedure, your booking form, the thank you page after someone requests an appointment. These are where a tracker turns a page view into a health story. The marketing you run can live on your general pages. The exam room, even the digital one, stays private. Our team covers this split in more detail in whether the Facebook pixel is HIPAA compliant and the same question for Google Analytics.

Three, publish a clear, honest privacy policy. Plain language, saying what you collect and why, with a real way for someone to opt out. Most state laws require a privacy notice anyway, and patients increasingly look for one before they trust you with a form.

Four, use consent the right way. If you serve patients in states that require it, put a real consent mechanism in place, one that holds non essential tracking until the patient agrees and respects browser opt out signals. That is the banner done properly. It is the gate, not the sticker.

You do not have to choose between safe and measurable

Here is the fear we hear most. "If I rip out the pixels, I go blind. I will have no idea if my marketing is working." That fear is reasonable, and it is also why so many practices leave the risky setup in place and hope for the best.

The good news is that it is a false choice. You can measure your marketing and respect patient privacy at the same time. It takes a site built with privacy aware tracking, server side measurement where it fits, and consent handled correctly, so you still see which ads bring patients and which pages convert, without shipping sensitive page visits to advertising platforms in the raw. This is exactly the kind of thing a website built for a medical practice should handle out of the box, and that a cheap template or a general agency almost never does.

It also matters that your tracking and your marketing talk to each other. When your patient acquisition system is built as one connected setup, your ads, your site, your forms and your measurement, you can prove what works without leaning on the exact third party pixels that create the legal exposure. Privacy and performance stop fighting each other.

The honest bottom line

Do you need a cookie banner? Maybe, depending on where your patients live. Do you need a banner slapped on as a magic shield? No, and if that is all you do, you have fooled yourself, not the lawyers.

The real question is not "banner or no banner." It is "do I actually know what my website is sending about my patients, and have I locked down the pages that matter?" Most practices have never asked it. The ones that do, and fix what they find, sleep better and still get to grow. That is the whole game: keep the trust, keep the data you need, and stop leaking the one thing patients hand you expecting you to guard it.

How EtherealMinds handles this

EtherealMinds works only with healthcare practices in the United States, so patient privacy is not an afterthought we bolt on. When we build or rebuild a practice website, we audit what is tracking, keep ad pixels off the pages that reveal a condition or a booking, set up consent and measurement the right way, and still give you clean numbers on what is actually bringing in patients. You get a site that markets hard and does not land you on a class action list without you ever knowing. If you are not sure what your current site is doing behind the scenes, that is reason enough to look.