Pixel Imperfect: What the OAIC's Tracking Pixel Rulings Mean for Your Website

It is 1:40 am. Noor is on the couch with a laptop, a cold cup of chamomile and a question she has not asked anyone out loud yet. She types "egg freezing cost" into a search box, clicks the first clinic that looks friendly, and reads three pages: the one about the process, the one about the price and the one called "Is it right for me?". She does not fill in a form. She does not create an account. She closes the lid and goes to bed, satisfied that the only witness was a sleepy cat.

At 7:15 am, she opens Instagram. The third post in her feed is a sponsored one, with a smiling woman in a sunlit kitchen and the words "Thinking about your fertility future?" By lunch, TikTok has the same idea.

Here is what happened, told the old-fashioned way. Somewhere inside that clinic's web page lived a small clerk, about one pixel tall, with a quill and a very good memory. As Noor read, he copied down the address of each page, which buttons she pressed and how long she stayed. He folded the notes, tied them to a pigeon and sent the pigeon to a data centre on the other side of the world. There, a much larger clerk compared the pigeon's notes with a file labelled "Noor, 34, likes pottery and dogs", made a note in the margin, and passed it to the advertising department before breakfast. The clinic, for its part, had asked him to do exactly this.

Noor's phone was not listening to her. Nothing so dramatic happened. A few lines of JavaScript did exactly what their documentation says they do, on a page nobody at the clinic had looked at critically in years.

The clerk has a name in the trade: a tracking pixel. And as of June 2026, the Privacy Commissioner has ruled on what he does, in two determinations. On 24 June 2026, the Office of the Australian Information Commissioner (OAIC) announced that telehealth provider Medmate and fertility provider Monash IVF had interfered with the privacy of people whose sensitive information was collected through third-party tracking pixels. The regulator's summary is blunt: using pixels to track visitors to health websites, and then targeting them with ads on social media, is a collection of sensitive information, and the website owner must get consent for it. The Commissioner, Carly Kind, added a number that should worry every marketing team in the country: the OAIC's community attitudes research shows "9 in 10 Australians consider it neither fair nor reasonable to be targeted on the basis of their sensitive health data".

If your site has a Meta Pixel, a TikTok Pixel, a Google Ads tag or anything like them, and any page on it could tell a stranger something personal about the visitor, these rulings are about you too.

So, the plan. We will open one of those pigeon notes and read what is inside. Then we will go through what the Commissioner found and the three legal steps behind it, why a cookie banner did not count, and how the consent "gate" works in the actual code. Then a (made-up) Hobart physiotherapist audits her own website, one pixel at a time, and you can copy her steps this week.

Put the kettle on. Let's get into it.

Part 1: What a Pixel Actually Sends

You already know how a web page loads, even if you have never thought about it. The page is a list of instructions, and your browser follows each one: get this picture from here, get this font from there, run this script. Each instruction sends a request to a server, and each request tells that server a little about you: your IP address, your browser, and, very often, which page you were on when you asked.

That last part is the whole trick. A server that hands out a picture learns who asked for it and from where. It does not need to be your server. If a page on clinic.example includes a picture that lives on platform.example, then platform.example learns that your browser was on that page of clinic.example, at that time.

From invisible picture to little clerk

The original tracking pixel was exactly that: a transparent picture one pixel square, placed on a page or in an email. Nobody could see it. Its only job was to be requested, so that its server could write down who asked.¹

The modern version is a small piece of JavaScript that the platform gives you to paste into your site. The OAIC's 2024 guidance defines it plainly: "a piece of code generated by the third-party provider that can be placed on an organisation's website", which, when the page loads, "sends certain types of data to the server of the third-party provider". The code can do much more than a picture could. It can wait for a click, read the text on the button, and report a "thank you" page as a conversion.

What is in the note

Here is where it gets specific. Meta's own developer documentation for the Meta Pixel, as it stood in June 2026, lists what the pixel receives:

• HTTP headers: the standard details every browser request carries, which Meta says "may include data like IP addresses, information about the web browser, page location, document, referrer and person using the website";
• pixel-specific data: the pixel ID and the Facebook cookie;
• button click data: "any buttons clicked by site visitors, the labels of those buttons and any pages visited as a result of the button clicks";
• optional values that the site owner chooses to send, such as a conversion value or a page type;
• form field names, like "email" or "address". Meta says it does not capture the values you type "unless you include them as part of Advanced Matching, or conversion tracking".

Read that list with Noor in mind. "Page location" is the full address, and on many sites the address describes the page: /fertility/egg-freezing/cost. A button label might be "Book an egg freezing consult". Nothing in the note says "Noor wants to freeze her eggs", and nothing needs to.

max_tokensPOST./v1/messages

The OAIC saw exactly this when it inspected health websites. In its report, Your life, pixelated, it lists what it saw going to social media platforms: the full URL, website searches, button clicks, the time and date, and device information. Then it gives examples that are hard to read calmly: a page address like "http://[domain]/mental-health", symptom questionnaires answered by clicking buttons, a site search for "UTI Medication", searches for domestic violence or eating disorder support, and the medications people added to a cart.

None of this is new. In 2022, The Markup found that on 33 of Newsweek's top 100 US hospital websites, the Meta Pixel sent data to Facebook when a visitor clicked a button to schedule an appointment. With the button text went details such as the search term "pregnancy termination" and a condition chosen from a menu, "Alzheimer's".

The hash that is not a disguise

There is one more item in the note, and it is the one many organisations misunderstand. "Advanced matching" is a feature in which the pixel takes an email address or phone number from a form, hashes it, and sends the hash to the platform.

A hash is a one-way scramble. Put "[email protected]" into a hash function and you get a long string of characters that cannot be turned back into the address. That sounds like anonymity. It is not, for one reason: the same input always gives the same output. Meta can hash the email address on Noor's Instagram account and get the identical string. The hash is not a disguise; it is a fingerprint that both sides can check.²

The OAIC saw hashed names, addresses and phone numbers sent from forms to social media platforms, where they are "used to match this to individuals and their profile, even where they are not logged in". One organisation told the regulator its data "is hashed and cannot be reversed". Both parts of that sentence were true, and it still did not help.

So the note carries the page Noor was on, what she clicked, the platform's cookie and, if she had filled in a form, a matching key for her profile. The clerk does not need her name. The pigeon lands at an address that already knows it.

Part 2: What the Commissioner Found

stop_reasoneval:.pass

The two determinations are Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40 and Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41. The OAIC dates both 11 June 2026 and released them on 24 June. That evening, the Commissioner explained them to Fran Kelly on ABC Radio National. Hall & Wilcox calls them the OAIC's first enforcement action specifically targeting tracking pixels. They follow from the OAIC's pixel guidance and its scan of 50 health websites in late 2024, and investigations it opened that December.

Medmate

Medmate is a telehealth service: online consultations, prescriptions and medical certificates. According to Information Age's report on the determination, it began using Meta and TikTok pixels in April 2021. The Commissioner noted that full URLs, hashed email addresses and phone numbers could go to TikTok through its pixel, and some of those URLs named a health condition, such as urinary tract infections and bacterial vaginosis, or a medication, such as oral contraceptives and treatments for benign prostatic hyperplasia. Medmate also used a Meta feature that linked visitors to their social media profiles whether or not they were logged in. By 1 December 2025, it had stopped using tracking pixels on its site altogether.

Monash IVF

Monash IVF provides fertility services. Its pixels went back much further: from 30 July 2012 to December 2024, across seven different pixels, including Meta, Google Ads and Pinterest. Information Age reports that Monash used Meta's pixel for advertising campaigns about egg donation and freezing, endometriosis, sperm donation, fertility treatment and IVF. It also kept "Custom Audience" lists with names, email addresses, phone numbers and other details, and uploaded at least some of them to Meta. Squire Patton Boggs, working from the determination, lists the events the pixels were set up to report: page views, phone clicks, form submissions and appointment bookings.

A Monash IVF spokesperson told Information Age: "We took action immediately on being informed of the likelihood of an issue by the OAIC to ensure we were complying with the Privacy Act."

The breaches and the orders

Both organisations breached the same three Australian Privacy Principles, as DLA Piper and Hall & Wilcox summarise:

• APP 3.3: they collected sensitive information without consent;
• APP 5.1: they did not notify people about the collection;
• APP 7.1: they used sensitive information for direct marketing without consent. Here, the direct marketing was the targeted ads on social media.

There was no fine. The Commissioner ordered both to stop using the pixels until proper consent is in place, and to destroy the sensitive information held in the pixel providers' dashboards. Each has 28 days to ask the Administrative Review Tribunal to review the decision.³

The three steps underneath

The headline is "pixels need consent on health sites". The reasoning underneath applies to far more websites. It has three steps, and each one closes a door that marketing teams have leaned on for years.

Step one: you collected it, even though Meta holds it. Both organisations could say, fairly, that the data never touched their servers. It went from the visitor's browser straight to Meta or TikTok. The Commissioner's answer, as Squire Patton Boggs describes it, is that each operator "exercised control over the deployment, configuration and customisation of the tracking pixels", and that control was enough to be a "collection" under the Privacy Act. Louder, an Australian consultancy, put it in one line on the day of release: "The pixel is yours. So is the liability."

Step two: the visitor does not need a name to be identifiable. The Privacy Act protects "personal information", which is information about someone who is identified or "reasonably identifiable". Both organisations argued that they could not identify anyone from pixel data. The Commissioner rejected this. In the words Squire Patton Boggs quotes from the determinations, "the definition of personal information does not expressly require that an individual be specifically identifiable, or identifiable by direct identifiers such as their legal name, passport or driver's licence number, or date of birth".

What counts instead is individuation: the ability to single out one person from everyone else in a way that affects their rights or interests.

You already use individuation every day without a name for it. Think of the café where the barista starts your large flat white before you reach the counter. She does not know your surname or your address. She has never seen your licence. But she can pick you out of the queue, and she treats you differently because of it. Now swap the flat white for an ad about egg freezing. If a clinic can pick Noor out of the crowd of Instagram users and show her, specifically, an ad based on what she read at 1:40 am, then for privacy purposes she is "reasonably identifiable". She is the one who got the ad. Hall & Wilcox calls the Commissioner's interpretations novel, and Information Age reports that Kind told The Age this one was likely to be tested in court.⁴

Step three: browsing a health page can be health information. Sensitive information includes information or an opinion about someone's health. The OAIC's guidance had already warned that a person may reveal sensitive information "solely by visiting a website", for example one that offers mental health or counselling services. In these determinations, the Commissioner applied that. Visits to the pages of a fertility clinic or a telehealth service could reveal, or support an inference about, the visitor's health. And the retargeting proved the point: if you show someone an endometriosis ad because they visited your endometriosis page, you have plainly formed an opinion about why they were there.

Put the three steps together: the site collected personal information, it was about health, and health information needs consent before collection and again before direct marketing. The pixel is new. The law is not.

The OAIC is explicit that health is only the first example. In her statement, Kind said website providers must get consent where pixels collect sensitive information "such as data on health, political opinions, race or ethnicity". A union, a political party, a religious charity, a migration agent and a sexual health service can all run the same Meta Pixel that a clinic runs.

Part 3: Why the Cookie Banner Did Not Count

page_viewtool_use

Both sites had a cookie consent pop-up, according to Squire Patton Boggs. It did not help, and a great many Australian websites have a banner exactly like it.

A cookie is not a pixel

When I wrote about first-party and third-party cookies, the first-party cookie was a friendly shopkeeper who remembers your preferences. A cookie is a small file your browser stores and sends back to the site that set it. It is a memory. You can see it, delete it and block it.

A pixel is a messenger. It sends information out, to a server you did not choose, as the page loads. It can use cookies to help recognise you, but it does not need them to send the note. Squire Patton Boggs describes the OAIC's view that pixels are distinct from cookies because a pixel sends data to its provider and can track a person across several devices. DLA Piper's summary makes the consequence plain: "cookie consent pop-ups will not constitute valid consent for the use of tracking pixels".

A banner that says "We use cookies to improve your experience" is a doorman who asks about the biscuits. The visitor nods at the biscuits. Nobody mentions the clerks at the back table.

What the banner would have needed to say

Hall & Wilcox lists why Medmate's pop-up failed: it did not refer to tracking pixels, it did not name the platforms (such as Meta or TikTok), and it did not deal with the collection of sensitive information with enough specificity. From that, they suggest that a consent mechanism should identify four things:

1. that tracking pixels are in use;
2. the platforms the data goes to;
3. the kind of information collected;
4. the purposes of the collection and disclosure.

This matches what the OAIC has asked for since 2024. For sensitive information, the guidance says an organisation "should generally seek express opt-in consent", and it is "only appropriate to infer consent from an opt-out mechanism in limited circumstances". After the release, an OAIC spokesperson repeated the "express opt-in consent" line to Information Age, and added that for consent to be valid, it "should be adequately informed, given voluntarily and be current and specific".

The OAIC's advice has two levels, and it is easy to miss. For ordinary targeted advertising, the report says you must at least give people a simple way to opt out, for example with a first-visit banner. For sensitive information, the pixel needs an opt-in. So the same Meta Pixel can need different treatment on two pages of the same site. The pizza menu page and the sexual health page are not the same page, even if the tag manager treats them as one "All Pages" trigger.⁵

The notice is a separate job

APP 5 is about telling people, and it is separate from consent. The OAIC's guidance had already said that "a privacy policy is not meant to be a substitute for notification requirements under APP 5". In these determinations, both policies mentioned cookies and marketing, but did not describe pixel-based ad tracking. According to Squire Patton Boggs, the OAIC suggests a more point-in-time notice, such as a banner or pop-up like a cookie banner. Squire Patton Boggs wonders whether a much better privacy policy alone might ever be enough. I would not want to be the test case.

utm_source=SELECT

The timing problem

There is one more failure that no wording can fix, and I see it often. Open a site with a cookie banner, open your browser's developer tools, and watch the network tab while the page loads. On a surprising number of sites, the requests to Meta and TikTok go out before the banner even appears. By the time the visitor reads "Accept all", the pigeon is somewhere over the Pacific.

Hall & Wilcox says it directly: "the consent must be obtained before the pixel fires". Timing is the part marketing teams most often cannot see, because on their own screens everything looks fine.

Part 4: How Common This Is

Two determinations can make this look like a problem of two companies. The OAIC's report says otherwise. In October and November 2024, the OAIC scanned 50 health service websites: mental health services and helplines, youth and children's health, pharmaceuticals, insurance, fertility and abortion services. Of those 50, 96% used tracking technologies of some kind, and 52% used at least one third-party tracking pixel. Of the sites with a pixel, 77% did not mention pixels in their privacy policy.

aria-labelgtm.js

The OAIC then looked closely at 12 of them. All 12 used more than one third-party pixel, and all 12 used Meta's. Half used TikTok's, and a quarter used Snapchat's. There was no easy way for a visitor to tell they were being tracked. Only four privacy policies mentioned pixels, and only two of those named the platform receiving the data. Where policies did discuss browsing data, they promised that it could not be traced back to one user, which the inspection showed was not true. None of the 12 had done a privacy impact assessment before adding the pixels.

Nobody knew the clerks were there

The part of the report I read twice, with the tea going cold, is not about bad intent. It is about organisations that did not know what was on their own websites.

The OAIC describes a separation between marketing teams and privacy teams, or marketing that has been outsourced, and it calls the result a "set and forget" approach. One health service provider did an audit after the OAIC contacted it. Its website had been built and managed by a vendor, who had added analytics tools and pixels from advertising and social media platforms over time. The provider found 50 tracking pixels active on the site that were not necessary for the website or for the business. It did not know what information they were sending.⁶

The report also includes a case study about "CareCo", a community mental health and chronic illness provider. A marketing consultancy recommended Meta and TikTok pixels, and CareCo's first campaign targeted people aged 25 to 30 who had visited its website in the last two weeks. Then, late one night, "Mary" searches for information about eating disorders, visits CareCo's website, reads about counselling and downloads a pamphlet. Within days, she sees counselling ads from CareCo and from companies she has never dealt with, and one for natural weight loss supplements. She wonders whether her phone has been listening.

That is Noor's story, told by the regulator. Nobody in it meant harm, and a person reading about eating disorders still got a weight-loss ad.

DLA Piper calls the use of tracking technologies in health "widespread and poorly governed". Louder adds that the obligation is the same whether the data travels "through a pixel, tag, SDK, API, server-side implementation, enhanced conversion framework or clean room environment". Moving your Meta Pixel to a server-side container does not move the responsibility. It only makes it harder to see.

Part 5: The Gate: How Consent Tools Actually Work

So, we need a gate: nothing leaves the browser for a platform until the visitor has said yes, specifically, to that. The platforms offer the tools. Hall & Wilcox notes that pixel providers typically let advertisers use "consent mode" functionality so that consent comes before the pixel fires, while warning that "the level of informed, specific, consent required for sensitive information is a high bar". Both halves of that sentence matter. The tool is the mechanism. It is not the consent.

The principle: default closed, open on a click

Think about a boom gate at a hospital car park. The gate starts down. It goes up only after you take a ticket. Nobody designs one that starts up and then lowers itself a few seconds after your car has gone through.

Every consent tool works on the same two moves:

1. A default, set before the tag does anything: "consent is denied".
2. An update, sent when the visitor makes a choice: "consent is now granted", or "still denied".

The mistakes are nearly always in step one: no default at all, or a default set after the first request.

Google's tags

I wrote about Google Consent Mode in 2022, and again when Google started enforcing it in Europe in 2025. The short version, from Google's documentation as captured in May and June 2026: there are four consent types that matter here. ad_storage and analytics_storage control storage such as cookies for advertising and analytics. ad_user_data controls "sending user data to Google for online advertising purposes", and ad_personalization controls personalised advertising.

Here is the detail that catches people. Google's set-up guide says, in plain words, "By default, no consent mode values are set". If you install the Google tag and do nothing else, there is no gate. To create one, you call the default command "on every page of your site before any commands that send measurement data", for example:

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied'
});

Then your banner calls gtag('consent', 'update', …) with the visitor's choice.

Google offers two versions, and for sensitive pages the difference is important. In basic consent mode, you prevent Google tags from loading until the visitor uses the banner, and Google says this "transmits no data to Google prior to user interaction with the consent banner". In advanced consent mode, the tags load straight away, and while consent is denied they "send measurements without cookies", so Google can model the conversions it cannot see.

My view: on pages where the visit itself is sensitive, use basic mode, or keep the tag off the page entirely. Advanced mode still sends a request from that page to Google before anyone says yes.⁷ Nothing I have read from the OAIC tests advanced mode directly, so treat this as an adviser's caution, not a ruling.

Meta's pixel

Meta's version is shorter and blunter. Its developer documentation gives two commands: fbq('consent', 'revoke') to "pause sending Pixel fires to Facebook", and fbq('consent', 'grant') to resume once consent is given. The order is the whole game:

// Revoke consent before 'init' is called
fbq('consent', 'revoke');
fbq('init', '<your pixel ID>');
fbq('track', 'PageView');

// Once affirmative consent has been granted
fbq('consent', 'grant');

Meta's note is easy to skim past, and it is important: "You need to call revoke on every page." If the revoke line sits in a script that loads after the pixel, or only on the home page, the gate is open everywhere else.

TikTok and everyone else

TikTok's help page, as captured in June 2026, says its first-party and third-party cookies are enabled by default with the TikTok Pixel, and it suggests a consent management platform if you have no developers. That moves the problem rather than solving it: the platform must block the TikTok Pixel until consent, and you must test that it does.

For every other tool, ask the same question. Does it have a consent switch, or can your tag manager hold it back until consent? If neither, it should not be on a sensitive page. That includes session replay and heatmap tools, which can record far more than a pixel sends.

The gate is not the consent

One last point, because tidy implementations still fail here. Consent mode passes on whatever your banner collected. If your banner says "We use cookies to improve your experience. OK?", then the gate works perfectly and the consent is still invalid, because the visitor said yes to biscuits. The Medmate reasoning is about what the visitor was told, not about which API you called. The code decides when a pixel can speak. The words on the banner decide whether the "yes" means anything.

I wrote about what a consent management platform is for in 2021. Five years later, my update is short: the software was never the hard part. Knowing what is on your site is.

Part 6: Tamsin Audits Her Clinic's Website

GPC:.1await

Meet Tamsin. She is made up, but her website is not unusual. She runs a small physiotherapy practice in Hobart that specialises in pelvic health: pregnancy, post-natal recovery, continence and pelvic pain. An agency in Melbourne built the site four years ago. It has a booking widget, a blog, a "Conditions we treat" section with a page for each condition, and a cookie banner that says "This site uses cookies. Got it."

She reads about Medmate on Thursday, makes a pot of tea, and gives herself a week.

Monday: list every pixel

Tamsin opens her home page in a private browser window, so no earlier consent is stored. She opens the developer tools, goes to the Network tab, and reloads the page without touching the banner. Then she types into the filter box, one at a time: facebook, tiktok, google, pinterest, linkedin, snap, hotjar, clarity. She writes down every domain that answers, before she has clicked anything.

She repeats this on three more pages: a condition page, the booking page and the booking confirmation page. Confirmation pages are worth checking, because they are where conversion tags live.

Then she runs the site through Blacklight, a web-based scanner from The Markup that the OAIC's report points to. It checks for ad trackers, third-party cookies, session recording, keystroke capture and data sent to Facebook, TikTok and Google Analytics.

Last, she lists every tag in her tag manager and every pixel ID in her ad accounts, active or not. Her list, at the end of Monday:

• a Meta Pixel with Advanced Matching turned on, on every page;
• a Google Ads remarketing tag on every page;
• Google Analytics 4;
• a heatmap tool the agency added for a website redesign in 2023 and never removed;
• a LinkedIn tag that nobody can explain.

Five clerks. Tamsin knew about two of them.

Tuesday: find the pages that say too much

Next, Tamsin takes her site map and marks every page where the visit itself says something about the visitor's health. For her, that is most of the site: every "Conditions we treat" page, the blog posts on pelvic pain and incontinence, the booking page (because the booking widget adds the appointment type to the URL) and the confirmation page.

She checks three places where sensitive information leaks without anyone meaning it to:

• URLs, including query strings. /book?type=pelvic-pain-initial tells the pixel exactly what the booking was for;
• site search. The OAIC report's "UTI Medication" example came from a search box. If search terms appear in the URL, they appear in the note;
• button and form labels. "Book a continence assessment" is a button label, and Meta's pixel collects button labels.

Then she looks at the Meta Pixel's event settings. Advanced Matching is on, which means the pixel hashes the email and phone number from her booking form and sends them. On a pelvic health booking form, that is the most sensitive combination on the site: a matching key for the person, plus the page that says why they came.

Wednesday: decide, pixel by pixel

For each clerk, Tamsin asks one question: does this need to be on a sensitive page at all? The OAIC's guidance gives her three options. Avoid pixels where the visit itself is sensitive (it says "it may be preferable to avoid" them). If you keep one, configure it "to collect and share the minimum amount of data" and place it only on selected pages. And where sensitive information may still be collected, get express opt-in consent first.

Her decisions:

• The LinkedIn tag: removed. Nobody could say what it was for, which answers the question.
• The heatmap tool: removed. The redesign ended in 2023.
• The Meta Pixel: kept for the home page and the general "About" pages, removed from every condition page, the blog's health posts, the booking flow and the confirmation page. Advanced Matching turned off.
• The Google Ads tag: the same as the Meta Pixel. Conversions will be measured on a neutral "thank you" page with no appointment type in the address.
• GA4: kept, behind consent, with the booking widget changed so the appointment type no longer appears in the URL.

This costs her something. Retargeting people who read the pelvic pain page was the agency's favourite campaign. It was also, on the Commissioner's reasoning, a clinic forming an opinion about a visitor's health and acting on it without consent.⁸

Thursday: build the flow

Now the gate. Tamsin's developer sets it up in the tag manager so that, on every page:

1. The consent defaults load first: gtag('consent', 'default', …) with all four Google types denied, and fbq('consent', 'revoke') before the Meta Pixel's init.
2. The Google tags use basic mode on any page that is still allowed to have them, so nothing goes to Google before a choice.
3. The banner appears on the first page view. It replaces "This site uses cookies. Got it." with plain words: this site uses tracking pixels from Meta and Google; they send the pages you visit and the buttons you click to those companies; we use this to measure and show ads on Facebook, Instagram and Google; you can say yes or no to each. There are two buttons of equal size, "Allow" and "No thanks", and a link to the details.
4. Only "Allow" sends the update and grant commands. "No thanks" sends nothing, and the pixels stay silent.
5. Her privacy policy gets a new section that names each pixel, each platform, what it collects and why. The banner links to it.

Then the only test that counts. Tamsin opens a private window, loads a condition page and watches the Network tab before touching the banner. Nothing to Meta or Google Ads. She clicks "No thanks" and browses three more pages. Still nothing. She clicks "Allow" on the home page and sees the Meta request appear. She screenshots each step and files them with the date.

If you are reading this with your own Network tab open and a sinking feeling, that is a perfectly normal response, and it is a lot cheaper to have it now than in a letter from Sydney.

Friday: clean up what already left

The pixels have run for four years, so data is already on the other side. The Commissioner ordered both organisations to destroy the sensitive information in the pixel providers' dashboards, and Tamsin takes the hint. She deletes the audiences built from condition pages and any customer list uploaded to Meta, and records what she deleted and when.

Last, she makes it a habit rather than a project. The OAIC says it in two documents: pixels are not "set and forget". Tamsin sets a quarterly reminder to repeat Monday's network check, and adds one line to her agency contract: no new tag without her written approval and a note of what it sends. She also does a short privacy impact assessment for the pixels she kept, because none of the 12 organisations the OAIC inspected had done one.

Her week, in a checklist you can copy:

1. List: load key pages in a private window with the Network tab open and record every request to a platform before any click. Cross-check with Blacklight and your tag manager.
2. Map: mark every page where the visit, the URL, a search term or a button label reveals something sensitive (health, sexuality, politics, religion, ethnicity, union membership).
3. Decide: remove pixels from those pages where you can. Turn off advanced matching. Strip sensitive detail from URLs.
4. Gate: set every consent default to denied before any tag loads, on every page. Use Google's basic mode on sensitive pages. Call Meta's revoke before init.
5. Ask properly: name the pixels, the platforms, the data and the purposes. Opt-in for sensitive pages, with a real "no".
6. Test: prove in the Network tab that nothing fires before "yes", and after "no". Keep the evidence.
7. Clean up: delete audiences and lists built from sensitive pages. Update the privacy policy.
8. Repeat: check again every quarter, and control who can add tags.

Final Thoughts

Go back to Noor on the couch at 1:40 am. The clinic she visited was not run by villains. An agency recommended a pixel, and the pixel did what the documentation promised. Nobody asked what the little clerk writes down, or where the pigeon goes.

That is what the Medmate and Monash IVF determinations change. Until 24 June, "we did not know the pixel sent that" was an awkward answer. Now it is an admission. The Commissioner has said that you collect what your pixel collects, that a person you can single out for an ad is a person you can identify, that a visit to a health page can be health information, and that a banner about cookies is not consent to any of it.

The single takeaway is this: no pixel should speak on a sensitive page before the visitor has said a specific, informed yes, and you should be able to prove it in your browser's Network tab. If you do only one thing this week, do Tamsin's Monday. Open a private window on your most sensitive page, open the Network tab, and reload without touching anything. What you see in the first second is your real privacy policy.

And if you last looked at your site's tags in 2023, you are in good company. One health provider found 50 clerks on its own website, and only went looking after the regulator got in touch.

Now, if you'll excuse me, I have a network tab to check and a pot of tea going cold beside it.