Chrome Kept Cookies in 2025. Health Privacy Rules Did Not Get Looser

For years, marketers waited for Google Chrome to phase out third-party cookies. In 2025, that story ended differently. Google said Chrome would keep its current approach. Some agencies took that as a sign that tracking was back to normal.

For private medical and aesthetic practices, that reading was wrong. The same year brought a proposed overhaul of the HIPAA Security Rule, continued HHS guidance on online tracking and the first class action under Washington’s consumer health data law. The browser decision changed nothing about what a practice may share with advertising and analytics vendors.

This retrospective covers what happened and what a practice owner should check on their website now. It is marketing guidance, not legal advice. Privacy law is complex and fact-specific; get qualified counsel for your situation.

What actually happened in 2025

Chrome’s decision. On April 22, 2025, Google’s Privacy Sandbox team announced that it had decided to maintain its current approach to offering users third-party cookie choice in Chrome and would not roll out a new standalone prompt for third-party cookies. Users can continue to choose their settings in Chrome.

The HIPAA Security Rule proposal. On January 6, 2025, HHS published a notice of proposed rulemaking to strengthen the HIPAA Security Rule. The abstract says it would revise existing standards to better protect electronic protected health information, citing significant increases in breaches and cyberattacks. Comments closed on March 7, 2025. As a proposal, its final form and timing were not settled in 2025.

The tracking guidance. HHS’s bulletin on online tracking technologies remained in place, with a note that on June 20, 2024, a federal court in American Hospital Association v. Becerra vacated the portion concerning certain visits to unauthenticated public webpages. The rest of the guidance still addresses booking pages, symptom checkers, patient portal logins and business associate agreements.

The first health data class action. According to WilmerHale’s analysis, the first class action under Washington’s My Health My Data Act was filed on February 10, 2025, against Amazon. The law regulates consumer health data collected outside HIPAA and includes a private right of action.

Why this mattered for private practices

Most practice websites run several third-party scripts: analytics, advertising pixels, chat widgets, booking tools, call tracking and session recording. Many were added by different vendors over the years, and few owners know exactly what each one sends.

The HHS bulletin highlights where the risk is highest. It says tracking on a webpage that lets individuals schedule appointments or use a symptom checker may collect protected health information, such as an email address or reason for seeking care, and that the HIPAA Rules apply in that case. It also says cookie banners that ask users to accept or reject tracking do not constitute a valid HIPAA authorization.

That is exactly where marketing pixels often sit, because booking and form pages are where conversions happen. A practice that installed an advertising pixel on its booking confirmation page to measure campaigns may be sending more than it realizes.

Not every practice is a HIPAA covered entity. Some cash-pay aesthetic practices may not be, though many are. State laws like Washington’s, and the FTC’s authority over health data, can apply where HIPAA does not. The point is not that every practice is in violation. It is that every practice should know what its website is doing.

What typical agencies did

Many marketing agencies install every available pixel on every page, because more data means better campaign optimization. They set up conversion tracking on booking forms, connect call tracking to ad platforms and add session recording tools to see how visitors behave, often without asking whether the practice is a covered entity or whether a business associate agreement is in place.

When the Chrome news came out, some told clients that the cookie problem was solved. It never was the real problem for health websites. Browser policy affects what is technically possible. Privacy law governs what is allowed.

We take a privacy-first approach to tracking. Our custom practice websites are built with a clear inventory of every script, minimal third-party tracking on sensitive pages and measurement designed around what the practice is permitted to share.

What it means for a practice today

1. Inventory every script

List every tag, pixel and third-party script on your website. Tag managers make this easier, but also check for code added directly by booking, chat and review vendors. Note which pages each one runs on.

2. Focus on sensitive pages

Booking, contact, intake, symptom checker, patient portal login and confirmation pages deserve the closest attention. Ask what information each script on those pages can access and where it goes.

3. Check your vendor agreements

If you are a covered entity and a vendor receives protected health information, the HHS bulletin says a business associate agreement and an applicable permission are required. Many advertising platforms will not sign one. Ask your privacy counsel how to handle that.

4. Measure differently

You can measure marketing without sending sensitive data to ad platforms. Track bookings and calls in your own systems, use aggregate or offline conversion data where appropriate and compare marketing spend against new patients and revenue. Our guide on predictability and scaling covers measurement that focuses on business results.

5. Update your privacy policy

Make sure your privacy policy accurately describes what your website collects and shares. The HHS bulletin is clear that a privacy policy alone does not permit disclosures of protected health information, but an inaccurate policy creates its own problems.

6. Review regularly

Websites change. New vendors add scripts, and plugins update. Review your tracking at least quarterly and whenever you add a new tool.

Common setups worth a closer look

Advertising pixels on booking pages. Conversion pixels are often placed on booking confirmation pages to tell ad platforms which clicks led to appointments. Depending on what the page contains and what the pixel collects, that can include information the HHS bulletin treats as protected.

Session recording. Tools that record mouse movements, clicks and typing can capture what patients enter into forms unless they are carefully configured. The HHS bulletin specifically lists session replay scripts among tracking technologies.

Chat widgets. Patients often describe symptoms or treatment interests in website chat. Know where those conversations are stored, who can see them and whether the vendor will sign the agreements you need.

Call tracking. Call tracking is valuable for measuring marketing, but some platforms record and transcribe calls and pass data to ad platforms. Check what is shared and with whom.

Embedded booking tools. Third-party booking widgets may carry their own analytics. Ask the vendor what they collect and share.

If you find a problem

If your audit shows a script sending information it should not, do not panic and do not simply delete everything without a record. Document what you found, remove or reconfigure the script, and talk to your privacy counsel promptly about whether any further steps are required, such as breach analysis or notification. The HHS bulletin notes that an impermissible disclosure to a tracking vendor can be presumed to be a breach unless a low probability of compromise is demonstrated, so this is a conversation for qualified advisors, not for your marketing vendor alone.

The advertising trade-off

Reducing tracking can make ad platforms less efficient at optimizing campaigns. That is a real cost. But the alternative, exposure to regulatory action, lawsuits and loss of patient trust, can be far larger. And as our retrospective on Meta’s 2025 health ad restrictions explains, the ad platforms themselves have been limiting what health advertisers can do with conversion data.

Practices that depend least on pixel-based ad optimization are the most resilient. Strong organic visibility, an excellent Google Business Profile, genuine reviews and referral relationships bring patients without sending their data anywhere. Our maps and AI search service is built around those channels.

Patient trust as a marketing asset

Patients are increasingly aware of online tracking. Many have read news stories about health websites sharing data with advertising platforms. A practice that respects privacy, and says so clearly, builds trust that supports premium positioning. That matters most for sensitive services such as behavioral health, men’s health, weight loss and hormone therapy, where patients care deeply about discretion.

A short, plain-language statement on your website about how you handle data, matched by practices that live up to it, is a quiet competitive advantage. Our retrospective on behavioral health and telehealth in 2025 touches on why discretion matters so much in that field.

Questions to ask your web and marketing vendors

A few direct questions will tell you where you stand. Which scripts are on our booking, contact and confirmation pages, and what does each one send? Which vendors have signed business associate agreements with us, and which have not? Do we use session recording anywhere that patients type information? Is call tracking connected to any ad platform, and what data passes between them? Who can add new scripts to our site, and how would we know?

A good partner answers clearly and provides documentation. If nobody can answer, that is the first thing to fix. Ownership matters too: your practice should control its own tag manager, analytics and ad accounts, so that you can see and change what runs on your site without waiting on a vendor, and so that nothing is lost if you ever change partners.

What 2025 does not tell us

We do not have reliable public data on how many private practice websites send protected health information to tracking vendors, or how often regulators or plaintiffs target small practices. The HIPAA Security Rule proposal had not been finalized in 2025, and its requirements may change. State privacy laws continue to evolve. Whether HIPAA, state law or FTC rules apply to your practice depends on your specific circumstances, so get qualified advice rather than relying on general articles, including this one.

The premium practice advantage

Typical agencies treat tracking as a technical setting: install everything and optimize later. Premium practices treat patient data with the same care online as in the exam room. That approach reduces risk, supports trust and still allows clear measurement of what marketing produces.

That is how we build for practices across the specialties we serve: privacy-conscious websites, measurement focused on bookings and revenue, and visibility that does not depend on sharing sensitive data. Our team works from Austin with practices nationwide.

The bottom line

Chrome’s April 2025 decision to keep its approach to third-party cookies did not loosen health privacy rules. HHS proposed a stronger HIPAA Security Rule in January, its tracking guidance continued to cover booking and portal pages, and Washington’s health data law produced its first class action in February. Practices should inventory every script on their sites, focus on sensitive pages, check vendor agreements and measure marketing in ways that protect patients.

Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.

Put this playbook to work: see how it applies to the Prestige System for medical practice marketing.

← Back to The Elite Practice Growth Lab