A Clinic's Condition Pages Went to TikTok and LinkedIn While Google Analytics Waited for Consent
Cedar Valley Clinic is a made-up family practice on PXTA’s test fixtures, and its sample report is a common story. The web team set up a Cookiebot banner and wired Google Analytics to it properly: the analytics tag loads only after a visitor accepts. Later the marketing team ran a campaign on TikTok and LinkedIn and pasted both pixels into the site template. Nobody connected them to the banner.
So half the site’s tracking behaves and half doesn’t, and an audit that only checked “is there a banner?” would pass it.
Three Passes Tell Them Apart
PXTA loaded each of the clinic’s pages three times: with the banner unanswered, after rejecting, and after accepting. The consent behaviour table in the report sums it up in one line per tracker. Google Analytics: quiet, quiet, sends. That’s correct. The TikTok Pixel and the LinkedIn Insight Tag: sends, sends, sends. They ignore the banner entirely.
What the Pages Gave Away
On a clinic’s site the page address is the sensitive part. The clinic names its pages after what they treat, /conditions/anxiety and /conditions/diabetes, and its booking page carries the service, /book?service=therapy. Both pixels send the full page address with every event. PXTA’s sensitive-page rule recognises words about health in an address or title and reports each one:
On /conditions/anxiety, the TikTok Pixel sent the address of a page about health (/conditions/anxiety) before the consent banner was answered.
The site’s search page was worse. A visitor who searched for “anxiety medication” had the search term sent to both pixels, inside the page address:
On /search?q=anxiety+medication, the TikTok Pixel sent the search term “anxiety medication” after the visitor rejected tracking.
Each of these appears in the report with the request behind it: the TikTok event’s JSON and the LinkedIn request, each with the page address highlighted.
Why It Matters for a Clinic
US health regulators have warned hospitals and clinics that tracking technology on their sites can disclose health information, and pixel use on health sites has drawn lawsuits. A clinic can’t fix that by fixing the banner if the pixels never ask the banner anything. The fix here is one change in the template: load the TikTok and LinkedIn tags the same way Google Analytics is already loaded, after consent. Or don’t load them on condition and booking pages at all.
Rerun the audit afterwards and the behaviour table should show quiet, quiet, sends for every tracker on the site.