Methodology

Maintained by Denis Alekseev · Last updated November 7, 2026

What HealthPixel Check measures, how each finding is decided, and where the method stops. The same rules run in the web checker and in the open-source engine (MIT licence). The method is open, so anyone can re-run a check; a result reflects the site at the time of the check.

What is measured

A clean, headless Chrome browser opens a public website and records every request the pages send to advertising, analytics, session-replay, call-tracking and chat-widget vendors. From those requests the check reports:

which advertising platforms receive data when a page loads (for example Meta, Google Ads, TikTok, LinkedIn, Microsoft/Bing, X, Pinterest, Snap, Reddit and programmatic ad tech);
whether they receive a page address or title that names a condition, procedure or medication, such as /opioid-addiction-treatment/, “HIV Testing” or /dental-implants/;
which events and custom parameters are sent, for example a Meta PageView event with cd[…] fields, or GA4 event names and ep.* parameters;
whether a consent banner or consent-management platform is present, and whether trackers fire before the visitor interacts with it;
signals of server-side tagging or a privacy relay, and Google Consent Mode flags;
whether the result is inconclusive: the site showed a bot-check page, some pages could not be loaded normally (no response, 403, 429 or a 5xx error), or only half of the planned pages or fewer loaded;
caveats that qualify a result without making it unreliable: a consent tool that loaded but showed no banner, a banner with no reject option the browser could find, or a banner click that did not complete.

Which pages are visited

Given a home page, the check visits it and one or two typical inner pages: a service or condition page, and an insurance, admissions or contact page. Given a specific page, such as an ad landing page, it visits that page first, then the home page and one typical page.

The browser only moves the mouse and scrolls. It never fills in or submits forms, never logs in, never types personal data, and never clicks anything outside the cookie banner, and only in the runs labelled for that.

The browser identifies itself honestly in its user agent but does not advertise automation (navigator.webdriver). Some consent tools hide their banner from automated browsers, and the measurement has to see what a real visitor sees.

The runs

A check makes up to five runs. Each run starts in a fresh browser profile with no cookies, so one run cannot influence another. Accept and Reject run only if a cookie banner is found, and Direct entry only when the check starts from the home page and a service page is found.

Run	What the browser does
No choice	Opens the pages and does not touch the cookie banner. This is what every visitor’s browser sends before making a choice.
Accept	Clicks the banner’s accept button, then repeats the visit.
Reject	Clicks the banner’s reject or decline option, then repeats the visit. The opt-out uses the open-source DuckDuckGo autoconsent rules, with a decline-button fallback.
Global Privacy Control	Sends the `Sec-GPC: 1` header and sets `navigator.globalPrivacyControl = true`, the opt-out signal used by privacy-focused browsers.
Direct entry	A separate fresh visit that lands directly on a service page, as a visitor arriving from an ad or a search result would. Some tools, such as call tracking, record only the first page of a visit.

Comparing the runs shows what changes with the visitor’s choice: for example, a tracker that keeps firing after “Reject”, or one that ignores Global Privacy Control.

How findings are decided

Finding	Rule
Advertising platform contacted	A beacon (a request that sends data, not just a script download) to a host in the advertising category of the vendor list.
Page address sent	Any query or body parameter whose value is a URL on the scanned site’s registered domain.
Condition-naming address or title	The URL path or query, or the page title, contains a term that names a condition, substance, procedure or medication. The hostname is never counted. Setting words such as treatment, outpatient or therapy count as “care-related”, not “condition-naming”.
Consent tool	Detected through the open-source DuckDuckGo autoconsent rules (846 rules for known consent tools in the copy bundled with the engine); scripts or JavaScript globals of known consent vendors, including first-party-hosted copies; or a visible fixed overlay or modal with consent wording and accept/decline buttons, including inside open shadow DOM and iframes.
Server-side signal	Google Analytics or Tag Manager collection on a first-party subdomain, or a known server-side relay or customer-data platform.

The vendor list and the vocabulary of condition terms are plain, readable files in the open-source engine. Corrections and additions are welcome as pull requests.

Trackers behind the site’s own subdomains

A tracker can be served from an address that looks first-party, such as metrics.example.org, while the DNS record points to a vendor (CNAME cloaking). The check resolves the CNAME chain of every first-party host the page contacted and matches it against the open AdGuard cname-trackers list and a list of known relays and customer-data platforms.

What a browser cannot see

The check observes what a visitor’s browser sends. It cannot see:

server-to-server transfers, for example a conversions API that sends events from the organization’s server directly to an advertising platform;
logged-in areas such as patient portals;
what happens after a form is submitted, because the check never submits forms;
what a vendor does with the data after receiving it, or what contracts are in place with that vendor.

A clean result therefore means “nothing was observed in these runs”, not “nothing is shared”. A finding describes data flows on the days and pages tested; sites change, and a later check can differ. This is a measurement, not legal advice.

Responsible use and disclosure

Full findings go only to the organization. The public summary in the checker shows vendor names and counts. A link to the full report, with exact page addresses, titles and screenshots, is e-mailed only to an address at the checked organization’s own domain; the link works for 72 hours.
Only public pages, at a polite rate. The check does not submit forms, log in or access non-public areas. The engine’s default user agent identifies the tool and links to its repository.
No health information is collected. The check never types personal data into the site it visits.
Corrections. If you believe a finding about your site is wrong, write to research@healthpixelcheck.org with the address checked and what you observed. We will re-run the check and correct the method if it is at fault.