Is Your Website Sharing Visitor Data Without You Knowing?

Most business websites collect more information about visitors than their owners realize. Analytics tools, advertising pixels, embedded videos, maps, chat widgets and booking tools can all record what people do on a site and send that information to outside companies. In many cases, those tools were added years ago by different vendors, and no one has looked at them since.

That used to be a technical detail. Today it can be a legal one. In this article, we explain what tracking tools are commonly found on business websites, why they have drawn attention from attorneys and regulators, which industries may face higher risk, and what questions are worth asking about your own site.

What Tracking Tools May Already Be on Your Website

A typical small business website often includes several of these:

• Website analytics. Tools such as Google Analytics record which pages people visit, how long they stay, and where they came from.
• Advertising pixels and tags. Code from Google Ads, Meta (Facebook and Instagram) and other ad platforms tracks visitors so businesses can measure ad results or show ads to past visitors.
• Embedded content. YouTube videos, Google Maps, social media feeds and review widgets can set their own cookies when a page loads.
• Forms, chat and scheduling tools. Third-party contact forms, live chat and appointment booking tools may collect and store what visitors type.
• WordPress and Joomla plugins sometimes add tracking features that are turned on by default.

None of these tools is unusual, and many are useful. The concern is that site owners often do not know which ones are running, what information they collect, or where that information goes.

Why Website Tracking Has Become a Legal Issue

A Growing Wave of Privacy Claims

Over the past several years, attorneys have brought a large number of claims against businesses over common website tracking tools. These claims generally argue that visitor information was shared with advertising platforms without proper notice or consent. Many rely on older wiretapping and consumer privacy laws that were written long before websites existed.

• Healthcare and counseling providers have faced claims that tracking tools on appointment, contact and service pages shared patient information with advertising platforms.
• Utilities and other account-based websites have seen attorney-organized claims, including mass arbitration, over tracking on account login and bill-pay pages.
• Retailers and other consumer businesses have faced claims over chat tools, session recording and advertising pixels.

Some of these claims are dismissed and some are settled. Even a claim that goes nowhere can still cost a business time and legal fees to answer.

What Regulators Have Said

Federal regulators have also addressed website tracking, particularly where health information is involved.

• HHS guidance on tracking technologies. The U.S. Department of Health and Human Services has published guidance on online tracking technologies for healthcare organizations covered by HIPAA. It states that a cookie banner asking visitors to accept or reject tracking is not a valid HIPAA authorization. In June 2024, a federal court in Texas vacated part of that guidance dealing with public webpages, and HHS has said it is evaluating next steps. The rest of the guidance remains posted.
• FTC enforcement. In 2023, the Federal Trade Commission finalized an order against an online counseling service that it said had shared email addresses, IP addresses and health questionnaire information with Facebook, Snapchat, Criteo and Pinterest for advertising. The company agreed to pay $7.8 million and was banned from sharing health data for advertising.

Industries That May Face Higher Risk

Any business with a website can be affected, but some types of sites tend to draw more attention:

• Healthcare practices, counseling and therapy providers, and medical spas
• Utilities, cooperatives and other organizations with customer account portals
• Law firms, financial advisors and other professional services that collect sensitive details through forms
• Businesses that run paid advertising campaigns with retargeting
• Any site where visitors share personal information through contact, intake or scheduling forms

Why a Cookie Banner Alone May Not Be Enough

Many businesses add a cookie consent banner and assume the issue is handled. A banner is a good step, but it does not always do what owners expect.

• Tags may fire before consent. If a consent tool is not set up correctly, analytics and advertising tags can load and send data the moment a page opens, before the visitor clicks anything.
• Some tools are missed. A banner can only control the tools it knows about. Tracking added later through a plugin, embed or new ad campaign may run outside of it.
• Settings matter. Google’s consent mode has a basic and an advanced setup. In the advanced setup, Google tags still load and can send limited, cookieless data even when a visitor declines. Which setup fits a given site is a decision worth making on purpose.
• Sensitive pages may need a different approach. For healthcare and counseling sites, the safer option on appointment, contact and intake pages is often to remove advertising and remarketing tags from those pages entirely, rather than relying on consent.

Questions Worth Asking About Your Own Website

You do not need to be technical to start this conversation. These questions can help:

• Which analytics, advertising and third-party tools are running on our site right now?
• Who added them, and are we still using all of them?
• Do any of them load on pages where visitors share personal, health or account information?
• Does our site have a consent tool, and has anyone tested whether tags actually wait for consent?
• Does our privacy or cookie policy accurately describe what the site collects?
• Has our attorney reviewed our privacy disclosures recently?

How Moore Tech Solutions Can Help

Moore Tech Solutions has been building and supporting business websites since 2004. We now offer a Website Cookie and Privacy Review, a technical service that typically includes:

• Scanning your website to identify cookies and tracking tools, and where each one sends data
• Removing tools you no longer need, with your approval
• Installing and configuring a consent management tool for your site
• Preparing a draft Cookie Policy based on what we find, for your approval and your attorney’s review
• Testing the setup and providing a written report of what we found and what we changed

This is technical work, not legal advice. It is designed to give you and your attorney a clear picture of what your website is actually doing, so decisions can be made with accurate information. Clients on our website support plans can also ask us to recheck their sites as tools and plugins change.

Conclusion

Website tracking tools are common, useful and easy to forget about. As privacy claims and regulatory attention continue, it makes sense for business owners to know exactly what their websites collect and share. A careful review is often the first step toward making informed decisions with your attorney.

If you would like to know what your website is sharing, contact Moore Tech Solutions to ask about a Website Cookie and Privacy Review.

This article is for informational purposes only and is not legal advice. Privacy laws and how they apply vary by state, industry and the information a website collects, and results from any website service vary based on implementation. Moore Tech Solutions provides technical website services and does not guarantee compliance with any law or regulation. Consult a qualified attorney for guidance specific to your business.