Sensitive visits may be shared.
A page address can reveal that someone is looking at ADHD assessments, fertility care or trauma support. An advertising tool may send that address even if they never fill in a form.
Did you know the OAIC found privacy breaches on health websites?
Australia's privacy regulator found that two health providers breached privacy laws through their use of website tracking pixels.
Read the June 2026 findings (opens in a new tab)Vantage checks what your healthcare website shares with Google, Meta and other companies, then helps you fix tracking you don't need.
Audits from A$149 · Scope agreed before work beginsSomeone visits your websiteFertility consultationThey read about a service. They don't fill in a form.
An advertising tool runs on the page
Sent to Google AdsThe address of the page they visited
clinic.example/services/fertility-consultationThat address reveals the service they were looking at.
A name or medical record is not the only information that can be sensitive. The page itself can say something about a person's health interests.
See what information is shared
Work with your existing agency
Keep checking after changes
For Australian healthcare providers
- Allied health
- Mental health
- Fertility
- Specialist practices
- Healthcare groups
If nobody checks, unwanted sharing can keep happening.
Your website can look normal and your ads can work while information about visits to sensitive pages is sent to other companies. A working website does not tell you whether its tracking is appropriate.
You may not be able to explain it.
If a patient or privacy adviser asks what your website shares, knowing your agency uses Google Ads is not enough. You need to know which pages send information, what is sent and who receives it.
Old tracking can stay. Removed tracking can return.
Tools from past campaigns can remain active. A new plugin, agency change or website update can add tracking or undo a previous fix. Without repeat checks, you may not notice.
You do not have to guess or turn all your advertising off.An audit gives you the evidence to decide what to keep, change or remove.
See what's included from A$149You know you use Google Ads.
Do you know what it receives?
Tracking pixels are small pieces of code used to measure visits and advertising results. Depending on their settings, they can also send the address or title of the page someone is viewing to another company.
Example audit finding
Google Ads receives the page address and title.
Page visited: Fertility consultation
/services/fertility-consultation- Who receives it?
- Google Ads
googleads.g.doubleclick.net - What is sent?
- The page address and title
- Did the browser send it?
- Yes
- Was a consent option selected?
- No, not during this check
- Does this establish a legal breach?
- No legal conclusion made
What this means for your practice
In this example, Google receives information about a visit to your Fertility consultation page. This does not, by itself, show that a medical record or completed form was sent.
What we would reviewDoes this advertising tool need to run on this page? If not, we can help exclude the page and test that the marketing measurement you still need continues to work.
Technical details for your developer
Simplified example fields, not a live capture or a vendor-specific payload.
{
"page_url": "https://clinic.example/services/fertility-consultation",
"page_title": "Fertility consultation",
"event": "page_view"
}Your report explains the finding in plain English, includes the evidence and recommends what to do next. You can share it with your agency or privacy adviser.
How we verify itOAICOffice of the Australian
Information Commissioner
Findings published 24 June 2026Information Commissioner
This has already led to privacy breaches in Australian healthcare.
The OAIC found privacy breaches involving sensitive information collected through tracking pixels at Medmate and Monash IVF. It also published a separate report after inspecting 50 health service provider websites.
Leaving tracking unchecked can leave a privacy risk unaddressed. The practical first step is to establish what your website actually sends. Your legal or privacy advisers can then assess your obligations using that evidence.
Read the OAIC’s findings (opens in a new tab)Vantage is independent and is not endorsed by the OAIC.
We check your website, help fix the issues and test again.
You don't need to understand the code or replace your agency. We explain what we find, agree changes with your team and check whether those changes worked.
Scan
Visit the agreed pages and check which tools send information to other companies.
Find out what your website sharesVerify
Manually check important findings. Show you what was sent, from which page and to whom.
See the evidence for yourselfRemediate
Help your team or agency change where tools run and what they send, then test the result.
Fix unwanted tracking carefullyMonitor
Check again over time to spot new tracking or old tools returning after website changes.
Know when something changesWhat we check
Advertising and analytics tools, and the pages where visitors use them.
- Google Ads
- Google Analytics
- Meta Pixel
- TikTok Pixel
- Tag managers
- Third-party analytics
- Booking pages
- Enquiry forms
- Sensitive service pages
- Information sent to other companies
We agree which pages and interactions to check before starting. Checks of a public website cannot reveal everything sent between company servers or happening behind a login. We do not submit real patient information.
Start with an audit. Choose the help you need after that.
Website Tracking Audit
Find out what is being shared.A report showing which companies receive information from your website, what they receive and which pages send it.
- Advertising and analytics tools identified
- Sensitive pages checked for sharing
- Evidence and recommended changes
Remediation
Fix the tracking you do not need.Help your developer or agency make targeted changes, with testing to protect the advertising measurement you want to keep.
- Review when and where tools run
- Exclude sensitive pages where appropriate
- Before-and-after testing
Monitoring
Catch tracking that changes later.Repeat checks to find new tools, removed tracking that returns and new information being shared after website updates.
- New and returning trackers identified
- Changes in what is sent and to whom
- Check frequency agreed for your website
A website update can undo a privacy fix.
A new campaign or plugin can put advertising tools back on pages you previously excluded. Monitoring checks for those changes so they can be reviewed and corrected.
Talk about ongoing monitoringFirst check completedBooking page is not sending information to an advertising tool.
Advertising tool appears after an updateThe booking page now sends its address. This needs review.
Change made and checked againThe tool no longer runs on the booking page during the re-check.
Illustrative report entries. Check frequency and coverage are agreed for your website.
We explain the problem and help you fix it.
You receive a plain-English explanation for your practice and the technical evidence your developer needs to make changes.
Look at an example findingHealthcare context matters.
A visit to a trauma support page can reveal more about someone than a visit to your homepage. We pay particular attention to sensitive services, bookings and enquiries.
Evidence before conclusions.
We manually check important findings and show what was sent, from which page and under what conditions. We also explain what the check cannot tell us.
Your existing team stays involved.
Your developer or marketing agency can make the changes with our guidance. We test the result so you can see whether the unwanted tracking has stopped.
We can keep checking after the fix.
Ongoing checks help spot new tools, removed tracking that returns and information being sent to companies that were not there before.
Know what your website sends. Then decide what to change.
You do not need to know which trackers you have or what to ask your agency. Send us your website address. We will confirm the scope and price before work begins.
The report is yours to keep and use.
Keep the findings. Share them with your team, agency or privacy adviser. Remediation and monitoring are separate decisions.
Website Tracking Audit
Starting at
A$149AUD
Find out what your website shares with other companies.
- Which advertising and analytics tools are installed
- Which pages share information, including sensitive services
- What information is sent and which companies receive it
- Manual verification of important findings
- Clear evidence and practical recommendations
Final pricing depends on website size and review scope. We confirm the total, including any applicable GST, before you commit. No ongoing subscription required.
Questions before you get started
We intentionally use Google Ads. Why would we need this?
You may want to measure how well your ads work without sharing visits to every sensitive service page. A tool installed across the whole website can do both. We check which pages send information to Google Ads and whether that matches what you actually want.
Does Vantage provide legal advice?
No. We provide technical evidence, remediation and monitoring. We do not decide whether your organisation has breached the law or certify compliance. Legal interpretation belongs with your legal or privacy advisers. Our findings give them something concrete to review.
Will changing tracking break our advertising?
Tracking changes can affect measurement, so they should be scoped and tested carefully. We work with your team or agency to understand what you need to measure, make targeted changes and compare behaviour before and after. The aim is to preserve legitimate marketing measurement while reducing unnecessary or unintended tracking.
Do we need to remove all tracking?
No. Some tracking may be useful and intentionally configured. We might recommend stopping a tool on particular pages, changing the information it sends, adjusting when it runs or removing an old tool you no longer use. The audit tells you what needs attention before anything is changed.
Can you work with our existing agency?
Yes. Your developer or marketing agency often knows why a tool was installed. We give them specific evidence and practical changes to consider, agree responsibilities and re-test the result. You do not need to replace your agency.
What do you need from us to start?
Your public website address and a contact person are enough for an initial conversation. We will agree the pages, journeys and review scope before starting. We do not need patient records. Any access needed for configuration changes is discussed separately.
What if the audit finds nothing that needs changing?
You still receive a record of the tools found, the pages checked and the companies receiving information, along with the limits of the review. We do not invent issues to justify further work. The result describes what happened during our checks; it cannot guarantee that no tracking exists elsewhere or will be added later.
See what your
website is sending.
Start with your website address. We will get back to you to agree what needs checking and what it will cost.
No patient information required.
No changes to your website without agreement.