CVS Health & Criteo $20.5M Website Tracking Settlement: What Healthcare Defenders Must Do About Pixel Privacy Risk

CVS Health and ad-tech firm Criteo have agreed to pay a combined $20.5 million to resolve class action litigation alleging that tracking technologies embedded on websites and digital properties transmitted sensitive visitor information — including health-related browsing behavior — to third parties without proper consent. A related settlement involving American Wellness Corp. underscores that this is not an isolated case: it is the latest in a sustained wave of litigation, regulatory enforcement, and FTC/HHS scrutiny targeting the healthcare industry's use of advertising pixels, session replay tools, and analytics SDKs.

I've spent 15 years in incident response and compliance, and I can tell you plainly: this is the breach class nobody patched for. There is no CVE, no exploit chain, no ransomware note. The "threat actor" is your own marketing stack. And the plaintiffs' bar, the FTC, and HHS OCR have figured that out. Meta Pixel litigation alone has produced hundreds of filings against health systems since 2022, and HHS OCR's guidance on online tracking technologies (originally issued December 2022, updated March 2024) made it explicit that tracking code on authenticated patient portals and even unauthenticated pages tied to health conditions can constitute an impermissible disclosure of PHI under HIPAA.

If your organization operates a healthcare website, patient portal, telehealth landing page, or appointment scheduler, you need to treat your web tracking inventory as a data exfiltration surface — because regulators and courts now do.

Technical Analysis: How Tracking Pixels Become PHI Disclosures

The Mechanism

Third-party tracking technologies — Meta Pixel, Google Analytics, Criteo's retargeting tags, TikTok Pixel, session replay tools like Hotjar and FullStory — operate by executing JavaScript in the visitor's browser. That script collects data and transmits it to the vendor's servers. What defenders consistently underestimate is what gets transmitted:

Page URL and title — cvs.com/.../hiv-medication-refill or an appointment confirmation URL containing a condition-specific path is itself health information tied to an identifiable individual.
URL query parameters — search terms, symptom inputs, provider names, and appointment types frequently ride along in query strings captured by analytics beacons.
IP address + device identifiers + cookies — under HIPAA, an IP address combined with health-context browsing is individually identifiable health information. OCR's guidance is unambiguous on this point.
Form field data — session replay and some tag managers have been observed capturing keystrokes and form inputs, including on unauthenticated pages where users enter symptoms or search for care.
Authenticated session context — pixels firing inside a logged-in patient portal can correlate a known identity (name, email hash, member ID) with specific medical pages viewed.

Why This Passed Your Security Review

In my experience auditing healthcare environments, tracking tags almost never go through security review because they're deployed by marketing through a tag manager (Google Tag Manager, Tealium, Adobe Launch) — often without any change control. The typical failure chain:

Marketing deploys a pixel container-wide via GTM to "measure campaign performance."
The tag fires on every page, including authenticated portals, symptom checkers, and pharmacy refill flows.
The vendor's JavaScript collects URL, referrer, IP, and hashed identifiers by default.
No Business Associate Agreement (BAA) exists with the vendor — Meta, Google, and Criteo will not sign BAAs for their standard advertising products.
The disclosure runs for months or years before discovery — often via a plaintiff's demand letter, a HHS OCR complaint, or an investigative journalist, not your own monitoring.

Enforcement and Litigation Status (2025–2026 Landscape)

This is active, confirmed, and accelerating — not theoretical:

HHS OCR updated its tracking technology guidance in March 2024 after the AHA v. HHS litigation narrowed some portions, but OCR continues to assert jurisdiction over tracking on authenticated pages and pages where health conditions can be inferred. OCR has stated it will enforce against entities disclosing PHI to tracking vendors without BAAs.
The FTC has taken enforcement action under Section 5 and the Health Breach Notification Rule against GoodRx ($1.5M, 2023), BetterHelp ($7.8M, 2023), Premom, and Cerebral ($7M, 2024) for sharing health data with advertisers — and continues to treat this as a priority in 2025–2026.
Class action filings under wiretap statutes (CIPA in California, VPPA, state consumer protection laws) have hit hundreds of health systems, with seven- and eight-figure settlements now routine. The CVS/Criteo $20.5M resolution is consistent with the upper band of these outcomes.
State attorneys general (notably Washington under the My Health My Data Act, which carries a private right of action) have added new exposure vectors for any entity handling consumer health data — not just HIPAA covered entities.

The practical translation for defenders: the "detection" problem here is inventory and egress auditing, and the "remediation" problem is governance and tag architecture. This is a data-flow control failure, not a perimeter failure.

Executive Takeaways

Because this is a governance and data-flow threat rather than an exploitable vulnerability, the right response is an audit-and-control program, not signature-based detection. Here is what I direct clients to execute:

1. Build a complete tracking technology inventory — this week. Crawl every public-facing property, patient portal, appointment scheduler, and telehealth entry point with a tool like BlackLight (The Markup's free scanner), a headless-browser crawl (Playwright/Selenium with HAR capture), or a commercial tag governance platform (e.g., ObservePoint, Lokker, Feroot). Enumerate every third-party script, the domains it calls, and the pages where it fires. If you cannot produce this inventory on demand, you cannot defend a discovery request — and plaintiffs' experts will produce it for you.

2. Map data flows against the OCR two-part test. For each tag, document: (a) does it fire on authenticated or health-context pages, and (b) does it transmit an IP address, device ID, URL, or identifier to a third party without a BAA? Any "yes/yes" pairing is a probable impermissible disclosure requiring remediation and, potentially, breach notification analysis under 45 CFR §§ 164.400–414. Involve privacy counsel on the notification determination — do not make that call unilaterally.

3. Segment your tag architecture. Implement server-side tag management or a customer data platform (CDP) with healthcare-grade controls so PHI never touches the browser-side vendor script. Restrict marketing tags to strictly non-health pages via tag manager triggers (never container-wide deployment), and strip URL query parameters, hash PII client-side before any egress, and block tag execution on authenticated routes entirely. If a vendor won't sign a BAA, the answer is architectural isolation — not a waiver.

4. Put tag deployment under security change control. GTM and equivalent platforms must require security/privacy sign-off for new tags, with a quarterly re-certification of the deployed tag inventory. Treat a new pixel like a new outbound firewall rule: named owner, business justification, data-flow documentation, and expiry/review date.

5. Extend monitoring to egress. Deploy CSP (Content-Security-Policy) reporting and monitor report-uri/Reporting-Endpoints violations for unexpected third-party script origins — this doubles as both a pixel-governance control and a Magecart/skimmer detection layer. Browser isolation or synthetic transaction monitoring on portal pages can alert when a tag begins exfiltrating new data fields after a vendor-side configuration change (vendors change collection behavior silently; Meta's pixel updates are a recurring offender).

6. Prepare the litigation posture before you need it. Given the settlement trajectory — CVS/Criteo at $20.5M, Advocate Aurora at $12.25M, Novant Health, and dozens more — assume discovery. Maintain dated evidence of your inventory, risk assessments, remediation actions, and counsel-guided decisions. Demonstrable good-faith remediation is materially different in settlement negotiations than ignorance. Also review cyber/privacy insurance policies: many carriers now exclude pixel-tracking claims or require attestation of a tracking governance program at renewal.

Remediation Priorities (30/60/90)

First 30 days:

Complete the full tracking inventory across all web properties, including staging and campaign microsites (a frequent blind spot).
Immediately disable any third-party pixel firing on authenticated portal pages, appointment flows, and pharmacy/telehealth paths pending review.
Freeze new tag deployments pending governance implementation.

By 60 days:

Deploy CSP in report-only mode to baseline third-party script origins; alert on net-new origins.
Stand up tag manager change control with security approval gates.
Complete the OCR two-part analysis per property with counsel; initiate breach-risk analysis where disclosures are confirmed.

By 90 days:

Migrate permissible marketing analytics to server-side or BAA-covered alternatives (e.g., healthcare-compliant analytics under a signed BAA).
Implement quarterly tag re-certification and vendor data-flow attestations.
Brief the board/Audit Committee on tracking exposure as a standing compliance risk item with defined residual risk acceptance.

Closing Perspective

The CVS and Criteo settlement is a signal, not an anomaly. The healthcare industry's ad-tech footprint was built in an era when nobody considered an IP address plus a page URL to be a regulated disclosure. That era is over — OCR said so, the FTC said so, and $20.5M settlements say so louder. The organizations that come out ahead of this wave are the ones that treat their marketing stack with the same rigor they apply to their EHR integrations: inventoried, governed, segmented, and monitored. If your SOC can tell you every outbound connection from your domain controllers but not every outbound connection from your patient portal, you have a gap that plaintiffs' attorneys have already priced.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub