Tracking pixels and health data: website privacy checklist

What changed in June 2026

The Privacy Commissioner found breaches involving tracking pixels, health-related information and targeted advertising. The determinations are binding on the parties but are not appellate court precedent.

What businesses should do now

Map every pixel and event, prevent sensitive or revealing data entering advertising tools, test consent before collection and keep policies aligned with verified live data flows.

• Map the live data flow, including temporary systems, pixels, vendors and onward disclosures.
• Confirm necessity, authority, notice, consent and purpose for each material use or disclosure.
• Reconcile intended privacy settings with live states across downstream systems.
• Apply access, configuration, monitoring, deletion and incident controls to non-production environments.
• Retest after changes to websites, vendors, migrations, permissions or data fields.

Evidence to retain

• Current data maps, system inventories and supplier responsibilities.
• Privacy assessments, notices, consent records and decision logs.
• Access reviews, configuration evidence, monitoring records and verified deletion.
• Incident chronology, assessment decisions, notifications and remediation evidence.

Turn the issue into a controlled decision

• Record the affected product, claim, customer journey, system, supplier or business process.
• Separate current requirements from proposals, priorities, allegations, warnings and matter-specific outcomes.
• Assign an owner, action date and evidence location for every material gap.
• Set review triggers for legal changes, new facts, supplier changes, incidents, complaints and campaign variations.
• Escalate when the available facts or evidence do not support the proposed decision.

Questions to ask

Focus on the decision and the evidence.

1. 01

   What personal information is actually collected, inferred, used, disclosed and retained?

2. 02

   Do privacy conclusions match the exact dataset, system, purpose and time period?

3. 03

   What evidence shows that the control works across suppliers and downstream systems?

Primary sources

Check the controlling material.

• Official regulator information ↗

Related resources

Continue with this topic.

Recommended training

Practical support

Apply the guidance to your facts.

Identify the exact product, claim, customer journey, supplier, legal entity or process involved. Preserve the information that supports the current position, record unresolved facts, assign an owner and confirm the point at which specialist review is required.

Important information

Check the current position.

This resource is general information, not legal advice. Laws, official guidance and proposals can change. Do not rely on a title or summary alone to decide whether a requirement applies to a particular entity, product or activity.