Australian Health Websites Secretly Fed Patients' Fertility and Medication Searches to Meta and TikTok

Key points

• Australia's Privacy Commissioner ruled on Wednesday that Monash IVF and telehealth company Medmate both broke privacy law by tracking visitors' health searches without consent.
• Monash IVF ran tracking code on its website from 30 July 2012 until December 2024, at one point using seven separate trackers on pages about egg freezing and fertility treatment.
• Medmate's TikTok tracker transmitted full web addresses revealing conditions such as benign prostatic hyperplasia and contraception searches from April 2021 onwards.
• A separate government scan of 50 health websites found 96 per cent used some form of tracking technology, and 77 per cent of those using a third-party tracker never mentioned it in their privacy policy.
• Neither company was fined, but both have been ordered to stop the practice and permanently delete the data they collected.

If you ever searched a health website for information about fertility treatment, contraception, or a prostate condition, there is a reasonable chance that search was quietly passed to Facebook's parent company Meta or to TikTok — without you knowing, and without you agreeing.

Australia's Privacy Commissioner, Carly Kind, ruled this week that two health companies did exactly that. Fertility clinic network Monash IVF and online prescription service Medmate both used tracking pixels — tiny, invisible pieces of code hidden inside a webpage that record what a visitor reads or searches and beam that information back to third parties — to collect sensitive health data and then use it to show those same visitors targeted advertisements.

The ruling is the regulator's first on this technology. It matters because it establishes that health websites must ask for permission before deploying these trackers.

Should patients be worried about what was shared?

Yes, and not just because of unwanted ads. Kind put it plainly: people may stop looking up health information online if they fear that search will follow them around social media. That chilling effect — where someone avoids seeking help because surveillance feels certain — is the real injury here.

Monash IVF's trackers sat on pages covering egg freezing, sperm and egg donation, and fertility health checks. Simply visiting those pages was enough to signal a person's interest in fertility treatment. The company then used that signal to push IVF and egg-freezing advertisements at those visitors. Medmate went further: it switched on a Meta feature that matched website visitors to their social media accounts even when they were not logged in.

Both companies argued the data was scrambled and therefore not personal. Kind rejected that. Under her expanded reading of Australian privacy law, a company does not need to know your name — it only needs to be able to single you out and treat you differently. That is enough to make you identifiable.

Neither company was fined. Kind said penalty proceedings take years and deliver no immediate protection for the public. Orders to stop and delete data do. She was direct that fines remain the next step if the industry ignores the findings.

Monash IVF says it has already deleted the collected data and improved its privacy disclosures. Medmate has removed all trackers from its site but did not respond to requests for comment from SMH Technology, which first reported the regulator's findings.

If you used either site for health research, watch for any unusual targeted advertising related to health topics on Facebook, Instagram, or TikTok. You can request deletion of your data directly from Meta and TikTok through each platform's privacy settings. Neither company is required to notify individual users under the current ruling, but the deletion orders mean the health firms themselves must erase what they held.