Amid a flurry of recent product updates from Google, there’s one that should pique the interest of those in the healthcare marketing arena. It has to do with Google Tag Manager (GTM) functionality—and it’s a reminder that health advertisers always need to be on top of their website and tracking technology if they want to stay HIPAA compliant.
Google’s latest GTM update is meant to improve tracking accuracy and attribution by allowing the Google tags within your GTM container to load first—before any events fire—when a user visits your website. This should improve tracking accuracy, enable better attribution, and make it easier to deploy tools like Enhanced Conversions and cross-domain tracking in your Google Ads marketing. The change will go into effect automatically on April 10th, 2025.
That update should be highly-beneficial to most marketers. But the experts at Ours Privacy, a customer data platform (CDP) focused on healthcare compliance, point out that it could be a concern for certain healthcare brands, who need to be careful about what their websites are sending to outside platforms like Google. Sharing protected health information (PHI) with Google would constitute a HIPAA violation, even if done unwittingly.
How Could this GTM Change Get Healthcare Marketers in Trouble?
While there are some situations where Google Ads tags can be tightly configured to mitigate non-compliant data sharing, most savvy healthcare marketers will have removed them and replaced them in favor of a more workable solution. The main concern is for healthcare brands that don’t have a strong grip on their website and marketing implementations. And unfortunately, there are a lot of those out there.
According to ADM’s Director of Measurement and Attribution Isaac Uloko, companies—and not just those in healthcare—often fail to clean up old tracking tags on their websites. As time goes on and technologies change or brands switch marketing partners, there can be a buildup of old, unnecessary tracking tags that are still capable of creating compliance headaches.
When enforcement actions began to rain down against non-compliant health marketers a few years ago, many brands in the space sought compliance solutions like CDPs and healthcare-specific marketing agencies—but some just turned their digital marketing off entirely. Even if their Google Ads account is no longer running campaigns, however, an old Google Ads tag sitting in their GTM container would create HIPAA compliance risks with this new update.
“Even if you paused your ads, you may still have tracking tags on your site that are enabled,” Uloko says.
Compliance Tips for Healthcare Marketing
Healthcare brands unsure of whether they will be affected by this GTM functionality change should audit all tags in their GTM container to ensure there aren’t any unaccounted-for Google Ads, Google Analytics, or Floodlight tags hanging out on their site. If there are, they should be removed.
If your company has been proactive about safeguarding itself from healthcare privacy issues, Uloko says there’s likely little else to worry about with this new GTM change. But if it hasn’t, this is just a reminder that there’s no better time to address your HIPAA compliance situation than immediately—and that begins with your website.
“The website itself should be optimized not to expose data through GTM,” Uloko says. “It should be as clean as possible. Whatever data is being passed from GTM to destination tags has to be compliant data without PHI—that includes PHI that can be generated by your URLs or through the network.”
Mitigating healthcare marketing privacy risks should start with a thorough understanding of both privacy law and platform policies—which are constantly changing. Compliance-focused CDPs are a worthwhile investment for most healthcare brands who still want to take advantage of important features in Meta Ads and Google Ads. And if your brand isn’t already working with a marketing agency that specializes in health and wellness, it may be time to change that: There is no replacement for industry-specific expertise.
If you have any questions about compliance or any other aspect of health marketing, don’t hesitate to reach out to the ADM team below:
