Healthcare Websites Often Ignore Your Do Not Track Setting

Turning on a privacy setting in your browser may not stop a health website from sharing your visit with advertisers. A new study by Datatrue tested the 242 most visited U.S. websites, including 50 healthcare sites. Healthcare did better than other sectors overall, but many of its sites still did not honor visitors' choices.

How the test worked

Datatrue checked each site three times between October 12 and 13, 2026. It turned on Global Privacy Control, a browser setting that tells websites you do not want your data sold or shared. Then it looked for three things:

• Whether visitor data went to ad tech firms, social media companies, or audience data companies
• Whether the site offered a clear opt-out, such as "reject all"
• Whether session replay started on arrival, which records clicks and scrolls so the site owner can replay a visit

What it found in healthcare

Of the 50 healthcare sites, 18 contacted ad or social media companies before visitors made any choice. Of those 18, 14 did nothing when the privacy signal was on. Two cut some tracking and two stopped all of it. Ad domains dropped only 7% with the signal enabled, the worst result of any sector.

Opt-out options were also scarce. Thirty-two sites had none, seven had one that was not obvious, and 11 had a clear one. Nine sites started session replay on arrival, before visitors could choose.

The bigger picture

Healthcare actually ranked best overall. It had a median of 1.5 ad companies per site, and 28% of its sites failed the core tests. The next best sector, media, failed at 40%. Across all sectors, more than 4 in 10 sites failed, and only 3 of the 242 passed every test.

What to do

The study does not say which sites failed, so there is no list to check. The practical lesson is that a browser privacy signal is not a guarantee. Be careful what you search on health sites, and use a "reject all" or "only accept essential" button when you see one. Many healthcare sites offer no such button.

What happens next

Datatrue says regulators have started to act, and California has imposed financial penalties for privacy failures. It urges sites to show a clear choice on arrival, switch off data-sharing tags when the signal is on, and test what a page sends after a visitor rejects tracking. The study does not say whether any healthcare sites will change.