More Than One-Fourth of Healthcare Websites Fail Core Privacy Tests
A recent study conducted by Datatrue on the most visited U.S. websites found that more than 4 in 10 websites failed its core privacy tests. The study was conducted on the top 242 most visited U.S. websites between October 12 and 13, 2026. The websites spanned several sectors, including 50 healthcare websites. Datatrue found a clear gap between what website visitors are offered in terms of privacy and what they are provided.
For the study, Datatrue assessed each of the websites three times with the Global Privacy Control (GPC) signal switched on. This is a browser setting that instructs websites that the visitor does not want to have their data sold or shared. Datatrue assessed whether there was any ad tracking – the sending of visitor data to ad tech firms, social media companies, or audience data or ID companies; whether there was a clear option available to website users to opt out of tracking, such as “reject all” or “only accept essential” tracking options; and if session replay was started upon landing on the site. Session replay records clicks and scrolls before the visitor has made any choice, allowing the site owner to replay the visit later.
Across all sectors represented in the study, healthcare performed best overall for website visitor privacy, with the lowest levels of ad tech. Healthcare websites had a median of 1.5 ad companies per site and the lowest percentage of sites (28%) failing Datatrue’s core data privacy tests. The next best sector was media with a 40% failure rate. Healthcare sites also had the second-lowest rate of session replay on arrival (18%), ahead of media (12%)
The study found that while hospital sites had low levels of ad tech, they often failed to respect visitor choices. Out of the 50 sites, 18 were found to contact ad or social media companies before visitors were given a choice. Out of those 18 sites, 14 did nothing when GPC was switched on, 2 sites cut some of the tracking, and only 2 sites stopped all tracking. With only a 7% drop in ad domains with GPC enabled, healthcare performed worst out of all sectors.
Similar to other sectors, healthcare performed poorly for failing to provide web visitors with an obvious opt-out option. Out of the 50 healthcare sites, 32 had no opt-out option, 7 had an opt-out option that wasn’t obvious, and 11 had an obvious opt-out choice. Out of the 50 sites, 9 started session replay on arrival before giving visitors a choice.
The study confirmed that perfect user privacy is possible, although it is rare, as only 3 sites out of the 242 tested passed all core privacy tests. Respecting visitor privacy matters as regulators have started to take action, with California having imposed financial penalties for privacy failures. Datatrue recommends giving visitors a clear choice on-screen upon site arrival; ensuring that every tag that shares or sells data is switched off if GPC is enabled; holding session replay until consent is given by a visitor; removing any ad tracking code that is no longer used; and testing what a page sends when a visitor rejects tracking to make sure that their choice is honored.
