GLP-1 Telehealth Ads: Tracking Conversions Without Leaking Patient Data

GLP-1 telehealth ads tracking is harder than tracking for any other telehealth vertical, for one reason: the drug is in everything. It's in campaign names and UTMs, landing page URLs, quiz answers, BMI calculators, checkout line items and the dose on every refill. Each of those can reach Meta without anyone deciding to send it.

The short answer: measure GLP-1 conversions server-side, as neutral events with a business value, and keep the drug, the dose and every intake answer out of every tag and payload. This guide walks the six places a weight-loss funnel leaks, field by field, and what to send instead.

Why GLP-1 funnels get the most scrutiny

Short answer: GLP-1 funnels ask for exactly the details health privacy rules care about (weight, height, BMI, conditions, medications), and they ask on pages that often carry ad tags. Plaintiffs' firms have noticed. Recent filings and investigations focus on weight-loss intake and checkout pages specifically.

Two examples from this year, both allegations only:

• A complaint filed in October 2026 against a company selling GLP-1 treatments online, in federal court in Florida, Maddocks v. Start Gimme, LLC (summary), alleges that ad tags (Meta, TikTok, Reddit, Criteo and Microsoft) on its treatment, intake and checkout pages received the text of answer buttons and questionnaire answers about height, weight, medical history, medications and prior GLP-1 use, along with hashed email and phone. Nothing has been decided; it's at the complaint stage.
• A law firm announced in June 2026 that it is investigating weight-loss telehealth sites for pixels on intake and checkout pages, naming weight, BMI, conditions and medication preferences as the data at issue, including for people who never bought.

Neither is a ruling. But together they show where people are looking: not the homepage, but the pages three clicks in, where the questions start.

The federal backdrop hasn't changed. HHS's guidance on online tracking technologies says tracking on logged-in pages like patient portals and telehealth platforms generally has access to protected health information. Our Meta Pixel and HIPAA explainer covers what that guidance still says after the 2024 court ruling, and the class certification in the Meta Pixel healthcare case.

The GLP-1 leak map

Here's where patient data leaves a typical GLP-1 funnel, in the order a patient moves through it.

#	Where	What leaks	Who receives it	The fix
1	Ad click and UTMs	utm_campaign=semaglutide_lal in the landing URL	Every browser tag on the landing page	Neutral UTM values; drug names stay in Ads Manager
2	Landing page URL	/weight-loss/tirzepatide/ paths	Every browser tag, on every page view	Neutral paths, or no browser tags on treatment pages
3	Quiz and BMI calculator	Button text, height, weight, BMI, conditions, prior GLP-1 use	Tags that read clicks or form fields	No browser tags on the quiz; count completion server-side
4	Checkout	content_name, content_ids, line items with drug and dose	Pixel Purchase or AddToCart events	Amount and currency only
5	Approval or decline	A decline reason ("BMI under threshold"), a drug-named event	Server events built from the platform webhook	Neutral approval event; declines never sent
6	Refills and dose steps	The new dose, "step 2", a dose-named SKU	Subscription events	Refill as its own event, amount only

The rest of this post takes them one at a time.

1. UTMs and campaign names

Short answer: campaign names inside Meta are Meta's business. UTMs aren't: they become part of the landing page URL, and browser tags on that page can receive the full URL, query string included. If your UTM says semaglutide, every tag on the page hears it.

This is the leak almost nobody checks, because media buyers build UTMs and developers build tags, and neither owns the overlap. A naming convention like utm_campaign=sema_025_lookalike is convenient for reporting and terrible for privacy, because it pairs a drug and a dose with a person's visit.

One nuance: if Meta has applied core setup to your pixel, Meta strips the path and query string before using the event. That's Meta limiting its own use of what your page sent, not a fix on your side, and it does nothing for the TikTok, Reddit, Microsoft or analytics tags on the same page.

What to do today:

• Rename UTM values to something neutral and decode them in your own reporting: wl_q4_prospecting, wl_retarget_7d.
• Check your ad URLs, not just your site. Open five live ads, click through, and read the URL bar.
• Check which tags can see those URLs. A free scan of your site shows which trackers load on your public pages and what each one receives.

2. Landing page URLs

Short answer: a URL like /weight-loss/tirzepatide/ tells every tag on the page what treatment the visitor is looking at. Either use neutral paths for treatment pages or keep browser ad tags off them entirely, and send conversions from the server with only your root URL.

GLP-1 sites are often built for SEO, with one page per drug, and that's fine for search. The problem is the tags on those pages. A browser pixel reports the URL of the page it fires on, so a page view on a drug-named path is a page view that names the drug.

If you can't change the paths (they're ranking, and that's real money), the cleaner answer is to decide which pages carry browser tags at all. Our Meta health and wellness restrictions guide shows how to check in Events Manager what Meta has already restricted on your domain.

3. The quiz and the BMI calculator

Short answer: the quiz is where the most sensitive data in the whole funnel lives: height, weight, BMI, conditions, current medications, prior GLP-1 use. No browser ad tag belongs on it. Count that the quiz was completed, from the server, and send nothing about what was in it.

GLP-1 quizzes are usually multi-step forms with big tappable buttons ("Yes, I've taken a GLP-1 before"). Tags that record clicks can pick up button text, and tags that auto-collect form data can pick up fields. The October complaint above alleges exactly that kind of data reached ad tags: answer button text and questionnaire answers.

Watch for these:

• Auto-collected form fields or "automatic advanced matching" style settings that read inputs.
• Click tracking that records button labels.
• Step URLs like ?step=bmi or /quiz/medications.
• A BMI calculator on a public page that fires a custom event with the result.

The fix is the same for all of them: no browser tags on the quiz, and one server-side Lead when the intake is submitted, with hashed contact details and nothing else.

4. Checkout

Short answer: send Purchase with the amount and currency, and nothing that names the product. In GLP-1 checkouts, the product field is the treatment and often the dose too, so content_name, content_ids and line items have to go. Your own reporting keeps the SKU; Meta only needs the value.

Standard ecommerce tracking setups fill product fields on checkout events. In a GLP-1 checkout that means events like:

"custom_data": {
  "content_name": "Tirzepatide 2.5mg, 1 month",
  "content_ids": ["TIRZ-25-1M"],
  "value": 349.00,
  "currency": "USD"
}

The value and currency are the useful part. Keep those, drop the rest. And skip product catalogs and dynamic product ads for treatments entirely: a catalog of drugs and doses is the same leak, sent in bulk.

5. Provider approval and declines

Short answer: send approvals from the telehealth platform as a neutral event with a projected lifetime value, timestamped when the clinician approved. Never send declines. In GLP-1 funnels a decline often has a medical reason, like a BMI below the eligibility threshold, and that reason is health information.

Two GLP-1 specifics on top of the general approval advice:

• Decline reasons are data. Some setups send a "Disqualified" event to build exclusion audiences. In weight loss, a decline usually means the person's answers didn't meet clinical criteria. Keep declines in your own reporting.
• Approvals can lag. Provider queues back up when volume spikes. Meta's Conversions API accepts web events up to 7 days old, and one older event gets the whole request rejected. Timestamp each approval with the time it happened and send it when it happens.

If approvals are your optimization event, you need enough of them: Meta's guidance is about 50 optimization events per ad set per week to leave learning. The signal ladder shows how to pick an event your volume can support.

6. Refills and dose steps

Short answer: send each paid refill as its own event with the amount. Never send the dose. GLP-1 subscriptions often change dose over time, and a refill event that names the new dose tells an ad platform how a patient's treatment is going. The amount already carries any price change.

This one is unique to GLP-1 and it's easy to miss, because refills come from the subscription system, not the site. Here's a fictional subscription webhook for a dose-step refill:

{
  "type": "subscription.renewed",
  "subscription_id": "sub_44A",
  "renewed_at": "2026-11-06T14:02:51Z",
  "patient": { "email": "[email protected]", "phone": "+13035550142" },
  "plan": { "name": "Semaglutide monthly", "sku": "SEMA-050-1M" },
  "dose": { "previous": "0.25mg", "current": "0.5mg", "step": 2 },
  "weight_log": { "start_lb": 212, "current_lb": 203 },
  "amount": 329.00
}

Forward that and Meta learns the drug, the dose change, and a weight trend. Here's the same refill built from an allowlist:

{
  "event_name": "Repeat",
  "event_time": 1793973771,
  "event_id": "sub_44A-renewal-2",
  "action_source": "website",
  "event_source_url": "https://northwindhealth.com/",
  "user_data": { "em": ["a1f9…e07c"], "ph": ["5c3b…91d2"] },
  "custom_data": { "value": 329.00, "currency": "USD" }
}

Field	Sent?	Why
Event name	Neutral Repeat	Says a subscription renewed, not what for
Event ID	Subscription plus renewal number	Retries don't double count
URL	Root only	Paths name treatments
Email, phone	SHA-256 hashed	For matching only
Value	Amount charged	Carries the price change without the dose
Plan name, SKU, dose, step, weight log	Never	Each one describes the patient's treatment

The rule underneath: build each outbound event by copying approved fields, not by deleting bad ones. When someone adds weight_log to the webhook next quarter, an allowlist ignores it. A blocklist sends it.

What to send Meta: the GLP-1 event set

Moment	Event	Value	Source
Landing page view	PageView from neutral pages only, or none	None	Browser, if at all
Intake completed	Lead	None, or a small fixed value	Server
First payment	Purchase	Amount charged	Server (payment processor or platform)
Provider approval	Neutral custom event, e.g. Qualified	Projected lifetime value	Server (platform webhook)
Refill paid	Its own event, e.g. Repeat	Amount charged	Server (subscriptions)
Decline, refund, cancel	Nothing	Keep for reporting	Your records

Keep event names neutral. GLP1_Approved says what Qualified doesn't, and renaming a blocked event to dodge restrictions isn't the answer either. Neutral, honest events with real values are.

Two lanes: what your ads say and what your site sends

Short answer: GLP-1 brands have two separate compliance lanes. The FDA's 2026 warning letters cover claims about compounded GLP-1s in ads and on websites. Tracking is about what data your site sends to ad platforms. Clean creative doesn't fix a leaky quiz, and a clean quiz doesn't fix a misleading claim.

In March 2026 the FDA announced 30 warning letters to telehealth companies over website claims about compounded GLP-1s, including claims implying a compounded drug is the same as an approved one, and branding that implies the telehealth company is the compounder. Its page for telehealth companies lists the claims to avoid.

That's your creative and landing page copy, and it's worth a review with counsel. It's also a separate checklist from this one. Agencies running GLP-1 accounts should own both: a claims review on every ad and landing page, and a data review on every tag and event.

A 15-minute GLP-1 tracking check

Step	Where	What you're looking for
1. Read five live ad URLs	Ads Manager, click through	Drug names or doses in UTMs
2. List pages with browser tags	The free scan (public pages), tag manager, a test run through the funnel	Treatment pages, quiz steps, checkout, login
3. Take the quiz	Browser dev tools, Network tab	Requests to ad platforms while you answer
4. Read one Purchase event	Events Manager, Test Events	content_name, content_ids or line items
5. Read one approval event	Same	Neutral name, approval time, no decline events
6. Read one refill event	Same	Amount only; no dose, step or plan name
7. Check rejected requests	Server or vendor logs	Batches refused for old event_time

If step 3 shows anything at all going to an ad platform while you answer health questions, fix that first.

Where Kalman fits

Kalman is Meta tracking built for telehealth brands and their agencies. It takes outcomes from where they happen (Stripe directly, Sylaris OS natively, and platforms like Bask Health, Telegra and MDI through a webhook catcher; see all integrations) and sends neutral events: Purchase with the amount, approvals as Qualified at projected lifetime value, and refills as Repeat with the amount.

Every outbound event is built from an allowlist. Product names, conditions, medications, doses, intake answers and page paths are never sent, and every delivery is in an outbound log, so you see exactly what Meta received. We sign a BAA with every customer, on every plan, before any data flows. See how it works with Meta, or read the full stage-by-stage telehealth conversion tracking guide.

Start with your own site. Run the free scan: in about a minute it shows which trackers load on your public pages and what each one receives. Then, when you're ready, see pricing.

This post is general information, not legal advice.

Frequently asked questions

Can I use the Meta Pixel on a GLP-1 telehealth site?

On a public page that doesn't name a treatment, a pixel sending a page view is a much smaller question than one on a quiz, intake or checkout page. Keep browser tags off anything that collects health answers or names the drug, and send conversions server-side from an allowlist. Run a free scan to see where your tags load today.

What should a GLP-1 brand send to Meta?

Neutral events with a business value: a server-side Lead for a completed intake, Purchase with the amount, a neutral approval event at projected lifetime value, and refills as their own event. Hashed email and phone, click IDs and your root URL. No drug, dose, BMI, weight or intake answer, ever.

Can I name the drug in campaign names or UTMs?

Campaign names inside Ads Manager stay in Meta. UTMs don't: they ride along in the landing page URL, and every browser tag on that page can receive the full URL. Use neutral UTM values like utm_campaign=wl_q4_prospecting and keep the drug out of query strings.

How should I track GLP-1 refills and dose changes?

Send each paid refill as its own event with the amount, and never the dose. A refill event that says the patient moved to a higher dose tells an ad platform about their treatment. If the new dose costs more, the value field already carries that.

Are the FDA's GLP-1 warning letters about tracking?

No. The March 2026 letters are about claims for compounded GLP-1s on telehealth websites. Tracking is a separate question about what your site sends. A GLP-1 brand has to get both right.

Sources

• openclassactions.com
• chimicles.com
• fda.gov
• fda.gov
• hhs.gov
• developers.facebook.com
• facebook.com