# GLP-1 Telehealth Ads: Tracking Conversions Without Leaking Patient Data

> GLP-1 telehealth ads tracking, field by field: where weight-loss funnels leak to Meta (UTMs, quiz, checkout, dose-step refills) and what to send instead.

Published 2026-11-08 by Joe Michael, Founder & CTO, Kalman Analytics · https://kalmananalytics.com/blog/glp-1-telehealth-ads-tracking/

GLP-1 telehealth ads tracking is harder than tracking for any other telehealth vertical, for one reason: the drug is in everything. It's in campaign names and UTMs, landing page URLs, quiz answers, BMI calculators, checkout line items and the dose on every refill. Each of those can reach Meta without anyone deciding to send it.

The short answer: measure GLP-1 conversions server-side, as neutral events with a business value, and keep the drug, the dose and every intake answer out of every tag and payload. This guide walks the six places a weight-loss funnel leaks, field by field, and what to send instead.

## Why GLP-1 funnels get the most scrutiny

**Short answer:** GLP-1 funnels ask for exactly the details health privacy rules care about (weight, height, BMI, conditions, medications), and they ask on pages that often carry ad tags. Plaintiffs' firms have noticed. Recent filings and investigations focus on weight-loss intake and checkout pages specifically.

Two examples from this year, both allegations only:

- **A complaint filed in October 2026** against a company selling GLP-1 treatments online, in federal court in Florida, *Maddocks v. Start Gimme, LLC* ([summary](https://openclassactions.com/lawsuits/privacy/gimme-care-website-tracking-privacy-class-action-lawsuit.php)), alleges that ad tags (Meta, TikTok, Reddit, Criteo and Microsoft) on its treatment, intake and checkout pages received the text of answer buttons and questionnaire answers about height, weight, medical history, medications and prior GLP-1 use, along with hashed email and phone. Nothing has been decided; it's at the complaint stage.
- **A law firm announced in June 2026** that it is [investigating weight-loss telehealth sites](https://chimicles.com/weight-loss-medication-telehealth-pixel-tracking-investigation/) for pixels on intake and checkout pages, naming weight, BMI, conditions and medication preferences as the data at issue, including for people who never bought.

Neither is a ruling. But together they show where people are looking: not the homepage, but the pages three clicks in, where the questions start.

The federal backdrop hasn't changed. HHS's [guidance on online tracking technologies](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html) says tracking on logged-in pages like patient portals and telehealth platforms generally has access to protected health information. Our [Meta Pixel and HIPAA explainer](/blog/is-meta-pixel-hipaa-compliant/) covers what that guidance still says after the 2024 court ruling, and the class certification in the Meta Pixel healthcare case.

## The GLP-1 leak map

Here's where patient data leaves a typical GLP-1 funnel, in the order a patient moves through it.

| # | Where | What leaks | Who receives it | The fix |
| --- | --- | --- | --- | --- |
| 1 | Ad click and UTMs | `utm_campaign=semaglutide_lal` in the landing URL | Every browser tag on the landing page | Neutral UTM values; drug names stay in Ads Manager |
| 2 | Landing page URL | `/weight-loss/tirzepatide/` paths | Every browser tag, on every page view | Neutral paths, or no browser tags on treatment pages |
| 3 | Quiz and BMI calculator | Button text, height, weight, BMI, conditions, prior GLP-1 use | Tags that read clicks or form fields | No browser tags on the quiz; count completion server-side |
| 4 | Checkout | `content_name`, `content_ids`, line items with drug and dose | Pixel Purchase or AddToCart events | Amount and currency only |
| 5 | Approval or decline | A decline reason ("BMI under threshold"), a drug-named event | Server events built from the platform webhook | Neutral approval event; declines never sent |
| 6 | Refills and dose steps | The new dose, "step 2", a dose-named SKU | Subscription events | Refill as its own event, amount only |

<figure><img src="/blog/img/glp-1-funnel-leak-map.svg" alt="A GLP-1 telehealth funnel drawn left to right: ad click, landing page, quiz, checkout, provider approval and refill. Each stage is marked with what can leak at that point, such as a drug name in UTMs, height and weight in quiz answers, drug and dose in checkout line items, and the new dose on a refill. Under the funnel, the same stages are shown sending only neutral events with a value to Meta." width="1200" height="620" loading="lazy"><figcaption>The six leak points in a typical GLP-1 funnel, and the neutral events to send in their place. The funnel is illustrative.</figcaption></figure>

The rest of this post takes them one at a time.

## 1. UTMs and campaign names

**Short answer:** campaign names inside Meta are Meta's business. UTMs aren't: they become part of the landing page URL, and browser tags on that page can receive the full URL, query string included. If your UTM says `semaglutide`, every tag on the page hears it.

This is the leak almost nobody checks, because media buyers build UTMs and developers build tags, and neither owns the overlap. A naming convention like `utm_campaign=sema_025_lookalike` is convenient for reporting and terrible for privacy, because it pairs a drug and a dose with a person's visit.

One nuance: if Meta has applied [core setup](/blog/meta-health-and-wellness-restrictions/) to your pixel, Meta strips the path and query string before using the event. That's Meta limiting its own use of what your page sent, not a fix on your side, and it does nothing for the TikTok, Reddit, Microsoft or analytics tags on the same page.

What to do today:

- **Rename UTM values** to something neutral and decode them in your own reporting: `wl_q4_prospecting`, `wl_retarget_7d`.
- **Check your ad URLs, not just your site.** Open five live ads, click through, and read the URL bar.
- **Check which tags can see those URLs.** A [free scan of your site](/scan) shows which trackers load on your public pages and what each one receives.

## 2. Landing page URLs

**Short answer:** a URL like `/weight-loss/tirzepatide/` tells every tag on the page what treatment the visitor is looking at. Either use neutral paths for treatment pages or keep browser ad tags off them entirely, and send conversions from the server with only your root URL.

GLP-1 sites are often built for SEO, with one page per drug, and that's fine for search. The problem is the tags on those pages. A browser pixel reports the URL of the page it fires on, so a page view on a drug-named path is a page view that names the drug.

If you can't change the paths (they're ranking, and that's real money), the cleaner answer is to decide which pages carry browser tags at all. Our [Meta health and wellness restrictions guide](/blog/meta-health-and-wellness-restrictions/) shows how to check in Events Manager what Meta has already restricted on your domain.

## 3. The quiz and the BMI calculator

**Short answer:** the quiz is where the most sensitive data in the whole funnel lives: height, weight, BMI, conditions, current medications, prior GLP-1 use. No browser ad tag belongs on it. Count that the quiz was completed, from the server, and send nothing about what was in it.

GLP-1 quizzes are usually multi-step forms with big tappable buttons ("Yes, I've taken a GLP-1 before"). Tags that record clicks can pick up button text, and tags that auto-collect form data can pick up fields. The October complaint above alleges exactly that kind of data reached ad tags: answer button text and questionnaire answers.

Watch for these:

- **Auto-collected form fields** or "automatic advanced matching" style settings that read inputs.
- **Click tracking** that records button labels.
- **Step URLs** like `?step=bmi` or `/quiz/medications`.
- **A BMI calculator** on a public page that fires a custom event with the result.

The fix is the same for all of them: no browser tags on the quiz, and one server-side `Lead` when the intake is submitted, with hashed contact details and nothing else.
Scan your telehealth site free: https://kalmananalytics.com/scan
## 4. Checkout

**Short answer:** send `Purchase` with the amount and currency, and nothing that names the product. In GLP-1 checkouts, the product field is the treatment and often the dose too, so `content_name`, `content_ids` and line items have to go. Your own reporting keeps the SKU; Meta only needs the value.

Standard ecommerce tracking setups fill product fields on checkout events. In a GLP-1 checkout that means events like:

```json
"custom_data": {
  "content_name": "Tirzepatide 2.5mg, 1 month",
  "content_ids": ["TIRZ-25-1M"],
  "value": 349.00,
  "currency": "USD"
}
```

The value and currency are the useful part. Keep those, drop the rest. And skip product catalogs and dynamic product ads for treatments entirely: a catalog of drugs and doses is the same leak, sent in bulk.

## 5. Provider approval and declines

**Short answer:** send approvals from the telehealth platform as a neutral event with a projected lifetime value, timestamped when the clinician approved. Never send declines. In GLP-1 funnels a decline often has a medical reason, like a BMI below the eligibility threshold, and that reason is health information.

Two GLP-1 specifics on top of [the general approval advice](/blog/telehealth-conversion-tracking/):

- **Decline reasons are data.** Some setups send a "Disqualified" event to build exclusion audiences. In weight loss, a decline usually means the person's answers didn't meet clinical criteria. Keep declines in your own reporting.
- **Approvals can lag.** Provider queues back up when volume spikes. Meta's Conversions API accepts web events [up to 7 days old](https://developers.facebook.com/docs/marketing-api/conversions-api/using-the-api), and one older event gets the whole request rejected. Timestamp each approval with the time it happened and send it when it happens.

If approvals are your optimization event, you need enough of them: Meta's guidance is [about 50 optimization events per ad set per week](https://www.facebook.com/business/help/112167992830700) to leave learning. [The signal ladder](/blog/telehealth-signal-ladder/) shows how to pick an event your volume can support.

## 6. Refills and dose steps

**Short answer:** send each paid refill as its own event with the amount. Never send the dose. GLP-1 subscriptions often change dose over time, and a refill event that names the new dose tells an ad platform how a patient's treatment is going. The amount already carries any price change.

This one is unique to GLP-1 and it's easy to miss, because refills come from the subscription system, not the site. Here's a fictional subscription webhook for a dose-step refill:

```json
{
  "type": "subscription.renewed",
  "subscription_id": "sub_44A",
  "renewed_at": "2026-11-06T14:02:51Z",
  "patient": { "email": "dana@example.com", "phone": "+13035550142" },
  "plan": { "name": "Semaglutide monthly", "sku": "SEMA-050-1M" },
  "dose": { "previous": "0.25mg", "current": "0.5mg", "step": 2 },
  "weight_log": { "start_lb": 212, "current_lb": 203 },
  "amount": 329.00
}
```

Forward that and Meta learns the drug, the dose change, and a weight trend. Here's the same refill built from an allowlist:

```json
{
  "event_name": "Repeat",
  "event_time": 1793973771,
  "event_id": "sub_44A-renewal-2",
  "action_source": "website",
  "event_source_url": "https://northwindhealth.com/",
  "user_data": { "em": ["a1f9…e07c"], "ph": ["5c3b…91d2"] },
  "custom_data": { "value": 329.00, "currency": "USD" }
}
```

| Field | Sent? | Why |
| --- | --- | --- |
| Event name | Neutral `Repeat` | Says a subscription renewed, not what for |
| Event ID | Subscription plus renewal number | Retries don't double count |
| URL | Root only | Paths name treatments |
| Email, phone | SHA-256 hashed | For matching only |
| Value | Amount charged | Carries the price change without the dose |
| Plan name, SKU, dose, step, weight log | Never | Each one describes the patient's treatment |

The rule underneath: build each outbound event by copying approved fields, not by deleting bad ones. When someone adds `weight_log` to the webhook next quarter, an allowlist ignores it. A blocklist sends it.

## What to send Meta: the GLP-1 event set

| Moment | Event | Value | Source |
| --- | --- | --- | --- |
| Landing page view | `PageView` from neutral pages only, or none | None | Browser, if at all |
| Intake completed | `Lead` | None, or a small fixed value | Server |
| First payment | `Purchase` | Amount charged | Server (payment processor or platform) |
| Provider approval | Neutral custom event, e.g. `Qualified` | Projected lifetime value | Server (platform webhook) |
| Refill paid | Its own event, e.g. `Repeat` | Amount charged | Server (subscriptions) |
| Decline, refund, cancel | Nothing | Keep for reporting | Your records |

Keep event names neutral. `GLP1_Approved` says what `Qualified` doesn't, and [renaming a blocked event](/blog/renaming-blocked-purchase-event/) to dodge restrictions isn't the answer either. Neutral, honest events with real values are.

## Two lanes: what your ads say and what your site sends

**Short answer:** GLP-1 brands have two separate compliance lanes. The FDA's 2026 warning letters cover claims about compounded GLP-1s in ads and on websites. Tracking is about what data your site sends to ad platforms. Clean creative doesn't fix a leaky quiz, and a clean quiz doesn't fix a misleading claim.

In March 2026 the FDA [announced 30 warning letters](https://www.fda.gov/news-events/press-announcements/fda-warns-30-telehealth-companies-against-illegal-marketing-compounded-glp-1s) to telehealth companies over website claims about compounded GLP-1s, including claims implying a compounded drug is the same as an approved one, and branding that implies the telehealth company is the compounder. Its [page for telehealth companies](https://www.fda.gov/drugs/human-drug-compounding/fda-telehealth-companies-what-know-when-promoting-compounded-drugs) lists the claims to avoid.

That's your creative and landing page copy, and it's worth a review with counsel. It's also a separate checklist from this one. Agencies running GLP-1 accounts should own both: a claims review on every ad and landing page, and a data review on every tag and event.

## A 15-minute GLP-1 tracking check

| Step | Where | What you're looking for |
| --- | --- | --- |
| 1. Read five live ad URLs | Ads Manager, click through | Drug names or doses in UTMs |
| 2. List pages with browser tags | [The free scan](/scan) (public pages), tag manager, a test run through the funnel | Treatment pages, quiz steps, checkout, login |
| 3. Take the quiz | Browser dev tools, Network tab | Requests to ad platforms while you answer |
| 4. Read one Purchase event | Events Manager, Test Events | `content_name`, `content_ids` or line items |
| 5. Read one approval event | Same | Neutral name, approval time, no decline events |
| 6. Read one refill event | Same | Amount only; no dose, step or plan name |
| 7. Check rejected requests | Server or vendor logs | Batches refused for old `event_time` |

If step 3 shows anything at all going to an ad platform while you answer health questions, fix that first.

## Where Kalman fits

Kalman is Meta tracking built for telehealth brands and their agencies. It takes outcomes from where they happen (Stripe directly, [Sylaris OS](/integrations/sylaris-os) natively, and platforms like Bask Health, Telegra and MDI through a webhook catcher; see [all integrations](/integrations/)) and sends neutral events: Purchase with the amount, approvals as `Qualified` at projected lifetime value, and refills as `Repeat` with the amount.

Every outbound event is built from an allowlist. Product names, conditions, medications, doses, intake answers and page paths are never sent, and every delivery is in an outbound log, so you see exactly what Meta received. We sign a BAA with every customer, on every plan, before any data flows. [See how it works with Meta](/integrations/meta), or read the full [stage-by-stage telehealth conversion tracking guide](/blog/telehealth-conversion-tracking/).

Start with your own site. [Run the free scan](/scan): in about a minute it shows which trackers load on your public pages and what each one receives. Then, when you're ready, [see pricing](/pricing).

*This post is general information, not legal advice.*

## Frequently asked questions

### Can I use the Meta Pixel on a GLP-1 telehealth site?

On a public page that doesn't name a treatment, a pixel sending a page view is a much smaller question than one on a quiz, intake or checkout page. Keep browser tags off anything that collects health answers or names the drug, and send conversions server-side from an allowlist. [Run a free scan](/scan) to see where your tags load today.

### What should a GLP-1 brand send to Meta?

Neutral events with a business value: a server-side `Lead` for a completed intake, `Purchase` with the amount, a neutral approval event at projected lifetime value, and refills as their own event. Hashed email and phone, click IDs and your root URL. No drug, dose, BMI, weight or intake answer, ever.

### Can I name the drug in campaign names or UTMs?

Campaign names inside Ads Manager stay in Meta. UTMs don't: they ride along in the landing page URL, and every browser tag on that page can receive the full URL. Use neutral UTM values like `utm_campaign=wl_q4_prospecting` and keep the drug out of query strings.

### How should I track GLP-1 refills and dose changes?

Send each paid refill as its own event with the amount, and never the dose. A refill event that says the patient moved to a higher dose tells an ad platform about their treatment. If the new dose costs more, the value field already carries that.

### Are the FDA's GLP-1 warning letters about tracking?

No. The [March 2026 letters](https://www.fda.gov/news-events/press-announcements/fda-warns-30-telehealth-companies-against-illegal-marketing-compounded-glp-1s) are about claims for compounded GLP-1s on telehealth websites. Tracking is a separate question about what your site sends. A GLP-1 brand has to get both right.

## Sources

- https://openclassactions.com/lawsuits/privacy/gimme-care-website-tracking-privacy-class-action-lawsuit.php
- https://chimicles.com/weight-loss-medication-telehealth-pixel-tracking-investigation/
- https://www.fda.gov/news-events/press-announcements/fda-warns-30-telehealth-companies-against-illegal-marketing-compounded-glp-1s
- https://www.fda.gov/drugs/human-drug-compounding/fda-telehealth-companies-what-know-when-promoting-compounded-drugs
- https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
- https://developers.facebook.com/docs/marketing-api/conversions-api/using-the-api
- https://www.facebook.com/business/help/112167992830700