Skip to content
The difference between client-side and server-side tracking is where website data is processed. Client-side tracking runs vendor code in the visitor’s browser and sends data straight to each vendor, such as Meta or Google. Server-side tracking sends events to a server first, where rules can remove identifying and health details before anything is forwarded.
How does client-side tracking work on a practice website?
Client-side tracking works by loading a vendor’s script, such as the Meta Pixel or a Google tag, in every visitor’s browser. When a page loads or a button is clicked, the browser sends that event directly to the vendor. The practice’s website never sees or edits that data, so whatever the tag collects is what the vendor receives.
Each additional tag adds another vendor. As Maria Zhang, a doctoral candidate at Rutgers Business School and co-author of a study on hospital pixel tracking, put it: “The problem with third-party pixel tracking is that hospitals are sharing patients’ information with so many vendors.”
Defaults decide most of what gets collected. A 2026 study for the ACM Internet Measurement Conference compared Meta Pixel configurations on about 18,000 health-related websites and a control group from 2017 to 2024. It found that features collecting button clicks, page metadata, and first-party cookie identifiers reached adoption rates of up to 98.4%, “largely driven by the Pixel’s default settings.”
How does server-side tracking work?
Server-side tracking moves the collection step off the visitor’s browser. The website sends events to a server container, and that server decides what goes to each ad or analytics platform. Google’s documentation says a server container “runs on a server that you control,” and that only the operator has access to the data “until you choose to send it elsewhere.”
For a behavioral health practice, that control point is where identifying details come out. Beacon’s server removes names, emails, phone numbers, and device or cookie identifiers, along with condition, service, and form detail and any page address that names a condition. The IP address is hashed, and only a generic conversion, such as “appointment request,” goes on.
Hashing is one layer, so contact details are removed outright. Staff in the FTC’s Office of Technology wrote in July 2024 that “hashes aren’t ‘anonymous’ and can still be used to identify users.” The mechanics for paid media are covered in what server-side conversion tracking is and why health practices need it.
How do client-side and server-side tracking compare side by side?
Client-side and server-side tracking can both report conversions, but they handle data very differently at each step. The table below compares the two setups on the points a practice owner or office manager is most likely to ask about first.
| Question | Client-side | Server-side |
|---|---|---|
| Where does the code run? | The visitor’s browser | A server the practice or its provider controls |
| Who receives raw data first? | Each vendor directly | The server |
| What reaches the ad platform? | Whatever the tag collects, including identifiers | A generic conversion with no contact or health details, if configured that way |
| Is there a business associate agreement? | Google offers none for Google Analytics | Depends on the provider; get it in writing |
| Setup effort | Paste a tag | Server configuration and upkeep |
One caution belongs with the table. A server can forward identifying data as easily as it can remove it, so a poorly configured server moves the same exposure to a new location. The protection comes from the removal rules on it and the agreements with whoever runs it.
What does this comparison not cover?
This comparison explains how the two tracking methods move data. It does not decide whether a specific practice’s setup meets HIPAA, FTC rules, state privacy laws, or 42 CFR Part 2 for substance use disorder programs. This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.
The status of tracking on public pages is contested. HHS guidance on online tracking technologies says tracking on user-authenticated pages “generally” has access to PHI, and in June 2024 a federal court in Texas vacated the part covering certain public pages. The guidance treats its appointment-booking example as a disclosure of PHI, and Beacon’s standard keeps tracking off booking, intake, and portal pages under either method.
Frequently asked questions
Does server-side tracking make a website HIPAA compliant?
No. Server-side tracking is a method of routing data, and HIPAA compliance remains the practice’s obligation as the covered entity. A server that forwards names, email addresses, full URLs, or health details, hashed or not, creates the same exposure as a browser pixel.
Can a practice run both methods at the same time?
Technically yes. Keeping the browser pixel alongside a server setup means the client-side data flow still exists. Beacon’s standard for client paid media is server-side conversion tracking in place of client-side ad pixels, under a signed business associate agreement with the tracking provider.
Who usually sets up server-side tracking?
A developer, an agency, or a tracking provider usually builds and maintains it, because it involves a server, tagging rules, and platform connections. The practice’s role is to approve which events are sent, confirm what is removed or hashed, and keep the signed agreements on file.
