Server-side conversion tracking changes what happens between an action on your website and the advertising platform that needs to know a conversion occurred. Instead of allowing a client-side pixel to send information directly from the browser to an ad platform, a server-side setup puts a controlled layer in between so the information can be processed before anything is passed along.
That creates a real challenge for behavioral health organizations.
You still need to know whether someone saw an ad and eventually took an action on your website. Google and Meta also rely on conversion signals to understand which campaigns, ads, and audiences are producing those actions. At the same time, the information being transmitted can become sensitive very quickly when someone is interacting with a behavioral health website.
That leaves practices with a pretty reasonable question: How do we keep measuring marketing without sending information to an ad platform that shouldn’t be there?
Server-side tracking is one way to answer it.
Talk with Beacon Media + Marketing about creating a measurement approach that gives your team better visibility without passing unnecessary patient information to ad platforms.
What Does a Client-Side Tracking Pixel Actually Do?
A client-side pixel is code that runs in someone’s browser and sends information about an action directly to a third-party platform. Depending on how a website and its tracking are configured, that request can include details about the page being viewed, the action taken, identifiers, or information entered by the user.
This is how a lot of digital advertising has historically been measured.
Someone clicks a Meta ad, visits a website, and fills out a form. The Meta Pixel recognizes the conversion and sends a signal back to Meta. Google and other advertising platforms use similar tracking technologies.
That exchange gives the platform information it can use to attribute the conversion and improve future ad delivery. The concern for behavioral health organizations is what else may travel with the event.
HHS describes tracking technologies as scripts or code used to collect information about how someone interacts with a website or app. HHS also notes that third-party tracking technologies generally send information directly to the third party that developed them.
On a behavioral health website, even a URL can reveal more than you might expect. A visit to a general homepage and a visit to a page about a particular condition or modality carry very different context.
That becomes especially important when identifiers are involved. HHS lists information such as email addresses, IP addresses, device IDs and other identifying codes among the information tracking technologies may disclose. Whether that information constitutes PHI depends on the circumstances, and HHS’s guidance on some unauthenticated public webpages was partially vacated by a federal court in 2024.
The takeaway for a marketing team is much more practical: you need to understand exactly what your tracking setup is collecting and where it goes.
A conversion can be useful to an ad platform without giving that platform every piece of information surrounding it.
What Changes When Conversion Tracking Happens Server-Side?
With server-side tracking, the conversion takes a different route. The event is sent through a controlled server environment first, where information can be removed or transformed before a conversion signal is forwarded to the advertising platform.
The implementation Beacon uses through Curve is a useful example of what that looks like in practice.
Curve removes client-side tracking tags such as the Meta Pixel, Google Analytics and TikTok pixel from the website. A server-side relay processes the event on Curve’s U.S.-hosted servers instead.
Before the conversion leaves that environment, identifying or sensitive details are handled according to the tracking rules. In Curve’s implementation, email addresses are hashed using SHA-256, URLs are reduced to the path only, and condition or modality details are dropped before the event is sent to the advertising platform.
The platform still receives a conversion signal it can use for campaign measurement and optimization. It doesn’t receive the underlying PHI Curve is configured to keep out of that request.
Hashing deserves a little explanation here because it’s easy to make it sound more mysterious than it is. A hashing function turns an input into a fixed-length value. In this setup, an email address isn’t forwarded to the ad platform in plain text. SHA-256 is used to create the hashed version sent as part of the permitted conversion signal.
URL stripping serves a different purpose. Instead of forwarding the full URL and everything it might reveal, the request is reduced before being passed along. Condition or modality detail can also be removed entirely.
Those steps happen before the clean conversion reaches the ad platform. That’s an important distinction. HHS specifically warns that having a tracking vendor receive PHI first and remove or de-identify it afterward isn’t enough by itself to address an impermissible disclosure.
The useful part of the conversion keeps moving. The sensitive information stays out of the request sent to the ad platform.
Where Does a BAA Fit Into Server-Side Tracking?
A business associate agreement, or BAA, establishes responsibilities for a vendor that handles PHI on behalf of a HIPAA-regulated organization. If a tracking vendor qualifies as a business associate and receives PHI in that role, HHS says an appropriate BAA must be in place.
That matters because server-side tracking doesn’t mean information disappears between the website and the advertising platform. Someone still has to receive and process the event.
HHS’s current tracking technology guidance says regulated entities must ensure tracking technology vendors have signed a BAA when required and that an applicable Privacy Rule permission exists before PHI is disclosed. It also makes clear that a cookie banner or statement in a privacy policy doesn’t substitute for a valid HIPAA authorization.
Curve includes a signed BAA on each of its plans and describes its infrastructure as U.S.-hosted and SOC 2 Type II. Its Enterprise plan also offers a custom BAA and consent management.
Those details are part of the reason Beacon evaluates the entire tracking setup rather than treating server-side tracking as a switch someone turns on.
A BAA doesn’t transfer the covered entity’s compliance responsibility to the vendor. The organization still has to understand its technology, what information is being collected, where that information goes, and whether the setup fits its own obligations.
If you’re unsure what is currently firing on your website, reviewing your existing tracking setup is a good place to start before making changes to your campaigns.
Why Can’t a Practice Just Remove Its Tracking Pixels?
You can remove tracking pixels, but doing so also removes much of the conversion information those pixels were there to collect. That can leave a marketing team with less visibility into which ads generate meaningful actions and gives advertising platforms fewer signals to use when optimizing campaigns.
This is where the conversation gets tricky. After seeing enforcement actions and headlines about tracking technology, simply pulling every advertising pixel can sound like the safest response. But measurement was there for a reason. If Google knows an ad was clicked but never learns that the person took the conversion action you’re optimizing for, the platform has less information about which clicks are valuable.
Beacon’s own 2026 Signal Report found a similar measurement gap from another angle. 79% of the mental and behavioral health organizations we surveyed said they track where leads come from, but only 32% use a CRM or dedicated system to do it. Only 21% of the respondents said they were very confident they could tell what was actually working. Our broader reporting data also showed why connecting marketing activity with actual lead outcomes matters.
Removing tracking altogether can make that visibility problem even harder. The better question is what information the advertising platform actually needs. It needs to know that the conversion occurred and have an appropriate signal for attribution and optimization. It doesn’t need the person’s condition, modality interest, or other PHI to accomplish that.
That distinction is what server-side tracking is designed around.
Good measurement depends on sending the right signal, not every piece of data surrounding it.
Why Has Tracking Compliance Become Such a Big Issue?
Tracking compliance has become a much bigger conversation because regulators and consumers have challenged how sensitive health information was shared for advertising. Those cases show that something as ordinary as an advertising pixel can carry much higher stakes when sensitive information is involved.
BetterHelp is one of the clearest public examples.
The Federal Trade Commission alleged that BetterHelp disclosed email addresses, IP addresses, and answers to personal health questions to advertising platforms after promising consumers that their information would remain private. BetterHelp ultimately agreed to pay $7.8 million to settle the FTC’s charges, and the final order prohibited the company from sharing consumers’ health data for advertising.
In April 2025, the FTC reported that a second round of BetterHelp payments would send more than $2.6 million to over 534,000 people, following an earlier round that resulted in nearly $5.2 million in refunds.
The point here isn’t that every tracking pixel creates the same legal issue. Tracking setups, website contexts and the information involved vary, and HHS itself notes that these questions can be fact-specific.
What those cases have changed is the amount of scrutiny practices should bring to their marketing technology.
If you don’t know what information your website sends when somebody fills out a form, visits a service page or takes another tracked action, that’s worth finding out.
Can Server-Side Tracking Still Help Advertising Campaigns Optimize?
Yes. A properly configured server-side setup can still send conversion signals back to advertising platforms, allowing campaigns to learn from those actions without forwarding the sensitive information removed by the relay.
This matters because conversion tracking does more than populate a marketing report.
Ad platforms use conversion signals to understand which campaign activity is producing the actions an advertiser cares about. Better signals can also help Beacon connect the work happening later in the funnel back to the campaigns that generated those leads.
If a CRM eventually tells us that one lead was qualified while another wasn’t, offline conversion tracking can send that distinction back to the advertising platform. That naturally raises another question: Doesn’t sending lead information back to Meta or Google create the same privacy problem we’re trying to solve?
It can if the implementation sends information it shouldn’t.
A compliant server-side setup gives us a way to send the useful conversion signal without sending the ad platform the patient. That’s also why Beacon’s September work around sending lead quality back to advertising platforms leads directly into this conversation.
There can also be an audience benefit. With the right compliant infrastructure and appropriate campaign setup, Beacon can use permitted signals for targeting and retargeting without passing sensitive patient information to the advertising platform.
That capability comes from investing in the infrastructure required to handle the data correctly. It isn’t a workaround for privacy requirements.
Does Server-Side Tracking Make a Practice HIPAA Compliant?
No single tracking product or implementation makes an organization HIPAA compliant. Server-side conversion tracking addresses a specific part of the marketing data flow: how conversion information is processed and what gets sent to advertising platforms.
The covered entity still has its own responsibilities. That includes understanding which technologies are running on the site, determining what information they collect, evaluating vendors and agreements, managing access appropriately, and reviewing the organization’s broader privacy and security obligations.
HHS also emphasizes that tracking questions are fact-specific. Its current bulletin distinguishes among authenticated pages, unauthenticated pages and mobile apps, and a federal court vacated part of HHS’s earlier interpretation concerning certain visits to unauthenticated public webpages.
So this isn’t an area where a practice should take a blog post, a vendor claim or a checkbox in a marketing platform as legal advice.
Server-side conversion tracking can give marketing teams a better technical structure for measurement. The organization’s broader HIPAA compliance still has to be evaluated on its own facts.
What Should You Ask About Your Current Tracking Setup?
Start by finding out what happens when someone takes a meaningful action on your website. Your marketing team or agency should be able to explain which tracking technologies are installed, what information they collect, where that information is sent, and what happens before it reaches an advertising platform.
Then look at what you would lose if those tracking tools disappeared.
If removing a pixel means Meta or Google can no longer see the conversions your campaigns are supposed to generate, you have a measurement problem to solve alongside the compliance problem.
This is also a good time to connect the conversation with your CRM. A behavioral health CRM should help you understand what happens after a marketing lead comes in. Server-side and offline conversion tracking can then help close the loop by getting appropriate conversion information back to the platforms responsible for generating those leads.
The technology behind all of this can get technical quickly. The business question is easier:
Can you explain what information leaves your website when someone converts?
If the answer is no, that’s the place to start.
Beacon helps mental and behavioral health organizations build paid media measurement around both performance and compliance. Talk with our team about reviewing how your current tracking is set up.
Frequently Asked Questions
What is the difference between client-side and server-side tracking?
Client-side tracking uses code running in the visitor’s browser to send information directly to a third-party platform. Server-side tracking routes the event through a controlled server environment first, giving the organization an opportunity to process what will be sent before a conversion signal reaches the advertising platform.
Does hashing an email address make it safe to send?
Hashing changes an email address into a fixed-length value rather than sending the plain-text address. Whether a particular disclosure is permissible still depends on the surrounding data, purpose and regulatory requirements. Hashing alone shouldn’t be treated as a guarantee that any information can safely be sent to an advertising platform.
Do you need a BAA for server-side tracking?
A BAA may be required when a vendor is acting as a business associate and handling PHI on behalf of a HIPAA-regulated entity. HHS says regulated entities using tracking vendors must establish a BAA when the vendor meets the definition of a business associate and ensure an applicable Privacy Rule permission exists.
Can you still measure conversions without a Meta Pixel?
Yes, depending on the tracking implementation. In the server-side setup Beacon uses, the client-side Meta Pixel is removed and conversion events are processed through the server-side relay instead. Meta can still receive the permitted conversion signal used for measurement and campaign optimization.
Is server-side tracking only useful for Meta Ads?
No. The same general approach can support multiple advertising and analytics platforms. Curve’s implementation, for example, replaces client-side tags associated with Meta, Google Analytics and TikTok and processes conversion events through its server-side infrastructure before sending permitted information onward.








