Ecommerce OS · Online Pharmacy7 min readUpdated November 3, 2026

Server-Side Tracking for Online Pharmacies

What an online pharmacy can send to Meta, Google and TikTok, the FTC, HHS and platform rules behind it, and how to set up server-side events.

Nick Bonnassies, CMO at Tagada · checked against 11 sources

Article summary

TL;DR

Server-side tracking sends purchase events from your server, not the shopper's browser, to Meta, Google and TikTok. For an online pharmacy, its value is control: you decide which fields leave your system. Send the event, value and order ID; never product names, conditions or prescription data. It doesn't get around Meta's or Google's health data rules.

In February 2023, the FTC fined GoodRx $1.5 million for sharing data including "prescription medications and personal health conditions" with Facebook, Google and Criteo.
On June 20, 2024, a Texas federal court vacated part of HHS's tracking technologies bulletin; the rest was not affected, and HHS dropped its appeal in August 2024.
Meta's Business Tools Terms (effective November 3, 2025) bar sending data that includes "health information".
Google lists "purchases of medical services, prescription drugs or medical devices" as sensitive, and those conversions "can't be used for measurement in enhanced conversions".
Meta recommends running the Conversions API alongside the pixel, deduplicated by event name and event ID.

Want to go further? Ask

On this page

This guide is part of our playbook on the best ecommerce platform for online pharmacies. The general guide, for any store: what is server-side tracking. The ad rules themselves are in Meta and TikTok ads for online pharmacies. Prescription brands can also apply to Tagada Rx, which runs storefront, doctors, pharmacy and payments in one stack.

Why pixels miss pharmacy sales

Ad blockers and browser privacy
They stop part of the pixel events.
The sale happens after review
When the card is captured once the prescription is approved, there is no browser left to fire a purchase.
Refills and renewals
They charge without any visit to your site.
Checkout on another domain
It can break the session.

Each missed purchase inflates your cost per patient and teaches the ad platform less about who buys.

The rules that apply to pharmacy tracking

Five sources shape what a pharmacy can send. None of them is lifted by moving events to a server.

Source	What it says	Date
FTC, GoodRx	$1.5 million penalty, the first under the Health Breach Notification Rule; the order bars sharing health information with third parties for advertising1	February 1, 2023
HHS tracking bulletin	Court vacated the part on unauthenticated public pages; Holland & Knight notes "the remainder" stands, and advises close monitoring of "patient portals requiring authenticated access"2 3	June 20, 2024; appeal dropped August 29, 20244
Meta Business Tools Terms	NoData that includes or is based on "health information, financial information, consumer report information or other categories of sensitive information"5	Effective November 3, 2025
Google customer data policies	"Health or medical information, like purchases of medical services, prescription drugs or medical devices" is sensitive; "You may not upload conversion information related to sensitive categories"6	Read November 2, 2026
Meta data source categories	Health and wellness sources can lose URL details and custom parameters, or have standard events like Purchase blocked; as reported by Stape, the checks apply to the Conversions API too7	Reported March 2026

Fig. 1Five markers for pharmacy tracking, 2023 to 2026

GoodRx, Feb 2023No health data shared for advertising
HHS ruling, June 2024Public pages part vacated; portals still watched
Appeal dropped, Aug 2024The rest of the bulletin stands
Meta terms, Nov 2025No data based on health information
Google policyNo conversions tied to prescription drugs

None of them is lifted by moving events to a server.

FTC, February 1, 2023; Hunton Andrews Kurth and Holland & Knight, 2024; AHA, August 29, 2024; Meta Business Tools Terms; Google Ads customer data policies.

Watch out

Renaming purchase events with coded names, or hiding a pharmacy behind a neutral domain so Meta doesn't recognize it, is a way around the platforms' rules. It puts the ad account at risk and does nothing for your HIPAA or FTC exposure. Send only what you are allowed to send, accurately.

Check your own status in Meta Events Manager, under your dataset's settings, "Manage data source categories"7.

What server-side tracking fixes, and what it doesn't

Server-side tracking...	Fixes	Doesn't fix
Sends events from your server	Events lost to ad blockers	A health and wellness restriction already applied7
Sends the purchase when it is captured	Purchases after review, refills, cross-domain checkout	Enhanced conversions on prescription purchases at Google6
Lets you choose every field	Product names and URLs leaking into events	Data you are not allowed to share at all5
Covers Meta, Google and TikTok	Under-reporting on all three	Consent you didn't collect

What data to send

Send	Don't send
Event name and event ID, shared with the pixel8	Product names, SKUs or categories that describe a medication
Order value and currency	URLs, page titles or query strings from prescription or account pages
An internal order ID	Health questionnaire answers, prescription status
Click IDs captured on the landing page	Anything from logged-in patient pages

Keep the pixel off logged-in pages, prescription upload pages and order history. That is where health information sits.

Setup

Map your pages. List which pages are public, which collect health information, and which are behind a login.
Remove browser pixels from every page that collects or shows health information.
Send purchases from the system that captures the payment, with only the fields in the "Send" column.
Use the same event name and event ID in the browser and server events, so Meta deduplicates them8.
Send refills and renewals from the server, flagged apart from first orders.
Document what you send and review it with your counsel and your privacy officer.

Map the pages first, then send only from the payment side.

Fig. 2What leaves your site, and what never does

Logged-in and prescription pages

Patient pagesAccount, prescription upload, order history
no event toBrowser pixelRemovedDeclined

No pixel, no event

Public pages and payment server

Captured orderSent by the payment system
filtered byAllowed fieldsEvent ID, value, currency, order ID, click IDs
sent toMeta, Google, TikTokDeduplicated with the pixelApproved

Purchase sent with allowed fields only

Logged-in and prescription pages send nothing.

Illustrative example.

Check that it works

Check	How	Healthy sign
Deduplication	Events Manager, event overview	Browser and server events merged, not doubled
Payload	Test events, raw payload	NoProduct names, URLs or health fields
Coverage	Ad platform purchases vs. captured orders	A small, stable gap
Restriction status	"Manage data source categories"7	Known and documented
Refills	Server events by type	Present, separate from first orders

Then use the data to measure what your ads bring in: ad attribution for online pharmacies.

How Tagada helps

Purchase events sent once the pharmacy captures the payment

For brands that sell prescription medications online, Tagada Rx runs storefront, doctors, pharmacy and payments in one stack, with LegitScript included11.

Tagada never persists PHI: patient identity and intake answers pass through to the clinical network, and Tagada stores routing data only, such as case IDs, statuses and timestamps10. Tagada Rx serves US patients only and is open by application to a selected group of brands.

In the Tagada checkout:

Server-side events to Meta, Google and TikTok, sent from the checkout that takes the payment.
Meta Conversions API fired server-side once Meta is set up in the pixel slot, with deduplication9.
Postbacks fire once per paid order, so a refresh, a refund or a dispute doesn't create duplicate conversions9.

See the Rx stack and apply on the Tagada Rx page.

Apply to Tagada Rx

Purchase events sent once the pharmacy captures the payment

Updated on November 3, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Is Meta's Conversions API HIPAA compliant?

No tool is compliant on its own. The Conversions API only changes where events come from; what matters is what they contain. Meta's terms bar sending health information, and Meta's data source checks reportedly apply to server events too. Send the event, value and order ID, nothing that describes a medication.

Can an online pharmacy use the Meta pixel?

Only within Meta's terms, which bar sending health information. If you keep it, limit it to public pages that collect no health information, and keep it off logged-in pages, prescription steps and order history. The FTC's GoodRx case was about health data reaching ad platforms.

Why are my purchase events restricted in Events Manager?

Meta can classify a site as health and wellness and then strip URL details and custom parameters, or block standard events such as Purchase. Check "Manage data source categories" in Events Manager, and remove any health data from your events before you ask for a review.

Can I use Google enhanced conversions for a pharmacy?

Not for prescription purchases. Google treats "purchases of medical services, prescription drugs or medical devices" as sensitive, and says those conversions "can't be used for measurement in enhanced conversions". For any other conversion setup, check Google's policy for your account before you send prescription purchases.

Is the HHS tracking guidance still in force?

Partly. On June 20, 2024, a federal court in Texas vacated the part about tracking on unauthenticated public pages; the rest of the bulletin was not affected, according to Holland & Knight. HHS dropped its appeal in August 2024. This is general information, not legal advice.

Sources

Checked November 3, 2026

Tagada Rx

Count pharmacy sales without sending health data

Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.

Apply to Tagada Rx

01Tell us about your brand
02We review every application
03Go live under your brand after review