Cookie consent banners on a medical practice website: what they do and what they do not

Many practice websites now open with a cookie banner. Usually it arrived with a website builder, a plugin or a marketing vendor, and nobody at the practice decided what it should say or what should happen when a patient clicks “Reject”. That matters, because a banner is easy to mistake for a privacy fix. It records a visitor’s choice about cookies. It does not make a tracking setup acceptable under HIPAA, and it does not by itself satisfy laws that ask for a specific kind of consent.

This guide covers what a banner can and cannot do for a practice, how Google’s consent mode connects a banner to Google Analytics and Google Ads tags, why “Reject” does not always mean nothing is sent, and how to design the banner so the choice is real. For the wider question of which tags belong on a practice website at all, start with our guide to tracking pixels on practice websites. For newsletter and offer pop-ups, which raise their own search and accessibility questions, see our guide to pop-ups on a medical practice website. For browser notification prompts, see our guide to web push notifications for practice websites and apps. Our guide to Google Analytics on medical practice websites covers which pages to keep analytics off.

What a cookie banner can do, and what it cannot

A banner does one job well: it asks the visitor whether the site may use non-essential cookies and similar technologies, records the answer, and passes that answer to the tags on the page. Done properly, that gives visitors a real choice and gives the practice a record of it.

What it cannot do is stand in for the permissions some health privacy laws require. The three that come up most for practices:

• HIPAA. The HHS Office for Civil Rights bulletin on online tracking technologies says that website banners asking users to accept or reject a site’s use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization. If a tag would disclose protected health information to a vendor, a click on “Accept” does not make that disclosure permitted. Part of that bulletin was vacated by a federal court in 2024; our tracking pixels guide explains which part, and the banner statement is in a section the court did not remove.
• The FTC Health Breach Notification Rule. This rule does not apply to HIPAA covered entities, or to a business acting as a covered entity’s business associate. It does reach vendors of personal health records and related entities, such as some health apps. For them, 16 CFR 318.2 defines a breach of security as acquisition of health information without the authorization of the individual, and says this includes an unauthorized disclosure, not only a hack. Our Health Breach Notification Rule guide covers who it reaches.
• State consumer health data laws. State laws can cover health data collected outside HIPAA. Washington’s My Health My Data Act, for example, requires consent to collect consumer health data and separate consent to share it, obtained before collection; a general cookie banner is not designed to capture either. See our Washington My Health My Data Act guide.

So the practical rule is to decide first which tags may run on which pages, then use the banner to manage choices about the tags that remain. A banner is the last layer, not the first.

How Google consent mode connects the banner to your tags

If the site uses Google Analytics or Google Ads, the banner usually talks to Google’s tags through consent mode. Google Ads Help is clear that consent mode does not provide a banner or widget; it receives the visitor’s choices from your banner and adjusts how Google tags behave. Google’s overview also says you are responsible for obtaining users’ consent on your website.

Consent mode works with named consent types. The ones that matter most on a practice site:

• ad_storage: storage such as cookies related to advertising.
• ad_user_data: consent for sending user data to Google for online advertising purposes.
• ad_personalization: consent for personalized advertising.
• analytics_storage: storage such as cookies related to analytics, for example visit duration.
• functionality_storage and security_storage: storage the site needs to work, such as language settings, authentication and fraud prevention.

Google’s setup guide says the site should set a default consent state before the visitor makes a choice, then update it when they do, and that by default no consent mode values are set. The ad_user_data and ad_personalization types were added in November 2023, so a banner configured before then may be sending an incomplete set of signals.

Why “Reject” does not always mean nothing is sent

Google describes two ways to implement consent mode, and the difference matters more for a practice than for most businesses.

1. Basic consent mode. Google tags do not load until the visitor interacts with the banner. Google’s overview says no data is sent before the visitor consents, not even the default consent status, and if the visitor does not consent, no data is transferred to Google at all.
2. Advanced consent mode. Google tags load when the page opens, with consent defaulted to denied unless you set other defaults. While consent is denied, Google says the tags send measurements without cookies, along with the consent state. Google offers this mode because it allows better conversion modeling.

For an online store, advanced mode may be a reasonable trade. For a practice, think about which pages the tags are on. A visitor who clicks “Reject” on a page about a specific condition, or on an appointment request page, would reasonably expect nothing to go to an ad platform. Under advanced mode, something still does, just without cookies. Whether that is a problem depends on the page, the data and the laws that apply, but it is a decision the practice should make knowingly, not a default someone else chose.

Two practical consequences follow. First, consent mode is not a way to put Google tags on pages where HIPAA concerns apply, such as patient portal pages or forms that collect health information; those pages should not carry advertising tags at all. Second, if you use advanced mode anywhere, your website privacy policy should describe it accurately. Our guide to the practice website privacy policy covers what that document should say about cookies and tags.

Designing a banner patients can actually say no to

In September 2022 FTC staff published a report on dark patterns, design choices that push people toward decisions they would not otherwise make. The report is not a regulation, but it shows how the FTC looks at consent screens, and it names cookie banners specifically. A workshop panelist pointed to the common cookie consent dialogue that puts “Accept” front and center while the option to deny or change settings sits behind several screens. The report’s appendix lists a pre-checked “accept tracking cookies” box as an example of preselection, and repeatedly offering “Yes” or “Not now” instead of “Yes” or “No” as an example of nagging. Our guide to dark patterns on healthcare websites covers the report’s other pattern families.

The report’s recommendations translate directly into banner design:

• Equal weight. “Accept” and “Reject” should be equally easy to see and click. The report says one option should not be more prominent than another.
• No pre-checked boxes. Defaults should not lead to collection or sharing visitors would not expect.
• Choice at the moment it matters. The report says choices should be presented when the person is making a decision about their data, not buried in a privacy policy or terms of service.
• Specific, not blanket. For sensitive information, the report says it should be clear what the person is consenting to, with the information they need, such as whether the data will be shared with third parties.
• A real “No”. A visitor who rejects should not be asked again on every page.
• Easy to change later. A link in the footer that reopens the cookie settings lets visitors change their mind.

A setup review for your practice website

Illustration: a small practice runs Google Analytics on every page and a Google Ads conversion tag on its thank-you page, with a banner installed by its website plugin. Its owner wants to know what the banner is actually doing. A review in this order, with whoever manages the site, answers that.

1. List every tag. Use your tag manager and the page source. Note what each tag is for and which pages it runs on.
2. Remove tags from sensitive pages first. Patient portal pages, appointment requests, symptom checkers and forms that collect health information should carry no advertising or analytics tags that send data to a vendor without the permissions HIPAA requires. Our guide to HIPAA and website contact forms covers the form side.
3. Pick basic or advanced consent mode on purpose. Write down which one the site uses and why.
4. Set defaults to denied before the banner appears. Check that all four Google consent types are set, including ad_user_data and ad_personalization.
5. Test the “Reject” path. Reject on the banner, then watch the browser’s network panel while you move through the site. Confirm that what is sent matches what you decided.
6. Fix the design. Equal buttons, no pre-checked boxes, no repeated prompts and a footer link to reopen settings.
7. Update the privacy policy. Describe the tags, the banner and how to change a choice.

How we handle this

When we build a practice website, we decide which tags run on which pages before a banner goes on, keep advertising tags off pages that collect health information, and test the reject path in the browser. Our website work is built with HIPAA in mind, and we confirm in writing what a BAA covers before any patient information flows through a tool; if it is not covered, we do not route patient information through it. See our medical website design service for how we approach the build.

Sources

• HHS Office for Civil Rights: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
• eCFR: 16 CFR Part 318, Health Breach Notification Rule (318.1 scope, 318.2 breach of security)
• FTC staff report: Bringing Dark Patterns to Light (September 2022), pages 15 to 16 and Appendix A
• Google for Developers: Consent mode overview
• Google for Developers: Set up consent mode on websites
• Google Ads Help: About consent mode

More in Practice websites, privacy and tracking