Can a GP practice website use Google Analytics, cookies or the Meta Pixel?

Tracking pixels: don’t

NHS England’s GP IT operating model says that where a practice website handles patient-identifiable information, tools such as the Meta Pixel must not be embedded in a way that passes visitors’ details to third parties without their knowledge or consent.

On a GP website, almost every page is health-related. A pixel that tells an advertiser someone looked at your sexual health, mental health or maternity page, or filled in a form, is sharing something very personal. There’s no good reason for a practice to advertise, so there’s no reason for a pixel.

The cookie rules now

The Privacy and Electronic Communications Regulations (PECR) cover cookies, pixels, local storage and anything else that stores or reads information on a visitor’s device. The Data (Use and Access) Act 2025 added some exceptions, and the ICO has updated its guidance. In short, you don’t need consent for:

• things that are strictly necessary for something the visitor asked for, like a login or a form;
• remembering how the visitor wants the site to look, like a language or text size;
• analytics whose only purpose is counting how the site is used, to improve it, if you meet the ICO’s conditions.

The ICO’s conditions for the analytics exception include: you tell visitors clearly what it’s for; you give them a simple, free way to object; the data is only shared with a provider acting on your behalf, not one that uses it for its own purposes; and individuals aren’t tracked or profiled. Advertising and social media trackers always need consent.

What about Google Analytics?

NHS England’s operating model recommends that practices use analytics someone actually reviews. But whether a tool fits the new exception depends on how it’s set up. Many standard analytics set-ups share data with the provider for its own purposes, or link visits to individuals, and then you still need consent. If you’re not sure, ask your supplier and your data protection officer before relying on the exception.

Before adding analytics at all, ask what you’ll do with the numbers. If no one will look at them, leave them out.

Cookie banners get in patients’ way

NHS England’s guide to usable GP websites asks practices to remove pop-ups and banners that sit on top of content. When we checked 150 North East practice websites, 35% opened with a cookie banner covering the page on a computer or phone. If your site sets no non-essential cookies, you don’t need a banner: a cookie statement linked from the footer is enough.

Check your own site

1. Put your website address into Blacklight. It lists ad trackers, third-party cookies, the Meta Pixel and session recording.
2. Read your cookie notice. Does it list every cookie and script the site actually uses?
3. Ask your supplier for a list of every third-party script on your site, and what each one does.
4. Remember embedded content: video players, maps and some online consultation widgets can set their own cookies.