Australia’s OAIC finds tracking pixels breached privacy law: Medmate and Monash IVF (2026)
At a glance
- Brought by
- Regulator: OAIC (Australia)Regulator
- Company
- Medmate and Monash IVF
- Sector
- Telehealth and fertility
- Law
- Australian Privacy Act (APPs)
- Amount
- Breach findings, no fine
- Date
- Determined Jun 11, 2026
- Status
- Breach findings, no fine
Summary
In June 2026, Australia’s privacy regulator, the OAIC, found that two health providers, Medmate and Monash IVF, breached the Privacy Act by using tracking pixels that sent visitors’ sensitive health information to advertising platforms without consent. These are formal breach findings with remediation orders, and they carry no monetary fine.
What happened
Medmate is a telehealth provider and Monash IVF provides fertility services. The determinations are dated June 11, 2026. On Medmate’s site, Meta and TikTok pixels collected health data and fed targeted social-media advertising. On Monash IVF’s site, seven different pixels were used at various times (five were active in December 2024), and a custom Meta pixel tracked visits to fertility pages and form submissions. Monash also uploaded Custom Audience lists to Meta containing names, email addresses, phone numbers and states.
The mechanism
These are standard advertising pixels on health sites, doing what pixels do: sending what a visitor looked at to a third party. When the site is about telehealth or fertility, what a visitor looked at is sensitive health data. Australia’s Privacy Act protects that through the Australian Privacy Principles (APPs), and the OAIC found breaches of the rules on collecting sensitive information, notifying people, and using it for direct marketing.
Why it was preventable
A pixel that sends page-visit data from a health site to an ad platform is exactly what payload inspection surfaces. The fix starts with seeing what each pixel sends, and from which pages.
In the regulator’s words
The Privacy Commissioner said: “[W]ebsite providers must obtain consent where they’re using tracking pixels to collect sensitive information, such as data on health, political opinions, race or ethnicity.”
Timeline
- Jun 11, 2026determinations dated.
- Jun 24, 2026published.
Source
oaic.gov.au media release; full determinations [2026] AICmr 40 and 41 on AustLII.
oaic.gov.auQuestions
Who found these breaches?
The OAIC, the Office of the Australian Information Commissioner. It found that Medmate and Monash IVF breached the Privacy Act. These are formal breach findings with remediation orders, and they carry no monetary fine.
What did the pixels do?
On Medmate’s site, Meta and TikTok pixels collected health data and fed targeted advertising. On Monash IVF’s site, seven different pixels were used at various times (five were active in December 2024), and a custom Meta pixel tracked visits to fertility pages and form submissions. Monash also uploaded Custom Audience lists to Meta containing names, email addresses, phone numbers and states.
Why is this sensitive data?
When a site is about telehealth or fertility, what a visitor looked at reveals a health matter. Australia’s Privacy Act protects that through the Australian Privacy Principles, which require consent to collect sensitive information.
Related cases
The health-pixel lawsuit wave
Aspen Dental’s pixel-tracking settlement
Meta Pixel and Google Analytics on appointment site (alleged)
FTC v. Hims & Hers
Alleged sharing of health data (ED, mental health) with ad platforms, not clearly disclosed
See what your tags send before it becomes a case
DataTrue runs real journeys on your site in each consent state and reads what each tag sends, field by field. A tag sending what it should not shows up in a test.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
