Privacy ComplianceWeb Tracking
Can URLs Reveal Sensitive Data? What Tracking Tools Send by Default
Analytics and advertising tools typically send their vendors the full address, or URL, of each page that visitors view. Those addresses often describe the pages, so, on certain categories of websites, they can reveal health conditions, financial concerns, and other sensitive interests. This has made them a recurring issue in health privacy enforcement and wiretapping claims.
By Alex Proctor
Published October 16, 2026
Summary
A URL is the address of a web page, which often includes words that describe the page or the terms that visitors searched for. Most analytics and advertising tools send the full address to their vendors by default, and in some cases even after visitors decline non-essential tracking. Regulators have treated descriptive addresses as sensitive information, while some courts have treated them as the contents of a communication. I recommend that businesses review what their page addresses and titles reveal, and confirm which tools receive them.
How Do Page Addresses Reach Tracking Vendors?
Analytics and advertising tools typically read the full address of each page that visitors view and send it to their vendors. For example, Google Analytics sends a parameter that Google describes as "the full URL of the page." Meta lists page location among the information that its pixel collects.
Consent settings do not always change this behavior. For example, under Advanced Consent Mode, Google's tags continue to send data to Google after visitors decline non-essential tracking. Google's documentation states that, when advertising cookies are denied, that data "will still include the full page URL."
These tools commonly send three items that can reveal sensitive information:
| What Is Sent | Example | What It Can Reveal |
|---|---|---|
| Page path | /conditions/diabetes | A health concern |
| Search term | ?q=bankruptcy+lawyer | A financial concern |
| Page title | Applying for Asylum in the U.S. | An immigration concern |
Examples of what Google Analytics collects by default, as of October 2026.
Descriptive page addresses that may constitute sensitive personal data are not limited to healthcare websites. For example, immigration law firms, religious organizations, and retailers may have pages about visa applications, religious practices, or pregnancy.
How Do Regulators Treat URLs Under Privacy Laws?
Regulators have treated descriptive page addresses as health information when those addresses were shared with advertising companies. In 2023, the Federal Trade Commission alleged that GoodRx shared website addresses with Facebook that "in many cases included a medication name." It also alleged that addresses on a related telehealth service "referenced specific health conditions." GoodRx agreed to pay a $1.5 million penalty.
California's Attorney General took a similar position in 2025. Its complaint against Healthline alleged that the company shared article titles "strongly suggesting a current diagnosis" with third parties. Healthline agreed to pay $1.55 million. Notably, Healthline is a publisher rather than a healthcare provider.
State privacy laws generally permit an opt-out model for web tracking, so analytics and advertising tools may run until visitors opt out. However, most of those laws require opt-in consent before businesses process sensitive data, such as information about a health condition or diagnosis. When page addresses reveal sensitive topics, websites that otherwise use an opt-out model may need to obtain opt-in consent before tracking tools run on those pages.
How Do Courts Treat URLs in Wiretapping Claims?
Starting in 2027, SB 690 limits pen register claims over website tracking to the Attorney General. After that, private CIPA claims will depend largely on whether tracking tools captured the contents of a communication. Courts have generally treated basic address information as record information rather than contents. However, an address that describes what visitors read or searched for may qualify as contents.
Search bar claims, which have been among the most common wiretapping claims of 2026, are the clearest example. When visitors use site search, the terms that they type often appear in the address of the results page. Tracking tools then send that address to their vendors. In 2024, a federal court in Los Angeles ruled that "search terms constitute 'contents' of a communication."
In 2022, a federal judge in California concluded, in an early ruling in a case against Meta, that "descriptive URLs" from healthcare providers' websites were contents. In 2025, another federal judge in California found that the URLs in a case against an eating disorder treatment provider were "personal enough" to support a lawsuit. However, that judge ruled for the provider on the CIPA claim, because Meta did not read the information while it was in transit.
The level of detail in the addresses appears to matter as well. In July 2026, a California appellate court observed that an address on a hospital's public website "arguably would need to include specific terms" in order to disclose that a patient was exchanging health-related communications. Taken together, these rulings suggest that the question remains unsettled, and that descriptive addresses carry more risk than generic ones.
What Reduces the Risk?
Businesses have a few common ways to reduce the risk:
- Keep sensitive terms out of page addresses. Search terms and form answers do not have to appear in addresses. Page paths can also be written in general terms.
- Limit what the tools send. Google Analytics offers data redaction for the query parameters that businesses list, although it does not remove descriptive words from page paths. Meta may apply a core setup to certain categories of businesses, which restricts "anything in a URL following the domain."
- Control the tools through the consent banner. Tools can be gated behind consent logic derived from the banner, so that they stop sending page addresses when visitors disable tracking. On pages that reveal sensitive topics, they can be set to wait for opt-in consent.
I recommend that businesses review what their page addresses, search results pages, and page titles reveal, and confirm which tools receive them. Analytics and advertising tools on pages that reveal sensitive topics may need a different consent approach than the rest of the website.
Questions
Does the browser's referrer policy keep page addresses private?+
Not from most tracking tools. By default, browsers send only the website's domain in the referrer header when requests go to other companies. However, analytics and advertising tags read the full page address themselves and include it in the data that they send.
Does server-side tracking keep page addresses away from vendors?+
Not necessarily. Browsers still send the addresses to servers that businesses control, which forward them unless they are set up to remove or generalize them. Google tells businesses that, with its server-side tagging, they have "full control over how that data is shaped."
Is a page address personal information if it does not include a name?+
Yes, in many cases. California's privacy law lists browsing history and search history as examples of personal information. Tracking tools typically send page addresses together with identifiers such as cookies and IP addresses, which can link the browsing to particular visitors.
Briefings are informational and do not constitute legal advice.
Running analytics or marketing tools?
I'll trace what leaves the browser, and when.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.