Why Privacy Regulations Are Coming for Every Marketer
Privacy regulations are coming for every marketer.
In 2025, Tractor Supply Company was fined $1.35M for privacy violations related to improperly configured consent management infrastructure on their website.
Think about that. This wasn’t Tractor Healthcare, or Tractor Financial, or even Tractor MedTech. This company sells….Tractors.
If Tractor Supply Company can be fined for privacy violations. So can you.
How the 2022 OCR/HHS Guidance Redefined PHI for Digital Marketers
On December 1st, 2022, the healthcare industry was put on notice when OCR/HHS vastly expanded the definition of PHI for digital marketers. Overnight, the industry had to redefine how it thought about the third-party scripts that had been ubiquitous to that point.
Well, almost ubiquitous.
A handful of forward-looking healthcare systems, including our client, the third largest non-profit health system at the time, had already assessed the privacy and compliance risks of the likes of Google Analytics and Meta. For us, that meant being asked to design the industry’s first enterprise implementation of a HIPAA-compliant data solution.
What a HIPAA-Compliant Data Solution Is and Where It Started
In 2019, three years before the infamous guidance from OCR/HHS rocked the healthcare industry, we quietly rebuilt the analytics infrastructure of this sprawling health system in a way that, for the first time, gave their marketers and technologists control of the user data their websites collected and shared with third parties.
The approach, now widely adopted by platforms and agencies alike, shifted data collection from relying on client-side third-party pixels to server-side data collection. This meant shifting away from platforms like Meta and Google, who mainlined user data from websites directly to their own servers, to giving brands direct control over the data themselves. Brands could decide exactly what data got shared with technology giants.
This move gave brands control over their own data, but now presented them with another problem: how do they leverage it?
How Free Analytics Pixels Became Marketing’s Default Infrastructure
Since the dawn of digital marketing in the naughts, the lure of analytics has been ever-present. Marketers quickly copied GA scripts and Meta pixels and plugged them into the admin section of their CMS, plopping the code into the header of every page.
Over time these scripts became ubiquitous and powerful. Understanding the effects of our website design, SEO, digital advertising, or email campaigns was what gave marketers the power to request more investments, or redirect investments, from leadership.
Marketing was measurable.
The adage of “50% of my marketing works, I just don’t know which 50%” became a quaint echo of the Donald Draper era.
But as we all came to realize, these free trackers and pixels weren’t free at all. Our data, which we freely gave away, became the product that Google and Meta would sell back to us in the form of better audiences and more precise targeting.
And this bargain worked, until a father of a young woman noticed that Target was actively marketing pregnancy and baby products to his daughter. Who he didn’t know was pregnant.
But Target did.
And Target wasn’t alone. The Markup did a study of websites that used the common tracking scripts and made an alarming discovery. Without the brands’ knowledge, the Meta pixel on websites was literally slurping up every form field across entire sites. It was understood prior to this revelation that webmasters would have to instrument forms to allow data to be collected, but the Meta pixel (among others) had evolved and had gained the ability to listen and capture all kinds of sensitive data from websites, even healthcare ones.
This included private symptoms entered into clinic intake forms, comments made as part of feedback provided in confidence, which pages were browsed before the form submit, and more.
This data created a detailed “graph” or profile of the user that would be repackaged to advertisers who wanted to get their products in front of browsers with an interest in their product or service.
Like prenatal care products for a young, soon-to-be mother who hadn’t summoned the courage to tell her parents she was pregnant.
Which brings us back to Tractor Supply Company.
The bargain has changed. Consumers the world over are waking up to the realization that their privacy is the product. Their browser history is being monetized by corporations who are using their profits to steer legislation their direction.
Marketers Who Control Their Data Will Win the Privacy Era
Despite these special interests and their deep pockets, over 21 states have adopted privacy legislation with another 7 states with bills moving through their legislatures.
Some of these bills mirror the guidance from OCR/HHS, and yet others are more strict and onerous. Not to mention the likes of GDPR, CCPA and the myriad of regulations being adopted and implemented the world over.
It makes for moving goal posts, conflicting and confusing guidance. Until regulations coalesce around a uniform standard, if that ever happens, complexity will rule the day, and marketers will have to learn how to adapt to the shifting sands.
And they’ll have to navigate the minefields of $1.35M fines for improperly configured cookie banners while still having to show the value of their work through analytics and tracking, the very tools that make them vulnerable.
This is why privacy is coming for every marketer. It’ll be the marketers that learn how to wrest control of their data from the behemoths and build the capabilities to organize and leverage that data for the benefit of their users and their stakeholders that rule in this new era.
