Medical practice websites: a data protection check

In brief

• Two out of three healthcare websites (67.7%) contact third-party servers before visitors can click anything. In the other eleven sectors of our sample, the figure is 67.8%. So the confidentiality these professions stand for does not automatically carry over to their websites.
• Less advertising, just as much data outflow: An advertising or analytics tool runs before consent on 9.9% of healthcare websites, compared with 15.7% in other sectors. The rest of the data outflow comes mainly from fonts, maps, website builders, appointment booking portals and sector-specific platforms.
• “Reject” rarely works: On 77.4% of healthcare websites with third-party services, the number of third-party servers contacted does not fall after a click on “Reject”, usually because there is no effective way to reject. Among psychotherapy practices, the figure is 82.6%.
• Each profession has its own cause: Medical practices mainly load Google services, and appointment booking portals are also typical of them. Psychotherapy practices are strikingly often tied to website builders, pharmacies to platforms of their sector.
• Much of it is easy to fix: If all practices and pharmacies simply left out what can be avoided without losing any function, the share of completely quiet websites would rise from 32.3% to 45.4%.

Data and methodology

This article is a spin-off of our “Before you click: Data Protection Report 2026”. For the report, we automatically visited 10,389 German websites from 15 sectors, each in three separate sessions with a real browser: once without any click, once after “Accept all” and once after “Reject”. The data was collected from 25 June to 9 August 2026. We recorded the third-party servers contacted, the cookies set, the security settings and whether a privacy policy can be found.

For this analysis, we narrowed the sample down to four healthcare professions and compared them with the remaining 9,046 websites from eleven sectors (basis: 10,384 unique websites; five had been recorded twice in the report):

Four points for context. First, we measure what a website does technically; we do not establish legal violations. Whether a particular contact is permitted depends on the individual case. Second, the group of dental practices is small at 56 websites; their figures indicate a trend, nothing more. Third, the sample is stratified by sector and not representative of the German web as a whole; this makes comparisons between sectors robust. Fourth, we do not name any practices or pharmacies, only the recipients of the data, that is, the companies to which something flows. The assignment of recipients to purposes follows the methodology of the main report. “Reject ineffective” means: after a click on “Reject”, the website contacts no fewer third-party servers than after “Accept”; this includes websites that offer no option to reject at all. All figures may be used under the CC BY 4.0 licence with attribution.

Healthcare websites are as leaky as all the others

You might expect professions bound by confidentiality to be more restrained online as well. The measurement shows something different: on the most important figure, data outflow before the first click, practices and pharmacies are exactly at the average.

The table can be read in two ways. The good news: practices and pharmacies load advertising and analytics tools before consent significantly less often, and a privacy policy is missing less often than elsewhere. The sobering news: data outflow before the click is nevertheless just as common. It usually arises not because someone wants to watch patients, but because a font, a map or a booking window is loaded from a third-party server. It is rarely intentional, but it still has an effect.

Why this carries more weight in healthcare

Every connection to a third-party server transmits the IP address of the visitor and usually also which website the request comes from. On a furniture store’s website, that is a technical detail. On the website of a psychotherapy practice, it can contain a clue about a person’s health.

The GDPR protects health data particularly strictly (Art. 9 GDPR). The Court of Justice of the European Union (CJEU) interprets the term broadly: even data that only indirectly allows conclusions about a sensitive characteristic can fall under it (CJEU, judgment of 1 August 2022, C-184/20). Information that customers provide when ordering pharmacy-only medicines online is health data, even if no prescription is required (CJEU, judgment of 4 October 2024, C-21/23). And the Court considers it possible that in certain cases merely visiting a website reveals sensitive information, for example where a network such as Facebook links the visits to user accounts (CJEU, judgment of 4 July 2023, C-252/21, paras 72 f.). According to our research, neither a German court nor a German supervisory authority has so far expressly ruled on whether merely visiting a practice website constitutes health data in itself (as of October 2026). It can, however, allow conclusions to be drawn about health.

Irrespective of this, the following applies to every website: loading third-party content requires a legal basis under the GDPR, and anyone who stores or reads information on visitors’ devices needs their consent, unless this is strictly necessary to provide a service explicitly requested (§ 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG). In her guidance on appointment management in medical practices, the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) writes in general terms: if third-party content such as fonts, city maps or scripts is embedded in an app or website, these third parties obtain knowledge of personal data. “As a rule, there is no legal basis for this.” The Regional Court of Munich I (LG München I) awarded a website visitor €100 in damages because a website loaded Google Fonts from Google’s servers without asking (judgment of 20 January 2022, 3 O 17493/20). And the German Federal Court of Justice (BGH) has ruled that even the loss of control over one’s own data can constitute compensable damage (judgment of 18 November 2024, VI ZR 10/24).

Four professions, four causes

On average, the healthcare professions look the same. If you look at the recipients, they differ considerably. That is the really useful finding of this analysis, because the cause determines the solution.

*Share of websites with third-party servers before the click whose entire data outflow before the click consists of avoidable items: fonts and script libraries, maps, videos, spam protection and small add-on widgets. These websites would be completely quiet after a clean-up.

Medical practices: Google and the appointment booking portal. Of the four professions, medical practices perform best, and yet 64.4% contact third-party servers before the click. The most common reason is Google Fonts, embedded Google Maps and the reCAPTCHA spam protection (27.7% of websites). On top of that comes a case typical of the sector: on 9.7% of medical practice websites, an appointment booking portal such as Doctolib, Jameda or Dr. Flex is already contacted as soon as the page is opened, for example through a booking window or a rating badge, before anyone even wants to book an appointment. Booking is a genuine function. But it does not have to load when the page is opened: according to the guidance of the German Data Protection Conference (DSK), additional functions such as a map service or a contact form are not already “requested” the moment a website is first opened; the same is likely to apply to a booking window. A button that opens the booking window only on click or links to the booking page serves the same purpose.

Dental practices: Google on every second website. In the small group of dental practices, every second website (50.0%) has contact with Google before the click, almost always because of fonts, maps or reCAPTCHA. What also stands out is that 21.4% load banner or legal text services from third-party servers, twice as many as in the other sectors (10.0%). The banner itself then establishes a connection to the outside before any decision has been made.

Psychotherapy practices: the website builder decides. According to our size estimate, three out of four psychotherapy practice websites belong to solo or very small practices, and they run strikingly often on website builders: 26.4% contact the infrastructure of a website builder or website platform before the click; in the other sectors, the figure is 14.3%. 10.7% of psychotherapy practice websites run on Wix, and Wix websites almost without exception load services from third-party servers as soon as the page is opened (411 of 418 across all sectors). These connections are part of the product; the practice can hardly switch them off without changing provider. At the same time, “Reject” works least often here: on 82.6% of websites with third-party services, it has no effect at all. This is particularly unfortunate in this profession, because merely visiting the website can reveal something about the visitor.

Pharmacies: the sector’s platform. At 82.8%, pharmacy websites contact third-party servers before the click more often than any other of the 15 sectors in the report. Advertising is hardly the reason: we found an advertising or analytics tool before consent on only 5.3%. The data outflow lies in the infrastructure of the sector. 42.4% of pharmacy websites load services from pharmacy portals, cooperation groups and specialist publishers before the click, most often addresses of the Apotheken Umschau from Wort & Bild Verlag (20.5% of pharmacy websites). Whether these services run on behalf of the pharmacy and what data arrives there cannot be determined from the outside. 29.1% also load image and delivery services from third-party servers, mostly the same websites that are also tied to sector-specific platforms. That is why only 4.8% of the affected pharmacy websites can be made quiet by simple means. For the rest, the lever lies with the provider that supplies the website. For pharmacies with online ordering or pre-ordering, there is one more point: according to the CJEU, order data in the online sale of pharmacy-only medicines is health data, even without a prescription. Its processing therefore requires an exception under Art. 9(2) GDPR, in the case decided by the Federal Court of Justice explicit consent, and competitors may pursue such infringements before the civil courts (CJEU C-21/23; Federal Court of Justice, judgments of 27 March 2025, I ZR 222/19 and I ZR 223/19).

What practices and pharmacies can change themselves

Because the cause is usually a default setting, the solution is usually a setting. The steps are sorted by impact:

1. 1Serve fonts from your own server, load maps and reCAPTCHA only on click. This step alone makes an additional 8.6% of all healthcare websites completely quiet. Everything remains usable for visitors; the map and spam protection only appear after a click. Switching over the fonts alone usually takes half a day.
2. 2Start appointment booking only on click. A button or link to the booking instead of a window that loads when the page is opened. This affects around one in ten medical and dental practice websites.
3. 3Test the reject button. Open the website in a private browser window, click “Reject”, open the “Network” tab in the developer tools and see which third-party addresses still show up. Takes five minutes.
4. 4Defuse videos and widgets. For videos, a preview image that loads the player only on click; rating badges as an image instead of a third-party script.
5. 5Talk to the provider. If your website sits on a website builder or a sector-specific platform, you should ask whether fonts can be served locally and whether anything loads before consent. If the answer remains unsatisfactory, switching is the most honest solution.
6. 6Set the server’s security settings. Four to five lines in the server configuration; they are missing on 67.4% of healthcare websites.

Added up: if every practice and every pharmacy simply left out what can be avoided without losing any function, 45.4% of healthcare websites would be completely quiet before the click instead of 32.3% today. What then remains are things with a genuine purpose, such as analytics tools, website builders and platforms. Each of them needs its own legal basis, and analytics and advertising usually need consent. Where consent is required, the “no” must also get through technically. When you need a banner at all is explained in our guide Cookie banner: when is it required?.

Checking your practice website with Dieter

You can run the same three-state test that we used to collect the data for this study on your own website: the website scanner in the GDPR check-up is free, requires no sign-up and shows you in under a minute which recipients your website contacts before the click, after “Accept” and after “Reject”, which cookies are set and whether the security settings are right. The report is written so that you can read it without prior knowledge or pass it straight on to your agency.

Whatever remains on the website after that must be included in the privacy policy, from the appointment booking portal to the map. Dieter’s privacy policy generator detects embedded services via a website scan, knows over 1,000 of them and keeps the text up to date through live embedding. How a complete privacy policy is structured is explained in the guide How to create a privacy policy.

Conclusion

Practice and pharmacy websites pass something on before the first click just as often as the websites of the other sectors in our study, even though they load advertising and analytics less often before consent. The data outflow is rarely intended; it is a default setting: Google Fonts and maps at medical and dental practices, website builders among psychotherapy practices, sector-specific platforms at pharmacies. The good thing about it: for many practices, a few technical adjustments are enough to ensure that nothing flows out before the click any more. Where the platform decides, the most important measure is a conversation with the provider. Especially in professions that depend on the trust of their patients, both are worthwhile.