Cookies can collect special category data under GDPR Article 9 without anyone filling in a form. When an analytics or advertising tag on a page about a medical condition, a religion or sexual orientation sends the page address to a third party together with a cookie identifier, it can link that person to the sensitive topic. The Court of Justice has confirmed that data like this can be special category data, which needs explicit consent or another narrow Article 9 condition. Most websites with sensitive sections are better off keeping such tags off those pages.
How analytics and marketing tags reach sensitive data
Article 9 of the GDPR prohibits the processing of special categories of personal data unless one of its narrow conditions applies. Most website operators assume this rule only affects hospitals, political parties or religious institutions collecting form submissions. Standard analytics scripts and marketing pixels can also capture special category data by recording what a visitor reads.
The mechanism lies in how standard marketing tags work by default. Scripts from major advertising networks send page addresses and referrers to external servers. If a visitor opens a page about a specific medical condition, the address itself can reveal health information, and the cookie identifier sent with it links that information to one browser.
What qualifies as special category data
The GDPR singles out information that poses significant risks to fundamental rights if exposed or misused. Article 9 lists racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, health data, and data concerning a person's sex life or sexual orientation.
Standard personal data, like an email address or IP address, requires a valid lawful basis under Article 6 of the GDPR. Special category data also needs one of the conditions in Article 9(2).
Health data is the most common trap for ordinary websites. If an analytics cookie records a visitor reading /health-advice/diabetes-management, the website may be processing special category data. The same principle applies to dating websites that reveal sexual orientation or union websites that record membership questions. Context determines the sensitivity of the data collected.
Inferred data counts too
You do not need to ask a user for their medical history to process health data. On 4 July 2023, in Meta Platforms v Bundeskartellamt (C-252/21), the Court of Justice found that Meta's processing of data about users' visits to other websites and apps appeared to concern special categories, since it could reveal, among other things, political opinions, religious beliefs or sexual orientation. The Court also held that merely visiting such sites does not mean a person has made that data public.
On 4 October 2024, in Lindenapotheke (C-21/23), the Court held that the information customers enter when ordering pharmacy-only medicines online is data concerning health, even when no prescription is needed, so the seller needs their explicit consent. An advertising pixel that records purchases of pregnancy tests and prenatal vitamins sits close to the same line.
The test is what the data can reveal, not only what it says on its face. If a third-party vendor can deduce a visitor's political affiliation from their reading habits on your news site, you are responsible for that disclosure.
Fines for sensitive data and tracking
Regulators across Europe have penalised organisations that mishandle special category data, including through tracking.
In May 2023, the French CNIL fined the health website Doctissimo EUR 380,000 for breaches of the GDPR and of the French rules on cookies, in a case that covered both health data and cookies set without valid consent. The case shows that health-focused content publishers face particular scrutiny over their tracking.
Grindr faced a steeper penalty from Norway's Datatilsynet, which issued a NOK 65 million fine in 2021 for sharing user data with advertising partners without valid consent. The data included GPS location and the fact that users were on an app for the LGBTQ+ community, which in effect revealed their sexual orientation.
In September 2024, the CNIL fined CEGEDIM SANTÉ EUR 800,000 for processing health data without the required authorisation. The data was pseudonymised rather than anonymised, because re-identification remained possible, so masking direct identifiers did not take it outside the rules. For how these amounts are set, see how GDPR fines are calculated.
What a tracking request carries from a sensitive page
Most website administrators deploy tags through Google Tag Manager without inspecting what each request sends. A standard _ga cookie from Google Analytics or an _fbp cookie from Meta comes with requests that include the page address and referrer by default. On a site with sensitive sections, those defaults become a liability.
The script that runs the Meta Pixel, fetched on 16 October 2026, builds its requests with parameters including dl (the page address), rl (the referrer), ev (the event) and fbp (the browser identifier). Put together on a health page, two of them do the damage:
What one pixel request from a health page carries
A clean, descriptive URL structure helps search engines but also tells advertising networks what a visitor is reading. Consider a legal advice website with a page at /services/criminal-defence/domestic-abuse. If a Meta Pixel fires on that page, it sends the exact address to Meta's servers, linking the visitor's browser to an interest in domestic abuse legal services.
The website operator, as the data controller that chose to embed the tag, is responsible for that disclosure. Not knowing how a third-party script works is no defence.
How third-party pixels work on sensitive sites
Third-party vendors design their tracking scripts to collect as much behavioural data as possible for advertising. A third-party cookie can link the current visit with the same browser's history across other websites, so each tag that fires on a sensitive page adds to a profile held elsewhere.
Many advertising networks forbid customers from sending sensitive data to them. Google's policies, for example, prohibit sending personally identifiable information to Google Analytics, so a health-related address that identifies a person can break both the GDPR and a platform's terms. You remain the controller regardless of the tools you use.
Explicit consent vs standard cookie consent
The GDPR sets a higher bar when sensitive data is involved. Setting a standard analytics cookie requires consent under Article 5(3) of the ePrivacy Directive, and the personal data processed needs a basis under Article 6 of the GDPR.
Processing special category data on the basis of consent requires explicit consent under Article 9(2)(a): a clear, express statement, such as ticking a box that names the sensitive category. A generic "Accept all" button on a standard banner rarely meets that threshold. The person must know that data about their health, political opinions or another sensitive trait will be collected and used, and for what.
That creates an obvious problem for websites on sensitive topics: a banner saying "We use cookies to process your health data for advertising" will rarely be accepted. Vague wording that hides this is not the answer, because regulators look past deceptive language and dark patterns, and pre-ticked boxes are never valid consent.
Most websites are better off switching marketing and analytics trackers off entirely on sensitive pages, or not loading them on those sections at all.
| Data type | Rule | Consent requirement | Cookie examples |
|---|---|---|---|
| Standard personal data (IP, email, user ID) | ePrivacy Article 5(3) and GDPR Article 6 | Opt-in consent for non-essential cookies | _ga, _fbp, fr |
| Special category data (health, political, sexual orientation) | GDPR Article 9 | Explicit consent, or another Article 9(2) condition | Trackers firing on medical or dating pages |
| Strictly necessary storage (session IDs, security) | Exempt from consent under ePrivacy Article 5(3) | No consent, but a GDPR basis is still needed for any personal data (often contract or legitimate interests) | PHPSESSID, __stripe_mid |
Running a sensitive data cookie audit
You cannot fix a leak you do not know about. A useful audit follows a visitor's path through the most sensitive areas of your website.
Start by listing every page, form and interactive element that deals with Article 9 topics. Open your browser's developer tools on those pages and inspect the Network tab to see which scripts load and what they send. Look closely at the query string parameters sent to domains like google-analytics.com or facebook.com. If you see plain-text references to medical conditions, political affiliations or sexual orientation in the request URLs, sensitive data is leaving your site.
Automated scans catch trackers that manual checks miss. Kukie.io's cookie scanner lists the cookies and scripts that load on each scanned page, so you can check the pages that discuss health or other sensitive topics and spot a marketing pixel that arrived with a new plugin or a new post.
Server-side tagging and payload scrubbing
Server-side tagging places your own server between the visitor's browser and the third-party tracker. You can configure that server to remove sensitive URL paths or query parameters and replace them with general values. A request for /health/hiv-testing becomes a neutral signal like page_category=medical_service, so the page view is counted but the sensitive context is gone before transmission.
Server-side tracking takes technical expertise and infrastructure, and you must control the routing logic so no sensitive parameter slips through. Server-side tagging does not remove the need for consent before cookies are set. For most websites, blocking tracking scripts in the browser until the right consent exists is the more practical defence.
Setting safe boundaries on your website
The most effective strategy separates sensitive content from tracking. If your pages on sensitive topics sit under clear paths, configure your tag manager so that marketing and analytics tags never fire on those paths, whatever the visitor chose elsewhere.
Everywhere else, your consent banner should block non-essential scripts until the visitor opts in, and explain what each cookie category does without dark patterns. The French CNIL penalises sites that make rejecting cookies harder than accepting them.
Kukie.io holds tracking scripts until consent is given and lets you choose pages where the banner is not shown, while blocking stays in place. It does not change consent by section of your site: excluding tags from sensitive pages is a decision you make in your own tag setup.
Questions about cookies and sensitive data
Does a user's IP address count as special category data?
No, an IP address alone is standard personal data under the GDPR. However, if that IP address is linked to browsing behaviour on a highly sensitive web page, the combined data can fall under Article 9.
Can we use legitimate interest to process health data via cookies?
No. Legitimate interest is an Article 6 basis, and special category data also needs an Article 9 condition. For tracking on websites, that condition is usually explicit consent, and the cookie itself needs consent under the ePrivacy Directive anyway.
How do advertising networks know if my URLs contain sensitive data?
Standard tracking scripts send the full page address and referrer with their requests as soon as they load. Unless you configure them to remove it, that plain-text address reaches the network's servers.
What happens if a user consents to cookies but then visits a sensitive page?
Standard cookie consent rarely meets the explicit consent threshold required for special category data. You must either obtain a separate, explicit opt-in for sensitive data processing or keep trackers off those pages.
Do these rules apply to B2B websites?
Yes, the GDPR protects the individual, not the business. If a visitor to a B2B website browses pages revealing their trade union membership or political opinions, that data is protected under Article 9 regardless of their professional context.
What is payload scrubbing in cookie management?
Payload scrubbing means intercepting tracking data on your own server before it goes to a third party and removing sensitive parameters, so the third party only receives general values instead of exact, sensitive page addresses.
See which tags fire on your sensitive pages
If your website covers sensitive topics, check which cookies and scripts load on those pages before a visitor chooses. Kukie.io scans your pages, sorts the cookies by category and blocks marketing and analytics scripts until visitors consent.
