Engineering case study. Client anonymized. No legal determination is made.
Advertising scripts can receive page URLs, referrers, event names, browser identifiers and device information, and on a clinical site a health-related page path can contribute to sensitive inferences.
This study examines a browser-level privacy intervention in a healthcare booking funnel: an allow-list of event keys, a clinical-term filter and wrappers on the outbound request paths for Meta, TikTok, Reddit, LinkedIn and Microsoft. It also documents what the intervention does not cover, including residual data flows to Google products and a consent load-order gap in which advertising pixels start before the consent platform loads.
The conclusion is deliberately bounded. Control effectiveness and legal sufficiency are different questions, and only the first is an engineering question. The study separates what the code does from what the record can support, and leaves covered-entity, business associate and consent questions to counsel.
What this demonstrates:
• Data minimization controls on advertising telemetry
• Documentation of residual flows and the consent load-order gap
• A clear boundary between engineering controls and legal determinations
What this does not claim:
• A HIPAA compliance determination
• That nonessential transmission is blocked before consent
• Identification of the client
How Dominate Ignite works: Forensic Discovery. System Architecture. Hardened Execution. Continuous Governance.
The full engineering case study is published at dominateignite.com/publications/cs-02/
Dominate Ignite. Growth. Precision. Governance.
0 likes · 0 views · Nov 12, 2026
What a browser-level privacy control can reduce, what it leaves open and where engineering ends and counsel's decision begins.