Question 9: What website analytics would you recommend for a dental clinic website in California that wants to limit tracking?

For a dental clinic website in California that wants to minimize tracking, I would recommend a privacy-first analytics platform rather than Google Analytics 4 (GA4).

The goal should be to understand how patients find the clinic and use the website without building detailed profiles of visitors, collecting unnecessary personal information, or sharing browsing data with advertising networks.

My preferred options would be Plausible Analytics, Fathom Analytics, and Matomo.

1. Recommended analytics platforms

1.

Plausible Analytics

My first choice

No cookies or persistent visitor identifiers.

Does not store visitors' IP addresses.

Simple dashboard for traffic, referrals, landing pages and conversions.

Supports custom events and campaign tracking.

Best for a clinic that wants useful statistics without extensive visitor tracking.

Website: plausible.io · Technical details

2.

Fathom Analytics

Cookie-free analytics.

Straightforward traffic and campaign reporting.

Bot filtering.

Conversion tracking and dashboard sharing.

A good alternative if you want a polished hosted service with minimal configuration.

Website: usefathom.com · Features

3.

Matomo

Can be self-hosted on infrastructure you control.

More detailed reporting and visitor behavior analytics.

Configurable cookie and IP anonymization.

More control over data retention and access.

Best if the clinic has technical support and wants greater control over its analytics infrastructure.

Website: matomo.org

2. What I would measure on a dental website

You don't need to track individual visitors to understand whether your website is working.

I would configure the analytics to measure:

Metric

Why it matters

Total visitors

Overall website reach

Traffic sources

Google, referrals, direct traffic

Landing pages

Which pages attract visitors

Service page views

Interest in implants, crowns, cleanings, etc.

Location page views

Interest in clinic locations

Phone button clicks

General indication of contact intent

Directions clicks

Interest in visiting the clinic

Appointment button clicks

Interest in booking

Mobile vs. desktop

Website usability

Important: Track aggregate events, not patient identities. For example, record an event called appointment_button_click, not a patient's name, email, phone number, requested treatment or appointment details.

3. California privacy and HIPAA considerations

This is particularly important for a dental practice.

There are two areas I would pay attention to:

HIPAA

Dental practices that are HIPAA-covered entities need to be careful about what website information is disclosed to third-party analytics providers.

HHS explains that tracking technologies can expose information such as IP addresses, appointment details, contact information and other identifiable health information.

There was also a June 2024 court ruling that vacated part of HHS's guidance concerning visits to unauthenticated public webpages. This does not eliminate HIPAA obligations when actual PHI is disclosed.

See: HHS guidance on online tracking technologies .

California privacy and tracking laws

The California Dental Association specifically warned dentists in January 2025 about potential legal exposure involving website tracking technologies, including Meta Pixel and cookies.

Its recommendations include:

Disable unnecessary tracking technologies.

Review the website privacy policy.

Consider cookie consent controls.

Collect only information necessary for website functionality.

Review third-party website management vendors.

See: California Dental Association's guidance for dentists .

CDA

I would also have a California privacy attorney review the website's use of analytics under applicable CCPA/CPRA and California Invasion of Privacy Act requirements. A cookie-free analytics tool does not automatically guarantee legal compliance.

4. Tracking technologies I would avoid

For a privacy-conscious dental clinic, I would avoid installing these by default:

Google Analytics 4: Avoid unless there is a carefully reviewed reason to use it. Google does not offer a BAA for Google Analytics, and it should not receive PHI.

Analytics Help

Meta Pixel: Avoid on the clinic website, particularly appointment and treatment-related pages.

Microsoft Clarity / Hotjar: Avoid session recordings, heatmaps and keystroke tracking on patient-facing forms.

Third-party advertising pixels: Avoid unnecessary cross-site tracking.

5. My recommended technical setup

Here is what I would implement:

Component

Recommendation

Website analytics

Plausible

Search performance

Google Search Console

Advertising tracking

None initially

Cookies

No analytics cookies

Session recording

Disabled

IP collection

Minimized

Patient forms

Separate secure system

Patient portal

No general-purpose analytics

Data retention

Minimum practical period

One important distinction: Google Search Console can help measure Google search impressions, clicks and search queries without installing Google Analytics on the website. It is useful for dental SEO.

My final recommendation

Recommended setup

I would start with Plausible + Google Search Console, without GA4, Meta Pixel or session-recording software.

This gives the dental clinic most of the information it needs to evaluate SEO, website performance and patient acquisition without introducing unnecessary tracking.

Before deployment, I would also have the website developer audit existing scripts, embedded maps, chat widgets, appointment forms and third-party plugins. Removing GA4 alone doesn't necessarily remove all tracking.

Would you like me to put together a privacy-first analytics implementation checklist for a California dental clinic, including exactly which scripts to install, disable and audit?