Let's TalkLet's TalkWhat Meta, Google and your state board actually forbid in medical advertising - and why the agency that learns it by rejection costs you a month of pipeline.
Send us your three highest-spend healthcare ads and the pages they point at. You get back a written review naming what would attract a restriction and why - specific enough to hand to your current agency or your counsel. It is a marketing review rather than legal advice, and we say so on it.
Four failures we see repeatedly in this vertical, and what each one actually costs.
Meta and Google enforce automatically and tell you when you have crossed a line. Your state medical board does not monitor ads, does not warn you, and acts on complaints - usually from a competitor. Practices optimise hard against the rulebook that gives feedback and stay unaware of the one that carries real professional consequences.
Meta forbids ad copy that implies knowledge of a person's health condition. "Struggling with acne?" and "Tired of hiding your smile?" both read as addressing an individual's condition, and both are ordinary marketing copy everywhere else. It is the single most common reason a healthcare account gets restricted, and it is invisible to anyone who has not run in the vertical.
Before-and-after imagery persuades better than anything else a practice has, and Meta restricts it. Many state boards restrict it further, or require disclaimers about typical results. Practices either run it and collect restrictions, or abandon visual proof entirely - and neither is necessary once the creative is planned around the constraint.
A copy mistake gets an ad rejected. Sending data that identifies a person and a health condition to an ad platform is a different category of problem, and the tracking setup is where it happens - usually by someone adding a pixel to every page without thinking about which pages those are.
Business outcomes rather than dashboard metrics. None of these is a guaranteed number - where we do guarantee something, it is written into the offer above.
The real deliverables, not a list written to make a proposal look thicker.
Not the general agency pitch. The reasons that only apply to this kind of business.
Guidance on health data tracking changed materially in 2024, and much of the advice clinics still receive is based on a federal position that a court has since vacated. We keep track of what is current and say plainly where the position narrowed and where the risk simply moved elsewhere - rather than repeating the most alarming version because it sounds safest.
Online booking systems, chat widgets, call tracking and form tools often send data to third parties by default. A practice can write compliant ads and still have a scheduling widget passing information it should not. The vendor stack is part of the data path, so we review it alongside the creative.
A short document of the rules that apply to your practice - what may be claimed, what needs a disclaimer, which pages carry tracking and why - belongs to the practice and can be handed to any future agency or new hire. Compliance should not depend on a particular supplier remembering, including us.
Live creative, landing pages and tracking, reviewed against both rulebooks. Most practices have at least one thing running they did not know was a risk, and it is usually copy rather than imagery.
Your board's rules on testimonials, results imagery and credential claims, confirmed before anything is produced. This is the step generalist agencies skip because they do not know it exists.
Pixels off patient portals and anything behind a login, condition names out of URLs and form fields, conversions moved server-side with personal data hashed. This is the one item where the downside is not a rejected ad.
Demonstration, technique and practitioner-led explanation instead of condition-addressing hooks and side-by-side results. Planned deliberately, this performs comparably - discovered by rejection, it costs a month.
What was checked, when, and against which rule. A board complaint is answerable if the practice can show the review happened, and unanswerable if it cannot.
The parts of this that come from having run it in this industry before rather than from running it well in general.
The theory that an IP address plus a visit to a public page about a condition was itself protected health information was declared unlawful and vacated in June 2024, and HHS withdrew its appeal that August. Authenticated pages and information a patient actually submits remain plainly in scope. Meanwhile state consumer-health-data law reaches marketing sites independently - Washington's took effect in March 2024 with a private right of action. Take the specifics to your own counsel.
Two dental practices settled with OCR over replies to online reviews - one for $10,000, another for $23,000 - after including patient names, treatment and insurance detail. Neither was acting maliciously; both were trying to respond helpfully. A reply that confirms someone was a patient is the line, which makes review replies one of the most overlooked compliance surfaces a practice has.
Consent to treatment is not consent to appear in advertising. Using a patient's image, story or words in marketing needs documented permission for that purpose specifically, and some boards add their own requirements on top. Getting this right before content is produced is far easier than retrieving it afterwards.
Checking a script before filming costs minutes. Discovering a problem after a shoot, an edit and a campaign launch costs a reshoot, lost pipeline and sometimes a restricted account. Building the review into the start of production is the single change that most reduces the cost of compliance.
Compliance is why this account could scale at all. A multi-state clinic group running in three states had creative that would not survive review in several of them, and a conversion setup that counted form fills. We rebuilt the creative to the platform rules and moved the conversion to the booked consult - cost per lead fell 57% in two weeks, and the account stayed live through expansion into nine more states. An account that gets restricted mid-expansion does not just pause; it loses the learning phase too.
Read the full case studyTwo agencies before this got our account restricted. Nobody had told us the copy was the problem - we assumed it was the before-and-after photos.
The written review was the useful part. I could hand it to our attorney and to the agency at the same time.
They found a pixel on our patient portal that had been there for two years. Nobody had thought about which pages it was on.
The rule that catches most practices is the personal-attributes policy: an ad may not imply knowledge of a person's health condition. "Struggling with hair loss?" addresses the reader's condition and is not allowed; "we treat hair loss" describes what you do and is. Detailed health and wellness interest targeting was also removed, so audiences are built from geography, search intent and lookalikes instead. Before-and-after imagery is restricted, as is copy implying unlikely or guaranteed results.
Some healthcare categories cannot run at all without it. Addiction treatment services, telehealth providers and online pharmacies require LegitScript certification before Google will serve the ads, which is an application process rather than a setting. Other categories are restricted by country. We check this before a campaign is built, because discovering it afterwards means a launch date that was never achievable.
Yes, on ordinary marketing pages. Not on a patient portal, an appointment history, or anything behind a login - those relate to an identifiable person and their care. The area between those two has been litigated in the US and the position is less settled than either side claims, so we treat it conservatively: no condition names in URLs or forwarded form fields, no diagnosis data in a conversion payload, and conversions sent server-side with personal data hashed. The practical rule holds regardless of how the law settles - do not send something that identifies a person and a health condition to an advertising platform.
They are a separate rulebook with separate consequences. Boards set rules on what counts as a testimonial, whether results imagery may be shown and with what disclaimer, and how credentials and specialty claims may be described - and those rules differ meaningfully by state. A board does not monitor your ads; it acts on complaints, often from a competitor. Platform enforcement costs you a month of pipeline. A board complaint is a professional matter.
No, and anything that tells you otherwise is worth distrusting. We know the platform policies because we run in them daily, and we know which state board rules commonly bite because we read them before producing creative. Where something is genuinely a legal question we say so and tell you to ask your counsel. The review we send is written so it can be handed straight to them.
We draft the appeal the same day and, where the restriction is creative-level, replace the affected ads so spend keeps running while the appeal sits. Restrictions are recoverable; what is not recoverable is the learning phase a campaign loses while it is paused, which is why the work is front-loaded into writing compliant creative rather than into appealing rejections.
Written for owners weighing this up, whether or not they work with us.
This is one part of a bigger service. Here is the whole of it, and the closest neighbours.
No pitch deck, no discovery call you have to sit through. Tell us the situation and we will tell you whether we can help.