Med Spa Meta Ads Compliance: Health and Wellness Restrictions and Legitimate Workarounds

Meta's health and wellness restrictions let med spas advertise fillers, injectables, peels and laser treatments, but only to people 18 or older, without copy that attacks appearance or implies the viewer has a condition, and without treatment data in the pixel. The legitimate workarounds are 18+ ad sets, clinic-focused copy, generic events and broad local targeting.

Most med spa ad accounts are not restricted for one bad ad. They are restricted for a pattern repeated across dozens of ads: the same copy habit, the same image style, the same pixel setup.

This guide reads Meta's current policy pages, the latest updated July 22, 2026, and turns each restriction into a workaround that stays inside the rules. Every rule links to the page it comes from, with screenshots taken in October 2026.

Meta health and wellness ad restrictions and legitimate workarounds

Five Meta rules shape every med spa campaign on Facebook and Instagram. Each one has a legitimate workaround, and none of them requires hiding what you sell.

• Age targeting. What Meta's policy says: Cosmetic procedure ads must target people 18 or older; Legitimate workaround: Set 18 as the minimum age in every ad set
• Appearance claims. What Meta's policy says: No statements of inferiority about physical appearance; Legitimate workaround: Sell the treatment, the injector and the visit
• Personal attributes. What Meta's policy says: No asserting or implying a viewer's medical condition; Legitimate workaround: Describe the service, never the viewer's condition
• Prescription drugs. What Meta's policy says: Drug ads need LegitScript certification and Meta authorization; Legitimate workaround: Advertise the appointment, not the drug brand
• Business Tools data. What Meta's policy says: No medical procedures or treatments in pixel data; Legitimate workaround: Standard event names, no treatment names in URLs

A workaround in this guide means a setup that complies. Second ad accounts, cloaked landing pages and misspelled treatment names are evasion, and Meta's Advertising Standards prohibit helping anyone evade or circumvent its enforcement.

Meta also reviews more than the ad itself. Its ad review covers images, video, text, targeting and the landing page, and the services in the ad must match the services on that page.

The 18+ rule for cosmetic procedures

Meta's health and wellness policy says ads for cosmetic products, procedures or surgeries must target people at least 18 years old.

Source: Meta Transparency Center: Health and Wellness

The same page names the treatments it means: dermal fillers, injectable treatments, skin rejuvenation, chemical peels, micro-needling, non-ablative laser treatments and laser or light treatments. That is most of a med spa menu.

Set 18 as the minimum age in every ad set, including retargeting, instant form and boosted post campaigns. Duplicated campaigns copy their settings, so one wrong template spreads across the account in an afternoon.

Laser hair removal falls under laser or light treatments, so the same rule applies. Our laser hair removal marketing guide covers offers for that service.

Before and after photos under the 2026 policy

Before and after photos are allowed in Meta ads for general cosmetic procedures, as long as the ad set targets people 18 or older.

Source: Meta Transparency Center: Health and Wellness

Many guides, including the first version of this one, still tell med spas to avoid before and after images entirely. The policy page carries a change log, and its latest entry is dated July 22, 2026, so read the current wording before you plan creative.

The limits sit around the photo, not in it. The same policy bans statements of inferiority about physical appearance and, for weight loss ads, close ups that pinch fat on a body area.

Our rule for med spa accounts: use consented, unretouched results, and keep the caption about the treatment and the timeline, never about what was wrong with the patient. Weight loss offers carry extra rules, covered in our weight loss program marketing guide.

Personal attributes: copy that implies a condition

Meta's personal attributes policy bans ads that assert or imply knowledge of a person's physical or mental health, including medical conditions.

Source: Meta Transparency Center: Privacy Violations and Personal Attributes

Meta's examples show the line. "New diabetes treatment available" is allowed. "Do you have diabetes?" is not, because it suggests the advertiser knows something about the person reading it.

Aesthetic copy breaks the same rule through second-person problem language. The fix is to describe the service and who provides it, which also makes the Facebook ad more specific and easier to trust.

• Tired of your forehead lines? Compliant rewrite: Forehead line treatments with a licensed nurse injector
• Hate your double chin? Compliant rewrite: Jawline contouring consultations, Saturday appointments open
• Your sun spots are aging you. Compliant rewrite: IPL photofacial sessions with a medical provider
• Lose your stubborn belly fat. Compliant rewrite: Body contouring consultations at our Main Street clinic

"You" is not banned. The policy allows you and your language that does not reference an attribute, so "Book your consultation" passes while "Your wrinkles" does not.

Botox, GLP-1s and prescription drug names

Neurotoxins and GLP-1 weight loss medications are prescription drugs, which puts brand-name ads under Meta's drugs and pharmaceuticals policy instead of the cosmetic rules.

That drugs and pharmaceuticals policy requires online pharmacies and telehealth providers to hold LegitScript certification and Meta's authorization before promoting prescription drugs. Those ads may only run in the United States, Canada and New Zealand, to people 18 or older.

A med spa is usually neither a pharmacy nor a manufacturer, so the workable route is to advertise the procedure and the appointment. The health and wellness policy lists injectable treatments as a cosmetic procedure adults can be shown.

In practice: lead with the injector, the consultation and the visit, keep brand-name discounts off the ad, and answer product questions in the consult. Our Botox marketing ideas has offer angles that fit inside this.

HIPAA compliant advertising and the Meta pixel

For a medical spa, HIPAA compliant advertising on Meta ads is mostly about data: what your website, pixel and Conversions API send to Meta.

HIPAA applies to covered entities. For providers, 45 CFR 160.103 means one who transmits health information electronically in connection with a covered transaction, such as an insurance claim. A cash-pay clinic should confirm its status with a healthcare attorney.

Meta's own terms apply either way. Its prohibited information list names medical procedures, treatments and testing, and covers URL parameters, custom event names, custom conversions and custom audiences.

Source: Meta Business Help Center: About prohibited information

That rules out three setups we find in med spa audits: an event called BotoxConsultBooked, a thank-you URL like /thank-you-lip-filler, and a custom audience named after a treatment history.

The compliant version uses standard events such as Lead and Schedule, thank-you pages with neutral URLs, and no patient lists uploaded to Meta unless consent and your attorney support it.

Core setup and restricted pixel events

Meta can also restrict a med spa's data on its own, by assigning the website to a sensitive data source category in Events Manager.

Its data sharing restrictions page lists three levels: core setup, limits on certain mid and lower funnel standard events, and full restrictions on all events in some or all regions.

Core setup strips custom parameters and everything in a URL after the domain. Website audiences built on URL rules can shrink or stop updating, and automatic advanced matching can disappear.

• Core setup: rebuild website audiences on domain-wide rules and set up advanced matching manually.
• Restricted events: optimize for the upper-funnel or custom events still available, as Meta's page suggests.
• Full restrictions: run Awareness, Engagement or Traffic objectives, or instant forms that collect leads on Meta.
• Wrong category: request a review in Events Manager; Meta replies by email with its decision.

Check Events Manager once a month. Meta notifies advertisers by email and in Events Manager when restrictions apply, but those notices are easy to miss in a busy clinic inbox.

Targeting med spa patients without health interests

Meta removed detailed targeting options tied to health causes starting January 19, 2022, so there is no anti-aging interest left to buy.

What replaces it is geography, first-party data, exclusions and creative. Your target audience becomes everyone 18+ within driving distance, and the ad decides which new patients raise a hand.

Without health interests to lean on, most of the ongoing work is creative rotation: replacing ads before they fatigue in a fixed local audience.

If you are deciding where budget goes while Meta is restricted, our comparison of Meta vs Google ads for med spas covers the split.

What to do when the ad account is restricted

A restricted account is usually the end of a pattern, so fix the pattern across the whole account before you request a review.

Meta's restricted account guide adds a deadline: an ad account disabled for a policy violation that stays ineligible for reinstatement for 6 months can no longer be reinstated.

Do not open a second ad account to keep spending. That is the circumvention Meta's standards prohibit, and it turns a fixable rejection into a bigger enforcement problem.

If you want a second pair of eyes before you appeal, book a free 15-minute call and we will go through the rejected ads and the pixel setup with you.