On this pageJump to a section
"Help prevent advertisers from sharing sensitive information through Meta Business Tools."
That is how a Meta spokesperson described the purpose of a new set of data restrictions, according to a Marketing Brew report on December 9.1 If you advertise a clinic, a telehealth service or anything near health and wellness, that sentence should make you open your Events Manager this week.
What follows is education. It is not legal advice. Have a healthcare privacy attorney review your own setup.
I am working from one trade-press report and a spokesperson's comments. Nothing has rolled out yet. But the direction is clear enough to act on, and an audit costs you an afternoon. If Meta narrows what health advertisers can send, you want to find out on your terms, not in a broken campaign.
What exactly did Meta tell advertisers?
Less than we would like, which is why the details matter.
What the report says
Marketing Brew reports that Meta recently began notifying advertisers about new data restrictions, set out in an advertising policy update released in November 2024. They could limit or fully block advertiser access to data in categories including health and wellness, financial services and politics. Meta "may restrict the sharing of specific mid- and lower-funnel events," and campaign optimization tools could stop working in some cases.1
How Meta defines the category
A memo shared with an advertiser, according to the report, defines health and wellness data as data "associated with medical conditions, specific health statuses or provider/patient relationship." The report gives examples on both sides of the line. Vitamins marketed for a specific medical condition could face restrictions while vitamins not marketed for a condition might not. Medical Botox for migraines could be restricted while cosmetic Botox might not. Products with vague claims, such as supporting digestion or relieving stress, fall into a gray area.1
Meta declined to explain how it categorizes advertisers.1 That is the honest picture: a policy with fuzzy edges and a January date.
That would be catastrophic.
Why are regulators watching the same data?
Because health information leaking into ad systems has been a live enforcement issue for two years.
The FTC
In February 2023 the FTC announced its first enforcement action under the Health Breach Notification Rule, against GoodRx. The agency said GoodRx shared users' prescription and health condition information with advertising platforms, including Facebook, and paid a $1.5 million civil penalty.4 In April 2024 the FTC finalized changes to that rule. The revised rule makes clear it covers health apps and similar technologies not covered by HIPAA, and that a breach of security can be an unauthorized disclosure, not only a hack.2
HHS and HIPAA
HHS's Office for Civil Rights has published a bulletin on online tracking technologies. It says regulated entities may not use tracking technologies in a way that results in impermissible disclosures of protected health information, and that tracking on user-authenticated pages, such as a patient portal or telehealth platform, generally has access to PHI.3
There is a wrinkle (I unpacked it in HIPAA, tracking pixels and the court ruling). On June 20, 2024, a federal court in Texas vacated part of that guidance, the portion saying HIPAA is triggered where a technology connects an IP address with a visit to an unauthenticated public page about health conditions or providers. HHS said it was evaluating its next steps.3 So the picture is not simple, and it is a reason to bring counsel in, not to guess.
How do you audit your events?
Start with a list of every event your pixel and server send.
Layer one: event names
Open Events Manager and write down each event. Typical names are PageView, Lead, Schedule, InitiateCheckout and Purchase. Then read the names you or a vendor created. A custom event called "Lead_ConditionName" tells anyone who sees it exactly what a person has. Rename generic.
Layer two: parameters
Events carry extra data: product names, content names, categories, values and sometimes more. Check what each parameter contains. If a parameter holds the name of a treatment, a diagnosis or a symptom, you are sending health information alongside the event. Strip it or replace it with a neutral value. The same minimal-data thinking drives my advice on telehealth intake forms.
Layer three: URLs
Many pixels send the page URL. Look at your URLs. Paths like /migraine-treatment-intake or /condition-name-checkout reveal a health situation to anyone who reads them. Use neutral paths for intake and checkout, such as /start and /checkout, and keep condition detail on the page, not in the address.
- Export every event and parameter your setup sends, from pixel and server.
- Mark anything that names or implies a condition, treatment or patient relationship.
- Rename events and parameters to neutral wording, and update URLs where you can.
- Check how Meta categorizes each data source in Events Manager, as a Meta spokesperson advised, and request a review if one looks wrong.1
- Write down who approved the final setup and when.
What if your best events get restricted?
Plan for it now, calmly.
Build a fallback
If lower-funnel events were limited, the platform would have less to learn from. Decide today what you would optimize for instead, perhaps a generic lead event higher in the funnel, and how you would judge quality without relying on the platform. Your own records of booked consults and completed intakes become the measure of truth, and the server-side plumbing is covered in my Conversions API baseline.
Keep your own numbers
Track source, booked consults and completed visits in a system you control, not only in Ads Manager. If an event disappears from the platform, your business can still see which campaigns bring patients.
Do not panic-edit
Per Meta's Help Center, touching an ad, ad set or campaign while it is still learning restarts the process.5 Wait for the rule to take effect before reshaping campaigns, and change one thing at a time when it does.
Do not wait for the platform to tell you what is sensitive. Decide it yourself, and send less.
I do not know exactly how this rule will land, and nobody outside Meta does. I do know that clinics with clean, minimal data are in a better position under any version of it. If you want to talk through your setup, start at my telehealth page.
Keep building.Ekai
Questions people ask
What is Meta changing for health and wellness advertisers?
According to a Marketing Brew report on December 9, 2024, Meta has begun notifying advertisers that it may restrict the sharing of specific mid- and lower-funnel events, with the policy taking effect in January. It had not rolled out as of this article.
Which events are affected?
The report says the events at issue include shopping-cart activity and prior purchases, and that campaign optimization tools could stop working in some cases. Meta did not publish a complete list.
How do I check how Meta categorizes my data source?
A Meta spokesperson advised advertisers to review the categories assigned to their data sources in Meta Events Manager, and to ask for a review if a source seems miscategorized.
Does HIPAA apply to my tracking pixel?
It can. HHS guidance says HIPAA applies when tracking technologies on a regulated entity's pages collect protected health information, such as on a patient portal. A federal court vacated one part of that guidance in June 2024, so the details depend on your facts. Ask counsel.
Sources
- 1
- 2
- 3
- 4
- 5
