What do Meta's health and wellness restrictions mean for a med spa, and what still works?

Three sets of Meta rules, three different fixes

A rejected ad, a restricted event and a missing interest come from different parts of Meta. Work out which one you are dealing with before you change anything.

• The ad itself. The Health and wellness and Personal Attributes standards govern what an ad says and who sees it. A problem here shows up as a rejected ad, and the fix is in the copy, the image, the age setting or the landing page.
• Your website data. Data source categories, core setup and prohibited information notices govern which events and fields Meta accepts from your site. They show up in Events Manager. Ads keep running, but conversions can go quiet.
• Who you can reach. Meta removed detailed targeting options referencing health causes, and it flags custom audiences that reference a specific health condition. The fix is in how you build audiences.

What your ads can say

Under the line "When targeting people 18 years or older, advertisers can run ads that promote:", Meta's Health and wellness standard lists "dermal fillers, skin rejuvenation treatments, injectable treatments", laser treatments and hair restoration surgery, and "General cosmetic products, procedures, surgeries depicting before and after transformation." The standard's change log shows an update dated July 22, 2026, so read the current text rather than an older summary.

What still gets a med spa ad rejected:

• Attacking appearance. Meta bans cosmetic and weight ads with "statements of inferiority about physical appearance (i.e., terms, descriptions, or questions that are negative and attack an individual's appearance, specific body parts, or hygiene)."
• Implying something about the reader. Meta's own examples allow "Our new lotion and creams fight wrinkles like never before!" and reject "Ready to upgrade your skin to look younger?" See Meta's personal attributes rule.
• Timed promises. Meta bans clickbait in a health or weight context, such as "promises of specific outcomes within a set timeframe without disclaimers or qualifiers."
• Close-ups that pinch fat. When an ad promotes weight loss, Meta bans a "Close up on specific body area by pinching fat".
• Prescription weight loss under the wrong policy. The standard says: "For weight loss products that require prescription, please refer to Drugs and Pharmaceuticals ads policy and comply with the geo-targeting, and written permission requirements." For imagery, see before and after GLP-1 photos.

What your website can send

Meta's Health and wellness data source category covers a data source associated with "health-related products and services", among other things. Meta doesn't publish a ruling for med spas as a group. It assigns categories "based on the topics related to the data source and the products and/or services provided", so check your own dataset rather than guessing.

In Events Manager, open your dataset's Settings tab and look at Manage data source categories. Meta notes you may not see that section if your data sources aren't in any category. If a category applies, it carries one of three restrictions:

• Core setup: Meta says "most campaigns should continue to run as expected", but custom parameters and everything after the domain are dropped. A treatment page such as /lip-filler arrives as your bare domain. See what core setup still allows.
• Restriction on certain standard events: Meta "Restricts the sharing of specific mid and lower funnel events", which is where booking and purchase events usually sit. Optimize on an event Meta still accepts. See what Meta restricts for health and wellness data sources.
• Full restrictions: Meta Business Tools can't be used for ads purposes where the restriction applies. Meta points to objectives such as Awareness, Engagement and Traffic.
• In every tier, "custom events are automatically blocked until you review and confirm them".

Who you can reach

Meta removed detailed targeting options referencing health causes starting January 19, 2022. What a clinic can still target covers each remaining option. For a med spa, the plan usually rests on three:

• Location. Meta says it "can be used to reach people in the vicinity of a business's brick and mortar store". A radius around each location is the natural core of a med spa plan.
• Age. 18 and over is required for cosmetic procedures, and you can narrow age and gender from there.
• Website and engagement audiences, and lookalikes built from them, kept clear of condition-specific pages. Meta's rule is that "references to specific health conditions (e.g., arthritis) or financial status (e.g., credit score) aren't allowed." See what to do when Meta flags a custom audience.

A compliant plan for a med spa

1. Set every ad set that promotes a treatment to 18 and over.
2. Rewrite copy so it describes the service, not a flaw in the reader. "Lip filler appointments with a licensed injector" describes the service. "Hate your thin lips?" attacks the reader's appearance.
3. Check prescription weight loss ads against the Drugs and Pharmaceuticals policy first, including its geo-targeting and written permission requirements.
4. Open Events Manager and note any data source category and tier, so you know which events you can optimize on.
5. List every tag that fires on your site. Curve Compliance's free website scan shows each pixel and tracker on a page in about a minute. Then take treatment and condition names out of URL paths, UTM values and custom event names, which can trigger prohibited information notices.
6. Measure bookings in your own reporting. A HIPAA-compliant attribution tool such as Curve Compliance ties each booking in Boulevard, Vagaro, Mindbody or Square back to the ad that sent it, so budget decisions don't depend on events Meta no longer receives.

What not to do

• Don't resubmit a rejected ad in new copies. Meta says "Editing or deleting an ad that was rejected for violating Advertising Standards will not remove the violation from your account and you can be restricted from advertising for severe or repeat ad violations."
• Don't send a restricted event under a new name. Meta says event, conversion and audience names "must not reflect, imply, or be based on any prohibited information".
• Don't open a new ad account, Page, pixel or domain to escape a restriction. See whether to open a new ad account after a restriction.
• Don't expect server-side delivery to lift a restriction. The category follows the data source and the business, not the way events travel. See why server-side tracking doesn't lift a restriction.
• Don't upload a list of clients from one condition-specific service, such as a weight loss program. Meta's audience rules look at what the list is based on.

Talk to Curve

For a med spa, most of the work is in the details: the age setting, the copy and what the site sends. Curve's team will review what your site sends to Meta with you, show what's likely triggering a flag, and set up HIPAA-compliant conversion tracking that keeps your campaigns optimizing, with bookings in Boulevard, Vagaro, Mindbody or Square tied back to the ad that sent them. A BAA is signed on every plan. To get started, book a call with Curve.

Frequently asked questions

Sources

• Meta Transparency Center: Health and Wellness (Advertising Standards)
• Meta Transparency Center: Privacy Violations and Personal Attributes (Advertising Standards)
• Meta Business Help Center: How to troubleshoot a rejected ad
• Meta Business Help Center: About data source categories in Meta Events Manager
• Meta Business Help Center: How to manage data source categories in Meta Events Manager
• Meta Business Help Center: Understand data sharing restrictions based on data source categories
• Meta Business Help Center: About core setup
• Meta Business Help Center: About prohibited information
• Meta Business Help Center: Understand restrictions on certain custom audiences
• Meta for Business: Removing Certain Ad Targeting Options and Expanding Our Ad Controls (November 9, 2021)

Last verified October 1, 2026

Related pages

• Meta Rejected My Ad Under the Health and Wellness PolicyWhat Meta's Health and wellness ad standard bans, what it allows for 18+ audiences, and when to edit a rejected ad or request a review instead.
• Meta Personal Attributes Rejection: Rewriting Clinic AdsMeta's personal attributes rule, its own allowed and rejected health examples, a rewrite check for clinic ad copy, and how rejections become restrictions.
• Meta Restricted Purchase Events for Health and WellnessWhy Meta restricts Purchase and other lower-funnel events for health and wellness sites, what still works in each tier, and the compliant way back.
• Meta Core Setup for Health Businesses: What Still WorksMeta core setup strips custom parameters and everything after the domain. What still works for a health business, why it happened, and what to fix first.
• Meta Flagged My Custom Audience or Lookalike: Next StepsWhy Meta flags custom and lookalike audiences that reference a health condition, what the flag stops, and how to fix the seed or request a review.
• Does Server-Side Tracking Get Around Health Restrictions?No. Meta restricts health data by data source, not by route, and forbids re-sending removed data. Here is what server-side tracking is really for.