Meta says "potentially prohibited information was removed from the data you're sharing"

Where the notice shows up and what it tells you

Meta says the notice can arrive "through email, in the diagnostic tab in Meta Events Manager, or in Meta Ads Manager". The removed data itself is not shown: Meta notes that "actual data that has been detected and removed is not displayed". What the Diagnostics tab does show is "which parameters, from which pages, had information removed". That is your starting point.

For a health business, Meta's examples of prohibited information include "Diseases, medical conditions and injuries", "Medical procedures, treatments and testing", prescription medications, and "Physical locations that identify a health condition, or places of treatment and counseling".

Where to look on a clinic or telehealth site

Meta tells you to check "URL strings from pages on which you use a Meta Business Tool, parameter names and values you are sharing, and the names you have chosen for custom events." In practice, that means:

• Page paths and query strings that name a condition or treatment, on any page where the pixel runs. Curve Compliance's free website scan lists every pixel and tracker on a page, so you can confirm where the pixel runs.
• UTM values. Meta warns that "UTM parameters in a URL string may contain prohibited data from the landing pages viewed." A campaign named after a condition ends up in utm_campaign.
• Parameter values such as content names, content categories, product IDs and custom properties.
• Custom event names.
• Form fields. Meta asks you to analyze "data fields, such as forms, on your webpages".
• Logged-in pages. Meta says "You shouldn't send information about people from web pages where visitors may log in and provide potentially sensitive information, such as patient portals."

How to fix it

Meta also suggests you "may want to turn on core setup" to help prevent further prohibited information being shared. Read what core setup still allows before you decide.

1. In Events Manager, open the dataset's Diagnostics tab and note every parameter and page Meta lists.
2. Compare that list with the summary of pages, parameters and URLs your Business Tools recently sent, which Meta also shows in Events Manager.
3. Trace each item to where it starts: a page template, a tag manager variable, a booking or intake tool, or your campaign naming.
4. Change the integration so the information is no longer sent. Remove the pixel from pages that shouldn't have it, stop sending the field, and take conditions out of URLs and campaign names. Curve Compliance replaces browser ad pixels with one script that sends each platform only a fixed list of fields, and flags PHI-like patterns such as condition names in URLs before data reaches Meta, so they can be stopped at the source.
5. If Meta blocked custom events and you think that was an error, Meta says you may be able to request a review from Events Manager or Ads Manager.
6. If a developer or agency maintains the site, bring them in. The fix lives in their code.

What not to do

If your events were also restricted because of your data source category, that is a separate issue. See what Meta restricts for health and wellness data sources.

• Don't re-send the removed information by another route, such as a renamed parameter, a different event name or a server-side call. Meta says "You must not attempt to send data that has previously been detected and removed."
• Don't encode or hash a condition to get it past the filter. Hashing is the format Meta's API requires for some customer information parameters. It does not change what the data is or make it allowed.
• Don't ignore repeat notices. For blocked parameters, Meta says repeats can put a dataset into core setup "for at least 90 days".
• Don't rely on Meta's filter as your safeguard. Meta says "Meta's systems are not a substitute for your own compliance mechanisms."

Talk to Curve

Repeat notices are one route into core setup, so the time to fix the source is now. Curve's team will show you which fields your site sends to Meta and which are likely triggering the flag, then set up HIPAA-compliant conversion tracking with PHI-like patterns detected before data reaches Meta. To go through it with you and your developer, book a call with Curve.

Frequently asked questions

Sources

• Meta Business Help Center: Troubleshoot Meta Business Tools prohibited information notifications
• Meta Business Help Center: About prohibited information
• Meta Business Help Center: About core setup
• Meta Business Help Center: How to review blocked parameters in Meta Events Manager

Last verified September 28, 2026

Related pages

• Meta Core Setup for Health Businesses: What Still WorksMeta core setup strips custom parameters and everything after the domain. What still works for a health business, why it happened, and what to fix first.
• Meta Blocked My Custom Events Until I Review ThemWhy Meta blocks every custom event once a dataset has data restrictions, which events to confirm, which to keep blocked, and why renaming is not a fix.
• Meta Restricted Purchase Events for Health and WellnessWhy Meta restricts Purchase and other lower-funnel events for health and wellness sites, what still works in each tier, and the compliant way back.
• Does Server-Side Tracking Get Around Health Restrictions?No. Meta restricts health data by data source, not by route, and forbids re-sending removed data. Here is what server-side tracking is really for.
• Meta Conversions Stopped: Restriction or Broken Tracking?Meta conversions dropped. How to tell a data restriction from broken tracking or a page change, event by event, and which layer to fix first.
• Data Sharing Restrictions Applied in Meta: What It MeansSaw "Data sharing restrictions applied" in Events Manager, or an email saying your site is in a category with restrictions? What it means and what to do.