Microsoft Advertising turned off remarketing and audiences for our healthcare account

What Microsoft turns off, and why

Microsoft says "UET uses multiple layers of filtering, scrubbing, and governance to help prevent sensitive data from entering personalization or targeting workflows." For a healthcare advertiser, three of those layers matter:

• The vertical setting. Selecting Healthcare/Pharma at setup turns remarketing and audience features off automatically.
• Domain classification. Microsoft's classifier identifies healthcare and pharmaceutical domains, and events from those domains are excluded from personalization.
• HIPAA filtering. "A dedicated HIPAA filter flags and removes events connected to health-related content." Microsoft adds that "Health-related UET events are kept only for a short compliance window before they're removed."

What Microsoft asks healthcare advertisers to do

Under Advertiser responsibilities, Microsoft lists:

• "Do not include any personally identifiable information (PII) or protected health information (PHI) in custom parameters."
• "Do not place UET tags on pages subject to HIPAA regulations."
• "Use consent management solutions where required, including support for the Transparency and Consent Framework (TCF)."
• "Use available validation tools to confirm that tags are implemented correctly and meet compliance requirements."

Microsoft doesn't sign a BAA for UET

Microsoft is direct about it: "Microsoft does not offer Business Associate Agreements (BAAs) for UET and does not represent that UET meets HIPAA requirements." It also says "Advertisers subject to HIPAA must not use UET in ways that could expose Microsoft to PHI." More on that in does Microsoft Advertising sign a BAA?

Its healthcare ad policy says the same about targeting. Advertisers commit to "Not targeting consumers based on sensitive health information", and ads that promote prescription drugs must "Not target users based on sensitive health information."

What still works

1. Build campaigns on search intent: keywords, ad copy and locations. None of those depend on remarketing lists or audiences.
2. Keep UET off pages subject to HIPAA, as Microsoft asks. Patient portals and intake forms are the usual examples.
3. Send conversions without health details. Curve Compliance sends Microsoft Advertising conversions server-side with a fixed list of fields and neutral event names, and detects PHI-like patterns such as condition names, form answers and emails in URLs before data reaches an ad platform.
4. If you send identifiers for attribution, hash them. Microsoft's enhanced conversions exception covers "hashed email addresses (HEM) and hashed phone numbers", which "are used only for estimated conversion modeling and attribution, not for personalization." Curve Compliance keeps contact identifiers off by default and SHA-256 hashes them when they are enabled.
5. Judge campaigns on booked appointments. Curve Compliance's Campaign Reporting puts Microsoft ad spend next to Curve-tracked conversions per campaign, so you can steer budget without audience data.

What not to do

• Don't change the account's vertical away from Healthcare/Pharma to get audiences back. Microsoft also classifies healthcare and pharmaceutical domains with its own classifier, and misstating the business creates a bigger problem than lost audiences.
• Don't build remarketing lists from condition or treatment pages, or upload patient lists as audiences. Microsoft says advertisers "may not associate any additional personal data with their remarketing lists or UET tags".
• Don't expect server-side delivery to bring audiences back. It changes what is sent and how, not Microsoft's rules. See why server-side tracking doesn't lift a restriction.

Talk to Curve

Without audiences, clean conversion data is what keeps Microsoft campaigns optimizing. Curve's team replaces the browser tag with server-side conversions to Microsoft Advertising and your other platforms, with a fixed list of fields, neutral event names and PHI-like pattern detection, and Event Logs show what Curve sent and what Microsoft accepted. Setup is typically live in about a week, with a BAA signed on every plan. Book a call with Curve.

Frequently asked questions

Sources

• Microsoft Advertising Help: UET technical safeguards for sensitive data
• Microsoft Advertising Help: Healthcare and Pharmaceutical Ad Policy
• Microsoft Advertising Help: Privacy and Personalization

Last verified October 5, 2026

Related pages

• Microsoft Ads Disapproved Telehealth Ads? Preapproval GuideMicrosoft Advertising disapproved your telehealth ads? Why prescription services need preapproval, the US accreditation rules, and how to request an exception.
• Microsoft Ads Weight Loss Policy: Why Ads Get DisapprovedWeight loss or GLP-1 ads disapproved on Microsoft Advertising? What the weight loss policy prohibits, the 18+ and consult rules, and how to fix the ads.
• Google Ads Personalized Advertising Policy: Health AudiencesWhat Google's sensitive health targeting notice means, which audiences health advertisers can't use, what still works, and how to fix the ad.
• Meta Removed Health Targeting Options: What Clinics Can UseMeta removed detailed targeting options tied to health causes in January 2022. What a clinic can still target on Facebook and Instagram, and what to avoid.
• Does Server-Side Tracking Get Around Health Restrictions?No. Meta restricts health data by data source, not by route, and forbids re-sending removed data. Here is what server-side tracking is really for.
• Meta Core Setup for Health Businesses: What Still WorksMeta core setup strips custom parameters and everything after the domain. What still works for a health business, why it happened, and what to fix first.