GLP-1 Advertising Rules in Late 2026: What Google and Meta Now Allow

As of July 2026, both Google and Meta permit GLP-1 advertising from licensed clinics and telehealth providers, but under significantly tighter certification and creative requirements than existed even 12 months ago. The glp-1 advertising policy 2026 landscape reflects two years of iterative platform enforcement following a surge of weight-loss clinic fraud complaints, compounding pharmacy shortages, and FTC scrutiny of misleading testimonials. If you run paid campaigns for a GLP-1 clinic or telehealth brand, the rules below govern what you can actually launch today.

TL;DR

• Google Ads now requires LegitScript certification plus a supplemental pharmacy attestation for any ad referencing semaglutide, tirzepatide, or their brand names.
• Meta restricts GLP-1 ad targeting to adults 25 and older and prohibits before-and-after imagery in the ad creative itself (landing pages with disclaimers are still permitted).
• Both platforms reject ads that reference compounded GLP-1 formulations unless the advertiser can demonstrate FDA-registered 503B outsourcing facility sourcing.
• Conversion tracking for GLP-1 campaigns must avoid transmitting protected health information (PHI) to ad platforms; server-side, PHI-stripped event delivery is the safest architecture.
• Violations carry escalating consequences: first-offense ad disapproval, second-offense campaign pause, third-offense account suspension with a 90-day appeal window on Google and 60 days on Meta.

What Changed in the Google Ads GLP-1 Rules During 2025-2026

Google began tightening healthcare and pharmaceuticals policies for weight-loss medications in mid-2025 after a wave of advertiser complaints and consumer protection filings. The google ads glp1 rules now in effect layer three distinct requirements on top of the standard Healthcare and Medicines policy.

LegitScript Certification Plus Pharmacy Attestation

Since Q4 2025, advertisers promoting GLP-1 medications must hold active LegitScript certification in the "Telemedicine" or "Healthcare Products" category. In early 2026, Google added a supplemental pharmacy attestation requiring advertisers to disclose their dispensing relationship: either a retail pharmacy, a 503B outsourcing facility, or a direct manufacturer fulfillment arrangement. Ads that do not include this attestation are now automatically disapproved during the review queue.

Keyword and Ad Copy Restrictions

Google restricts exact-match bidding on branded drug names (Ozempic, Wegovy, Mounjaro, Zepbound) to verified pharmaceutical manufacturers and their authorized agencies. Clinics may bid on broad-match and phrase-match queries containing these terms but cannot use the brand name in headline or description text unless they hold a manufacturer co-marketing agreement. Generic compound names (semaglutide, tirzepatide) remain available for use in ad copy by certified advertisers.

Landing Page Requirements

Google's policy reviewers now check GLP-1 landing pages for three elements: (1) a licensed prescriber disclosure with NPI or state license number, (2) clear pricing or a "request pricing" mechanism (no hidden cost structures), and (3) a notice that results vary and that the medication requires a prescription. Pages missing any of these elements trigger a policy disapproval. For more detail on building compliant pages that still convert, see our guide on GLP-1 Clinic Google Ads: HIPAA-Compliant Weight Loss Campaign Strategies That Convert.

Meta GLP-1 Ads Policy: Current State

Meta's approach differs from Google's in that it relies less on third-party certification and more on creative-level restrictions and audience controls. The meta glp1 ads policy as of mid-2026 operates under the Special Ad Category framework for health and wellness, with additional GLP-1-specific rules introduced in early 2026.

Audience and Targeting Limits

All GLP-1 ads on Meta platforms (Facebook, Instagram, Threads ads) must target users aged 25 and older. Interest-based targeting related to eating disorders, body dysmorphia, or adolescent health is explicitly excluded. Advertisers cannot use Custom Audiences built from website pixel events that indicate a user sought weight-loss treatment, because this constitutes health-condition targeting and risks transmitting PHI to Meta's systems.

Creative Restrictions

Meta prohibits before-and-after photos, body-transformation imagery, or weight-specific claims (such as "lose 20 pounds in 8 weeks") within ad creative. Landing pages may include such content if accompanied by FTC-compliant disclaimers, but the ad unit itself cannot. This rule is enforced through both automated image analysis and manual review. For a full breakdown of testimonial compliance, read our piece on GLP-1 Before-and-After Advertising Rules: FTC Requirements for Weight Loss Testimonials and Results.

Compounded GLP-1 Advertising on Meta

Meta's policy mirrors the FDA's enforcement posture: ads for compounded semaglutide or tirzepatide are rejected unless the advertiser can demonstrate (via the ad review appeal process) that the product comes from an FDA-registered 503B outsourcing facility and is being marketed during a verified shortage period. Given the FDA's 2026 crackdown on unauthorized compounders, this has become a high-rejection category. Our companion article on GLP-1 Compounded Pharmacy Marketing: 2026 FDA Crackdown and Advertising Rules covers the regulatory side in detail.

The HIPAA and Tracking Compliance Layer

Platform ad policies are only half the compliance picture. The other half is how you track conversions without violating HIPAA, the FTC Health Breach Notification Rule, or state laws like Washington's My Health My Data Act (MHMDA). HHS OCR's December 2022 guidance on online tracking technologies (updated in March 2024) made clear that standard client-side pixels on healthcare pages can transmit PHI (IP addresses, click IDs, page URLs containing health condition information) to advertising platforms without patient authorization.

For GLP-1 clinics, this means that a Meta pixel firing on a page titled "semaglutide-consultation-booking-confirmed" sends health information about that user to Meta. That transmission, absent a valid Business Associate Agreement (BAA) with the platform, is a HIPAA violation if the clinic is a covered entity or business associate. Google and Meta do not sign BAAs for their advertising products.

The compliant architecture is server-side conversion delivery with PHI stripping before the event reaches the ad platform. This preserves campaign optimization signals (conversion counts, values, timestamps) while removing identifiers that constitute PHI under the HIPAA Privacy Rule. Curve provides exactly this: a signed BAA, server-side event delivery to Google, Meta, and Microsoft, session-level analytics, and form tracking that never exposes PHI to third-party ad platforms.

What DTC Pharma Brands Face vs. Independent Clinics

The rules differ depending on advertiser type. Pharmaceutical manufacturers running direct-to-consumer campaigns for branded GLP-1 products must comply with FDA fair balance requirements, ISI (Important Safety Information) inclusion, and platform-specific pharma advertiser verification. Independent clinics and telehealth platforms face the LegitScript and attestation requirements described above but do not carry fair balance obligations unless they name the drug in a way that triggers product-claim classification. Our guide on Direct-to-Consumer GLP-1 Brand Advertising: Pharma DTC Rules for 2026 explains the distinction in depth.

Enforcement Patterns and Account Risks

Both Google and Meta have increased enforcement velocity for GLP-1 ads throughout 2026. Google's three-strike policy means that an account receiving three policy violations within a 90-day window faces suspension. Meta's threshold is lower for health-category ads; two rejected ads in 30 days can trigger a manual review of the entire ad account, pausing all active campaigns during the review period.

The most common triggers for enforcement actions in 2026 are: (1) using brand drug names in ad copy without manufacturer authorization, (2) promoting compounded formulations without 503B documentation, (3) making specific weight-loss claims without substantiation, and (4) running conversion pixels that transmit health data without proper consent mechanisms.

What to Do Now: Concrete Steps for GLP-1 Advertisers

Step 1: Verify Your LegitScript Status

If your certification is in the "Telemedicine" category, confirm it covers prescription medication advertising. If you only hold general healthcare certification, you may need to upgrade or add a supplemental category. LegitScript processing times have stretched to 4-6 weeks as of mid-2026 due to application volume.

Step 2: Complete Google's Pharmacy Attestation

Access this through your Google Ads account under Tools, then Policy Manager, then Healthcare Certifications. You will need to upload documentation showing your pharmacy relationship (DEA number, state pharmacy license, or 503B registration certificate).

Step 3: Audit Your Landing Pages

Ensure every GLP-1 landing page includes prescriber disclosure, pricing transparency, and a results-vary disclaimer. Remove or gate any before-and-after imagery behind a click-through interstitial if you are driving Meta traffic to those pages.

Step 4: Replace Client-Side Pixels with Server-Side Conversion Delivery

Remove Meta Pixel and Google Ads gtag.js from any page that reveals health-condition information. Replace with a server-side integration that strips PHI before sending conversion events. This protects you under HIPAA, MHMDA, and the FTC Health Breach Notification Rule simultaneously.

Step 5: Restructure Meta Audiences

Eliminate any Custom Audiences built from health-condition page visits. Switch to broad targeting with algorithm optimization or use first-party CRM lists that have been de-identified and consented for advertising use.

Step 6: Document Everything

Maintain a compliance file for each campaign containing: your LegitScript certificate, Google attestation confirmation, pharmacy source documentation, ad creative approvals, landing page screenshots with timestamps, and your tracking architecture diagram. If an account review occurs, having this documentation readily available shortens the resolution window significantly.

For advertisers ready to scale once compliance is locked in, our guide on Google Ads for GLP-1 Clinics: Weight Loss Campaign Optimization and Scaling covers bid strategies, audience segmentation, and budget allocation for compliant campaigns.

How Curve Fits Into This Stack

If you are running GLP-1 advertising on Google or Meta and need conversion tracking that does not put your practice at regulatory risk, Curve provides HIPAA-compliant analytics with a signed BAA, server-side conversion delivery that strips PHI before events reach ad platforms, HIPAA-safe session replay, form analytics, and full funnel visibility. The platform is purpose-built for healthcare marketers who need optimization data without the compliance exposure that standard pixels create.

Frequently Asked Questions

Can I still run Google Ads for my GLP-1 clinic in 2026?

Yes, but you must hold active LegitScript certification and complete Google's pharmacy attestation. You cannot use branded drug names (Ozempic, Wegovy, Mounjaro, Zepbound) in your ad copy unless you have a manufacturer co-marketing agreement. Generic names like semaglutide and tirzepatide are permitted for certified advertisers.

Does Meta allow before-and-after photos in GLP-1 ads?

No. As of early 2026, Meta prohibits before-and-after imagery, body-transformation photos, and specific weight-loss claims within the ad creative itself. You may include such content on your landing page if accompanied by FTC-compliant disclaimers, but the ad unit that appears in the feed cannot contain these elements.

Is it legal to advertise compounded semaglutide on Google or Meta?

Both platforms reject compounded GLP-1 ads unless you can document that the product comes from an FDA-registered 503B outsourcing facility and is marketed during a verified drug shortage period. Given the FDA's 2026 enforcement actions against unauthorized compounders, this is a high-risk category with frequent ad disapprovals.

Do I need a BAA with Google or Meta to run GLP-1 ads?

Google and Meta do not sign BAAs for their advertising products. This means you cannot send them data that qualifies as PHI under the HIPAA Privacy Rule. The compliant approach is to use server-side conversion tracking that strips PHI (IP addresses, health-indicating URLs, identifiers linked to health conditions) before the event reaches the ad platform.

What happens if my GLP-1 ad gets disapproved on Google?

A single disapproval can be appealed through Google's policy review process. However, three policy violations within 90 days trigger an account-level warning, and continued violations can lead to full account suspension with a 90-day appeal window. Address disapprovals immediately and document your compliance measures before resubmitting.

How do I track GLP-1 ad conversions without violating HIPAA?

Use a server-side conversion tracking platform that holds a signed BAA with your organization and strips all PHI before delivering conversion events to ad platforms. This preserves optimization signals (conversion counts, timestamps, values) while removing the identifiers that create HIPAA liability. Platforms like Curve are designed specifically for this use case in healthcare marketing.