GLP-1 Side Effect Disclosure in Healthcare Ads: FTC and FDA Requirements

On September 9, 2025, the FDA issued a warning letter to Eli Lilly over a high-profile Oprah Winfrey television special that promoted Zepbound and Mounjaro. ^[1]The FDA determined the promotional video was false or misleading because it omitted key risk information, including the boxed warning regarding thyroid C-cell tumors and the contraindication for patients with a personal or family history of medullary thyroid carcinoma or Multiple Endocrine Neoplasia syndrome type 2. The same wave of enforcement targeted dozens of telehealth marketers of compounded semaglutide and tirzepatide. Combined with the FTC's December 2025 final order against NextMed and a wave of multi-million-dollar pixel-tracking settlements, the regulatory perimeter around weight loss advertising has tightened dramatically.

This guide explains GLP-1 side effect disclosure obligations under both FTC and FDA rules, the specific ad requirements that apply to clinics and telehealth companies, and the tracking compliance gaps that turn lawful campaigns into HIPAA enforcement targets.

The Current Enforcement Landscape

FDA Crackdown on DTC GLP-1 Advertising and Side Effect Disclosure

The FDA has entered what commentators describe as a new era of proactive enforcement against direct-to-consumer pharmaceutical advertising. ^[2]According to Latham & Watkins, the September 9 enforcement letters were issued at the center level by CDER and CBER and signed at the director level, a departure from prior practice that signals elevated agency attention. The same analysis notes the FDA has announced its intention to conduct rulemaking that would require broadcast advertisements to present a brief summary of side effects, contraindications, and effectiveness, closing the so-called "adequate provision" loophole.

The Eli Lilly warning letter is instructive on GLP-1 side effect disclosure standards. The FDA found that a physician featured in the Oprah video minimized serious risks by characterizing them in ways the agency cited as misleading, and that the video failed to convey the boxed warning and contraindications carried in the Zepbound prescribing information.

FTC Action on GLP-1 Weight Loss Marketing

^[3]On December 3, 2025, the FTC gave final approval to an order against telemedicine company NextMed and its principals, requiring them to stop deceptively advertising weight-loss programs and end deceptive billing practices. ^[4]Covington's Inside Privacy analysis reports that NextMed agreed to pay $150,000 to settle charges that included unsubstantiated weight-loss claims, fake testimonials, and inadequate disclosure of membership terms. The FTC alleged the company lacked a reasonable basis for advertising that members lost an average of 53 pounds and 23% of body weight because NextMed did not maintain records of members' actual weight loss.

For deeper analysis of how this case reshapes claim substantiation standards, see our companion guide on GLP-1 clinic marketing after NextMed.

Dual Jurisdiction: FTC and FDA Overlap

The FDA regulates prescription drug promotion under the FD&C Act, including risk disclosure and fair balance. The FTC regulates the broader weight-loss program advertising market under Sections 5 and 12 of the FTC Act, focusing on substantiation, testimonials, and pricing transparency. A clinic or telehealth operator advertising GLP-1 access typically falls under both regimes simultaneously.

HIPAA Tracking Enforcement

^[5]HHS OCR's official guidance is unambiguous: regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors. ^[6]An $18.4 million class settlement resolved claims against Mass General Brigham over the use of cookies, pixels, and website analytics tools without obtaining the consent of website visitors. ^[7]Advocate Aurora Health agreed to pay $12.2 million to settle a proposed class action alleging it disclosed the personal health information of more than 2.5 million people to Meta and Google without their consent.

Specific Risks and Consequences

Financial Penalties

GLP-1 advertisers face stacked exposure across multiple regimes:

FDA enforcement: Warning letters demand immediate cessation; failure to comply can lead to seizure, injunction, and criminal misbranding referrals.
FTC civil penalties: The NextMed consent order required $150,000 in consumer refunds plus injunctive relief; larger operators face proportionally higher exposure.
HIPAA civil money penalties: ^[8]Per the August 8, 2024 Federal Register final rule, HHS adjusted civil monetary penalty amounts for inflation, applicable to penalties assessed on or after August 8, 2024 for violations occurring on or after November 2, 2015. ^[9]HIPAA Journal's published table places per-violation penalties ranging from $141 to $2,134,831, with a calendar-year cap of $2,134,831 per identical provision.
Class-action settlements: Recent pixel-tracking class actions against HIPAA-regulated entities have settled in the multi-million-dollar range, including the $18.4 million Mass General Brigham resolution and the $12.2 million Advocate Aurora resolution.
State AG penalties: ^[10]The New York Attorney General secured $300,000 from NewYork-Presbyterian Hospital after finding the hospital used advertising tools on its website that collected and shared private and personal information with third-party tech companies in violation of HIPAA.

Reputational Damage

Breaches affecting 500 or more individuals are posted to OCR's public breach portal, often called the "Wall of Shame." FDA warning letters are published on FDA.gov and indexed by major news outlets within hours. For consumer-facing weight loss clinics, a single FTC complaint can permanently alter Google search results for the brand name.

Operational Disruption

When OCR enters a resolution agreement, corrective action plans typically impose multi-year obligations including policy updates, technical remediation, workforce training, reporting, and monitoring. In the NewYork-Presbyterian matter, the corrective requirements alongside the financial penalty included updating policies, securing the deletion of PHI held by third parties, and maintaining enhanced privacy safeguards.

Personal Liability

Criminal HIPAA enforcement targets knowing misuse or disclosure of PHI, with penalty tiers escalating from knowing violations to offenses involving false pretenses or commercial advantage. The FTC's NextMed order named the company's founders personally, demonstrating that principals can be bound individually by injunctive relief.

What FDA and FTC Actually Require for GLP-1 Side Effect Disclosure

FDA Risk Disclosure Elements for GLP-1 Ads

For DTC advertising of approved GLP-1s, the FDA expects a "major statement" of the drug's most important risks plus access to full prescribing information. Based on the Zepbound warning letter and prescribing information, advertisements must address:

Boxed warning: Risk of thyroid C-cell tumors, with contraindication for patients with a personal or family history of medullary thyroid carcinoma or Multiple Endocrine Neoplasia syndrome type 2.
Serious adverse reactions: Severe gastrointestinal events, acute kidney injury, acute gallbladder disease, acute pancreatitis, hypersensitivity reactions including anaphylaxis and angioedema, hypoglycemia, and diabetic retinopathy complications.
Common side effects: Nausea, diarrhea, vomiting, constipation, abdominal pain, and injection site reactions, among other reactions identified in the approved labeling.
Coadministration limits: Not for use with other GLP-1 receptor agonists.
Fair balance: Risk information presented with comparable prominence to efficacy claims, never minimized or characterized as overhyped.

FTC Requirements for Weight Loss Program Ads

The FTC's NextMed action codifies what regulators expect from any clinic or telehealth company selling GLP-1 access:

Substantiated claims: Competent and reliable evidence to support claims about average or typical results, including documented outcomes rather than reliance on clinical trial averages alone.
Truthful testimonials: No fake reviews, no sourced before-and-after photos that do not reflect actual customers, and disclosure of any material connection between the company and reviewer.
Complete pricing disclosure: Monthly membership prices must clearly state whether they include the GLP-1 drug, required lab work, and provider consultations.
Cancellation transparency: Clear disclosure of minimum commitments and a simple cancellation path.

For testimonial and before-and-after specifics, our deep dive on GLP-1 before-and-after advertising rules covers documentation standards in detail. Compounded GLP-1 marketers face an additional layer of restrictions covered in our compounding pharmacy GLP-1 advertising guide.

How GLP-1 Side Effect Disclosure and Tracking Violations Happen

Technical Configurations

The most common HIPAA tracking violations stem from default-configured Meta Pixel, Google Analytics 4, and form-tracking widgets that transmit URLs containing condition keywords (for example, paths like "/weight-loss/semaglutide-consultation") alongside hashed identifiers. The NewYork-Presbyterian investigation found the hospital used third-party tools that sent information whenever a webpage loaded or a user took a predefined action like clicking a link, submitting a form, or running a search.

Vendor Relationships

HHS OCR's official guidance is unambiguous: regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors. If a tracking vendor will not sign a BAA, regulated entities must restructure the data flow so that PHI is not transmitted, typically through an intermediary that de-identifies the data before any onward disclosure.

Staff Actions

Most tracking violations originate not in malicious conduct but in routine marketing operations: a paid ads manager installs a new Meta Pixel for a semaglutide campaign, a developer adds a Google Tag Manager container, or a social team launches a landing page outside the standard CMS. Each action can create an impermissible PHI disclosure within minutes of going live.

Audit Triggers

Common triggers include patient complaints, breach notifications affecting 500+ individuals, whistleblower reports, and state AG investigations. ^[11]Phelps notes that state attorneys general have entered the enforcement arena, with the NewYork-Presbyterian settlement serving as a template, and that Meta has faced more than 50 class action lawsuits tied to pixel-related health data disclosures.

Protection Strategies

Immediate Actions (This Week)

Audit every page that mentions GLP-1, semaglutide, tirzepatide, Wegovy, Ozempic, Zepbound, or Mounjaro for active tracking pixels.
Confirm BAA status for every analytics, advertising, and CRM vendor receiving data from healthcare properties.
Pull a sample of ad creative and landing pages and confirm major-statement risk disclosure appears with comparable prominence to efficacy claims.
Document the substantiation file behind every weight-loss claim (average results, typical results, percentages).

Short-Term Fixes (This Month)

Remove client-side pixels from authenticated patient pages and replace with server-side, PHI-stripped tracking.
Update privacy policies to accurately describe analytics and advertising data flows.
Add boxed warning and contraindication language to all GLP-1 landing pages to satisfy GLP-1 side effect disclosure expectations.
Train marketing staff on the NextMed factors: substantiation, testimonials, pricing, cancellation.

Long-Term Compliance Infrastructure

Server-side tracking with PHI filters: Move conversion measurement off the browser and into a controlled server environment where PHI can be stripped before transmission.
Signed BAAs across the stack: Every vendor touching identifiable healthcare data needs a BAA or must operate exclusively on de-identified data.
Quarterly tracking audits: Tag manager containers drift; routine scanning catches new pixels before regulators do.
Substantiation library: A standing repository of evidence supporting every claim, refreshed with each campaign.

For platform-specific guidance on Meta campaigns, see our analysis of GLP-1 clinic Meta ads, and for virtual program operators, our GLP-1 telehealth marketing compliance guide.

How Curve Addresses GLP-1 Advertising Risk

Curve is a HIPAA-compliant tracking infrastructure designed for the exact failure modes that have produced substantial pixel-tracking penalties and class settlements against healthcare advertisers in recent years:

Automated PHI stripping: Curve intercepts conversion events before they reach Meta, Google, TikTok, or other advertising platforms and removes identifiers, condition keywords, and form contents that could constitute PHI under HIPAA.
Server-side tracking: Conversion data flows through Curve's server-side infrastructure rather than browser-resident pixels, eliminating the client-side disclosure vector that OCR has prioritized in investigations.
Signed BAAs: Curve executes Business Associate Agreements with every healthcare client, satisfying the BAA requirement that disqualifies most native ad-platform pixels.
Audit trails: Every event, transformation, and transmission is logged, producing the documentation OCR expects during investigation.
Healthcare-specific design: Curve is purpose-built for the GLP-1, telehealth, behavioral health, and medspa verticals that are squarely in the FTC and FDA crosshairs, including GLP-1 side effect disclosure workflows for landing pages.

Compliance Self-Assessment Checklist

Every GLP-1 ad and landing page includes the boxed warning for thyroid C-cell tumors and MTC/MEN 2 contraindications
Risk information appears with comparable prominence to efficacy claims (no minimizing language)
Common adverse reactions (nausea, vomiting, diarrhea, pancreatitis risk) are disclosed in the major statement
All weight-loss outcome claims are supported by documented patient records, not borrowed clinical trial averages
Testimonials are from actual patients, with material connections disclosed
Before-and-after photos are of real customers who used the advertised program
Membership pricing clearly discloses what is and is not included (drug cost, labs, consults)
Cancellation terms and minimum commitments are conspicuously disclosed before checkout
Every tracking pixel on healthcare pages has a corresponding signed BAA or operates on de-identified data only
Server-side tracking with PHI stripping is in place for conversion measurement
Quarterly tag audits are scheduled and documented
Workforce training on FTC and FDA requirements is current

Frequently Asked Questions

What are the penalties for HIPAA marketing violations involving GLP-1 ads?

HIPAA civil money penalties were adjusted on August 8, 2024 to range from $141 to $2,134,831 per violation, with an annual cap of $2,134,831 per identical provision per the HHS inflation-adjustment final rule. State attorneys general impose additional penalties (NewYork-Presbyterian paid $300,000 to the New York AG), and class-action settlements have reached substantial multi-million-dollar levels in pixel-tracking cases involving major health systems. Criminal HIPAA penalties for knowing violations include fines and imprisonment, escalating for offenses involving false pretenses or commercial advantage.

Can healthcare practices be sued for using Meta Pixel on GLP-1 landing pages?

Yes. Pixel tracking class actions and regulatory settlements have produced substantial penalties against U.S. healthcare providers in recent years, including the multi-million-dollar Advocate Aurora and Mass General Brigham resolutions referenced above. Any GLP-1 landing page that transmits condition-identifying URLs or form fields to Meta without a BAA creates litigation exposure.

How do I know if my GLP-1 marketing is FDA-compliant?

Compare every ad and landing page against the approved prescribing information. Advertisements must include the boxed warning for thyroid C-cell tumors, contraindications for medullary thyroid carcinoma and MEN 2 syndrome, warnings about pancreatitis, gallbladder disease, kidney injury, and hypersensitivity reactions, and common adverse events. Risk information must be presented with comparable prominence to benefit claims. Promotional materials should also be submitted to FDA's Office of Prescription Drug Promotion on Form FDA-2253 where required.

What should I do if I discover a GLP-1 advertising compliance violation?

Document the issue and timeline of discovery, pause the affected campaigns immediately, conduct a root-cause analysis, remediate the technical or content failure, and consult healthcare regulatory counsel about breach notification obligations. OCR weighs the speed and completeness of remediation when assessing culpability; corrected willful neglect carries lower exposure than uncorrected willful neglect.

Do compounded GLP-1 marketers face different rules than brand-drug advertisers?

Yes. Compounded GLP-1s are not FDA-approved, so marketers cannot claim equivalence to brand-name Ozempic, Wegovy, Mounjaro, or Zepbound. The FDA has issued warning letters to online sellers of compounded semaglutide and tirzepatide alleging unlawful marketing of unapproved and misbranded drugs.

Don't Wait for Enforcement

Every day without compliant tracking and disclosure is a day of risk exposure. Schedule a Compliance Assessment with Curve to map your current GLP-1 advertising stack against FTC, FDA, and HIPAA requirements before regulators or plaintiffs map it for you.

Sources

GLP-1 Side Effect Disclosure in Healthcare Ads: FTC and FDA Requirements

Stay Compliant. Scale Confidently.