On this page
The biggest health marketing compliance changes between October 27 and November 2, 2026 were HHS's peptide compounding policy (Federal Register), ChatGPT Ads turning on automatic creative changes (OpenAI), Meta's account rules for scam-like behavior (Meta), Google's multiturn ads in AI Mode (Google), Bing's new AI training and grounding settings (Bing) and Delaware's HB 380, which takes effect January 1, 2027 (bill text). This roundup is from Curve Compliance, which sends healthcare conversions to ad platforms server-side and signs a BAA on every plan.
Book a call. Not sure which of these touches your campaigns? Curve's team will review what your site sends to Meta, Google and TikTok with you and show what's likely triggering a flag. Book a call with Curve.
Early November 2026 at a glance
| Date | What changed | Source |
|---|---|---|
| Nov 20 | Meta's updated Commercial Terms take effect, per its preview page | Meta |
| Oct 29 | Meta may disable accounts for scam-like behavior | Meta |
| Oct 30 | ChatGPT Ads creative enhancements on by default | OpenAI |
| Oct 28 | Google launches multiturn ads in AI Mode (U.S.) | |
| Oct 30 | Bing AI Training and AI Grounding preferences | Bing |
| Oct 30 | Google plans to read a shared AI training opt-out | |
| Oct 30 | HHS peptide compounding policy; comments to Nov 13 | Federal Register |
| Oct 29 | OCR ransomware settlement with Lehigh Valley | HHS |
| Oct 21 | No 2026 HIPAA penalty inflation adjustment | Federal Register |
| Oct 29 | FTC warning letters to health plan marketers | FTC |
| Jan 1, 2027 | Delaware HB 380 takes effect | Delaware |
Ad platforms
Still set for November 20: Meta's updated Commercial Terms
Meta's preview page still says: “These updates will go into effect on November 20, 2026” (Meta). Checked November 2, 2026.
What it means for your ads or tracking: Check the preview page before you plan around November 20. Its Data Restrictions clause still bars sending information that “includes health, financial, biometrics, or other categories of similarly sensitive information” (Meta). See Meta Business Tools Terms and health data.
October 29: Meta adds account rules for scam-like behavior
Meta's Prohibited Commercial Practices standard, whose change log lists an update dated October 29, 2026, now says: “We may disable accounts or restrict access to products and features (e.g. the ability to message certain accounts) based on a combination of behaviors such as sending unsolicited messages to people who you do not follow, deliberately misrepresenting your location, or being an admin of communities (e.g. Pages) we have removed for violating our scam policies” (Meta).
What it means for your ads or tracking: Review who admins your Pages. See Meta unacceptable business practices.
October 30: ChatGPT Ads turns on creative enhancements
OpenAI says: “Starting Friday, October 30, 2026, creative enhancements will be enabled automatically for new and existing campaigns.” Headlines and descriptions can change, and “The destination URL may be optimized to direct people to a relevant page on your website.” OpenAI adds: “You do not need to review or approve each enhanced version before it runs” and “Existing account- and campaign-level opt-outs are preserved” (OpenAI).
What it means for your ads or tracking: Decide campaign by campaign whether to keep it on. See ChatGPT Ads creative enhancements.
October 28: Google launches multiturn ads in AI Mode
Google says: “To allow ads in follow-up queries in AI Mode, we are launching multiturn ads in the U.S.” (Google). Its help page says “Existing Search, Shopping, and Performance Max campaigns are automatically eligible to serve ads within AI Overviews and AI Mode” (Google Ads Help).
What it means for your ads or tracking: See Google AI Mode and AI Overviews ads for healthcare.
Effective October 16: Google's privacy policy and connected apps
Google's privacy policy, “Effective October 16, 2026,” lets content from Drive, Gmail and Google Photos shape personalized ads when a user chooses to share it, and still says “We don't show you personalized ads based on sensitive categories, such as race, religion, sexual orientation, or health” (Google).
What it means for your ads or tracking: Health stays excluded from personalized ads.
AI search
October 30: Bing replaces NoArchive and NoCache
Microsoft says its new AI Training and AI Grounding preferences “will replace existing Microsoft preferences NoArchive and NoCache for training and grounding.” “Starting February 1, 2027, Microsoft will honor the new preferences as it crawls,” and sites that use the old tags should act by March 1, 2027, because “after that date, NoArchive and NoCache will no longer be read as a preference for training or grounding” (Bing).
What it means for your ads or tracking: Bing warns that blocking grounding means “reduced brand visibility in AI experiences.” Full setup: AI training and grounding controls for health sites.
October 30: Google plans to read a shared AI training opt-out
Google says: “When a website uses this policy token to opt out of training in its robots.txt file (and Google-Extended is not explicitly specified), Google plans to interpret that as if the publisher had disallowed Google-Extended.” It adds: “Websites that specifically allow Google-Extended are eligible to appear in responses and receive clicks via grounding in Gemini Apps” (Google).
What it means for your ads or tracking: Once Google supports the shared token (it aims for 2027), opting out of training with it alone would also drop Gemini Apps grounding, unless you allow Google-Extended by name (Google).
Regulators
October 30: HHS publishes its peptide compounding policy
HHS says it “does not intend to take enforcement action against a State-licensed pharmacy, Federal facility, or licensed physician compounding a drug product using a peptide bulk drug substance found in Appendix A,” which lists BPC-157, Epitalon, KPV, MOTS-c, Semax and TB-500 (Federal Register; HHS policy). Regulations.gov lists the comment period as ending November 13, 2026, at 11:59 p.m. Eastern (docket HHS-OASH-2026-0496).
What it means for your ads or tracking: Ad platforms still apply their own rules to peptide ads. See BPC-157 and HHS's peptide policy.
October 29: OCR settles with Lehigh Valley Health Network
OCR announced that Lehigh Valley Health Network “paid $800,000 to OCR” and agreed to a three-year corrective action plan, after a ransomware attack, OCR's 22nd ransomware enforcement action (HHS).
What it means for your ads or tracking: It is a security case, not a marketing one. OCR's first listed finding was a failure to conduct a thorough risk analysis.
October 21: no 2026 HIPAA penalty adjustment
HHS says it “will continue to use the 2025 civil monetary penalty levels because there will be no cost-of-living adjustment for 2026” (Federal Register).
What it means for your ads or tracking: The amounts in the HIPAA penalties reference table still apply.
October 29: FTC warns health plan marketers
FTC staff are “sending warning letters to 25 companies that market or generate sales leads for healthcare plans,” and “The agency expects to send additional letters on a rolling basis.” The FTC says “The letters do not allege any wrongdoing by any of the recipients” (FTC).
What it means for your ads or tracking: If you market plans or buy plan leads, review what your ads say about coverage and costs.
Still pending: OMB's review list on November 2, 2026 still shows the HIPAA Privacy Rule final rule (since April 2, 2026) and DEA's telemedicine registration rule (since August 25, 2026) (OIRA). For DEA, see the DEA telemedicine rule guide.
States
Coming January 1, 2027: Delaware HB 380
Delaware's bill page shows HB 380 as “Signed 9/2/26” (Delaware). The enacted text says “This Act is effective January 1, 2027,” lowers the main threshold from 35,000 to 10,000 consumers, and adds health “condition, diagnosis, treatment, or status” and “inferences made based on personal data, alone or in combination with other data, that are used to reveal or identify” them to sensitive data (engrossed bill).
What it means for your ads or tracking: Ad pixels on service pages may raise that question, so talk to your counsel about your site. Guide: Delaware privacy law 2027.
Courts
Four tracking settlements have official sites with open deadlines. Each defendant denies wrongdoing.
| Case | What the settlement site says | Key dates | Source |
|---|---|---|---|
| Tenet Healthcare (Jane Doe v. AMISUB (SFH), Shelby County, TN) | Its “use of third-party tracking technologies, called "tracking pixels," on its web pages” | Opt-out and objection Dec 21, 2026; hearing Jan 14, 2027; claims Mar 15, 2027 | Settlement site |
| USC Arcadia Hospital (Merle, LA Superior Court) | “the Meta Pixel and other tracking technologies on its public-facing website” | Claims, opt-out and objection Dec 7, 2026; hearing Dec 14, 2026 | Settlement site |
| GoodRx | Plaintiffs allege disclosure “to advertising and analytics companies” between at least 2017 and 2020 | Claims “on or before 11:59 p.m. Eastern Time on December 29, 2026” | Settlement site |
| Prime Healthcare (Doe v. Prime Healthcare Services, LA Superior Court) | “third-party tracking technologies, called "tracking pixels," on its web pages” | Claims and opt-out Dec 21, 2026; objection Jan 20, 2027; hearing Mar 9, 2027 | Settlement site |
See pixel settlements to date for earlier cases and the October 2026 edition for September 17 to October 26.
How Curve Compliance helps
Most of these changes come down to what your site sends to ad platforms. Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, with a fixed list of fields for each. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Contact identifiers are off by default on Meta, Google Ads and TikTok, and Event Logs show what Curve sent and what each platform accepted.
When a platform flags something, Curve's team reviews what your site sends with you and shows what's likely triggering a flag. Curve's consent management holds back tracking until each visitor's choice allows it and honors Global Privacy Control in every region, and the free website scan lists the pixels and trackers on a page. Curve signs a BAA on every plan; setup is done by Curve's team.
Sources, checked November 2, 2026: Meta terms preview and Prohibited Commercial Practices; OpenAI Help; Google AI Mode post, Ads Help, privacy policy, and AI training post; Bing; Federal Register 2026-22192, and 2026-21524; Regulations.gov; HHS; FTC; OIRA; Delaware bill page and engrossed bill; settlement sites for Tenet, USC Arcadia, GoodRx and Prime Healthcare.
Frequently Asked Questions
What changed in health marketing compliance in November 2026?
Between October 27 and November 2, 2026, HHS published a peptide compounding policy, ChatGPT Ads turned on creative enhancements by default, and Bing announced AI training and grounding settings that replace NoArchive and NoCache (Federal Register; OpenAI; Bing). Delaware's HB 380 takes effect January 1, 2027 (Delaware).
Is Meta's November 20, 2026 terms update still happening?
Meta's preview page still says “These updates will go into effect on November 20, 2026” as of November 2, 2026 (Meta). Check the page again before you plan around that date.
What did HHS change for peptide compounding?
HHS said it does not intend to take enforcement action against state-licensed pharmacies, federal facilities or licensed physicians that compound six listed peptides, including BPC-157 and TB-500, when the policy's conditions are met (Federal Register; HHS policy). See the peptide policy guide.
Did ChatGPT Ads start changing ads automatically?
Yes. Since October 30, 2026, creative enhancements are on by default for new and existing campaigns, and earlier opt-outs are kept (OpenAI). You can change the setting in Ads Manager.
Did HIPAA penalties go up in 2026?
No. HHS said it will keep using the 2025 civil monetary penalty levels because there is no cost-of-living adjustment for 2026 (Federal Register).
Which health pixel settlements are open for claims?
Tenet Healthcare (claims by March 15, 2027), USC Arcadia Hospital (December 7, 2026), Prime Healthcare (December 21, 2026) and GoodRx (December 29, 2026) (Tenet; USC Arcadia; Prime; GoodRx).
Talk to Curve Compliance
Book a call. Want to know which of these changes affects your tracking? Curve Compliance sends conversions server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.