Healthcare Marketing Compliance Calendar 2027: Key Dates

The healthcare marketing compliance deadlines in 2027 start on January 1, when California's browser opt-out signal law and automated decisionmaking (ADMT) rules apply and privacy laws take effect in Oklahoma and Louisiana, and run through July 2027, which HHS's agenda lists for a final HIPAA Security Rule, to December 31, 2027, the CCPA deadline for risk assessments on older processing and the last day of Medicare's telehealth extension. Each row below links its primary source and quotes its status. Curve Compliance helps you get ad tracking ready for these dates: it strips PHI before data reaches an ad platform, runs consent management and signs a BAA on every plan.

Book a call. Want a date-by-date look at what your site sends to Meta, Google and TikTok? Curve Compliance's team reviews it with you. Book a call with Curve.

The 2027 calendar at a glance

Targets and pending dates can move; check the linked source before you plan.

Date	Change and primary source	Status, in the source's words	What to check
November 20, 2026	Meta Commercial Terms update (Meta)	"These updates will go into effect on November 20, 2026."	Crawler access; Business AI agents
December 31, 2026	DEA telemedicine flexibilities, 21 CFR 1307.41 (eCFR)	"in effect until the end of the day December 31, 2026"	Prescribing claims in telehealth ads
January 1, 2027	California AB 566, browser opt-out signal (bill)	"Chapter 465, Statutes of 2025" (status); "operative on January 1, 2027"	Honoring opt-out signals
January 1, 2027	Oklahoma SB 546 (enrolled text)	"Approved by Governor 03/20/2026" (status); "This act shall become effective January 1, 2027."	Consent for sensitive data; HIPAA preemption
January 1, 2027	Louisiana SB 386 (digest)	"Signed by the Governor. Becomes Act No. 502."; "Effective date 1/1/2027." (status)	Consent for sensitive data; HIPAA preemption
January 1, 2027	CCPA ADMT rules, 11 CCR 7200(b) (regulations)	"no later than January 1, 2027"	Automated intake decisions
January 1, 2027	California SB 690, CIPA (bill)	"Chapter 976, Statutes of 2026"; "Non-Urgency" (status); effective date set by the constitution	Pen register claims
January 21, 2027	Meta removes Graph API v21.0 (changelog)	"Graph API v21.0 is deprecated and removed."	API version and SDK
Decision pending	Salazar v. Paramount Global, No. 25-459, VPPA (docket)	"Argued." on October 14, 2026; no decision listed	Video pages with ad pixels
July 2027 (target)	HIPAA Security Rule final rule (agenda)	"Final Action 07/00/2027"; the 2025 text is a "Proposed Rule"	Network map; rule status
December 31, 2027	CCPA risk assessments, 11 CCR 7155(b) (regulations)	"no later than December 31, 2027"	Risk assessments
December 31, 2027	Medicare telehealth flexibilities (HHS)	extended "through December 31, 2027"	Telehealth campaigns
January 1, 2028	Vermont Act 145, S.71 (Act)	"Signed by Governor June 16, 2026" (status); "This act shall take effect on January 1, 2028."	Consumer health data; HIPAA preemption

Before 2027: November 20 and December 31, 2026

Meta's updated Commercial Terms take effect November 20, 2026. A new clause lets Meta "use automated software (such as web scrapers, bots, robots, spiders, crawlers, and user agents) and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl" the pages associated with your products or services, and the update brings in terms that "apply when you access and use Meta Business Agent" (Meta). See our guides on AI crawlers, Meta Business AI and Meta's Business Tools Terms.

The DEA's telemedicine flexibilities in 21 CFR 1307.41 are "in effect until the end of the day December 31, 2026" (eCFR). See the DEA rule guide.

January 2027: opt-out signals, two state laws, ADMT and SB 690

Opt-out signals. California's AB 566 says "A business shall not develop or maintain a browser that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal," from January 1, 2027 (AB 566). Chrome's status page for Global Privacy Control shows "No milestones specified" and notes that Chrome "allows to send GPC header only via an extension" (Chrome Platform Status). A business under the CCPA already "must display whether it has processed the consumer's opt-out preference signal as a valid request to opt-out of sale/sharing on its website" (11 CCR 7025(c)(6)). See the GPC guide.

Oklahoma and Louisiana. Oklahoma's SB 546 defines "Sensitive data" to include personal data revealing a "mental or physical health diagnosis," and a controller may not "Process the sensitive data of a consumer without obtaining the consumer's consent." It does not apply to "A covered entity or business associate" under the HIPAA rules, and it exempts PHI (enrolled SB 546). Louisiana's Act 502 takes effect the same day. Its official digest says it bars "processing the sensitive data of a consumer without obtaining the consumer's consent" and exempts "entities governed by the privacy and security rules" (résumé digest). See the Oklahoma and Louisiana guide.

ADMT. California's rules cover a "significant decision," one "that results in the provision or denial of" listed services, including "healthcare services." They add: "Significant decision does not include advertising to a consumer." A business that used ADMT for such a decision before 2027 "must be in compliance with the requirements of this Article no later than January 1, 2027" (11 CCR 7001(ddd), 7200(b)). See the ADMT and eligibility quiz guide.

SB 690. A suit against a private actor under Penal Code 638.51 over conduct on "an internet website, online application, or mobile application" "may be brought under this section only by the Attorney General" (SB 690). Approved September 30, 2026 as a "Non-Urgency" bill (status), it takes effect January 1, 2027, because such a statute takes effect "on January 1 next following a 90-day period from the date of enactment of the statute" (Cal. Const., art. IV, sec. 8). See the SB 690 guide.

Meta's API calendar. On January 21, 2027, "Graph API v21.0 is deprecated and removed," and Meta says to "migrate calls to the latest API version." The same changelog says the v26 Business SDK "is now integrated with open sourced Conversions API Parameter Builder," which can generate event_source_url, referrer_url and client_ip_address, gated by a preference the advertiser sets (Meta). Read the Parameter Builder guide before an upgrade.

Salazar, pending, and the July 2027 Security Rule target

The Supreme Court heard Salazar v. Paramount Global on October 14, 2026. The docket lists "Argued." for that day and no decision or decision date (docket 25-459). The question is whether "goods or services from a video tape service provider," in the VPPA's definition of consumer, "refers to all of a video tape service provider's goods or services or only to its audiovisual goods or services" (question presented). If your video pages load ad pixels, see the VPPA guide.

HHS proposed its Security Rule update on January 6, 2025. It would require a regulated entity "to conduct and maintain an accurate and thorough written technology asset inventory and a network map" of its systems. HHS's Unified Agenda lists "Final Action 07/00/2027" under "Long-Term Actions" (reginfo.gov). The network map guide shows where pixels, forms and ad vendors fit.

December 31, 2027 and January 1, 2028

CCPA risk assessments. "Selling or sharing personal information" and "Processing sensitive personal information" each present "significant risk to consumers' privacy" (11 CCR 7150(b)). For that processing, if a business "initiated prior to January 1, 2026 and that continues after January 1, 2026," its risk assessment is due "no later than December 31, 2027" (11 CCR 7155(b)). See the risk assessment guide.

Medicare telehealth. HHS says "Recent legislation authorized an extension of many of the Medicare telehealth flexibilities through December 31, 2027" (telehealth.hhs.gov).

Vermont. Act 145 "shall take effect on January 1, 2028" and defines "Consumer health data" as "any personal data that a controller uses to identify a consumer's physical or mental health condition, diagnosis, or status" (Act 145; S.71 status). See the state law table.

Pending, with no date yet

• HIPAA Privacy Rule final rule. OIRA lists "HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens" as a "Final Rule" received April 2, 2026 (reginfo.gov).
• DEA special registration final rule. "Special Registrations for Telemedicine and Limited State Telemedicine Registrations," a "Final Rule" received by OIRA on August 25, 2026 (reginfo.gov).
• New York S9269. The bill "Provides for the protection of health information." The Senate site lists its status as "Passed Senate & Assembly" and shows no delivery to the governor (nysenate.gov).

How Curve Compliance helps

Most of these dates turn on what your site sends to ad platforms, whether visitor choices are honored, and whether you can show it. Curve Compliance replaces browser ad pixels with one script, sends conversions server-side with a fixed list of fields for each platform, and strips PHI before data reaches an ad platform. Its consent management treats Global Privacy Control as a decline of advertising and records every decision.

Event Logs show what Curve sent to each platform and what the platform accepted. Curve Forms hosts intake and lead forms under the BAA Curve signs on every plan. Curve is SOC 2 Type II, its team does the setup, typically live in about a week, and the free website scan lists the pixels and trackers on a page. For how these rules apply to you, talk to your counsel.

Sources, checked October 26, 2026: Meta Commercial Terms; Graph API v26.0 changelog; 21 CFR 1307.41; OIRA review list; AB 566, status; Chrome Platform Status; SB 690, status; Cal. Const. art. IV, sec. 8; CCPA Regulations; Oklahoma SB 546, status; Louisiana SB 386, digest; docket 25-459, question presented; RIN 0945-AA22; 90 FR 898; HHS telehealth updates; Vermont Act 145, status; New York S9269.

Frequently Asked Questions

What healthcare marketing compliance deadlines are coming in 2027?

January 1, 2027 brings California's browser opt-out signal law and ADMT rules and new Oklahoma and Louisiana privacy laws, July 2027 is HHS's target for a final HIPAA Security Rule, and December 31, 2027 is the CCPA risk assessment deadline for older processing and the last day of Medicare's telehealth extension (AB 566; CCPA; Oklahoma; Louisiana; agenda; HHS). A HIPAA Privacy Rule final rule and the Salazar VPPA case are pending with no date (OIRA; docket).

What healthcare privacy laws take effect in 2027?

Oklahoma's SB 546 and Louisiana's Act 502 take effect January 1, 2027, and both require consent before processing sensitive data (Oklahoma; Louisiana). California's ADMT rules apply from the same day (CCPA), and Vermont's Act 145 follows on January 1, 2028 (Vermont).

When is the HIPAA Security Rule final rule expected?

HHS's Unified Agenda lists "Final Action 07/00/2027," that is July 2027, under "Long-Term Actions" (reginfo.gov). Until a final rule publishes, the January 6, 2025 text remains a proposed rule (Federal Register).

What happens on January 1, 2027 for website tracking?

Browser makers covered by AB 566 must offer an opt-out preference signal, Oklahoma and Louisiana require consent for sensitive data, California's ADMT rules apply, and under SB 690 only the Attorney General may sue private actors over pen registers on websites (AB 566; Oklahoma; Louisiana; CCPA; SB 690).

Do new state privacy laws apply to HIPAA-covered clinics?

It depends on the law. Oklahoma's does not apply to "A covered entity or business associate" under the HIPAA rules (Oklahoma), and Louisiana's digest says its law exempts "entities governed by the privacy and security rules" (Louisiana). A health business outside HIPAA can still be covered.

When do Medicare telehealth flexibilities end?

HHS says recent legislation extended many of them "through December 31, 2027" (HHS). The separate DEA prescribing flexibilities in 21 CFR 1307.41 run "until the end of the day December 31, 2026" (eCFR).

Which 2027 changes affect Meta and Google conversion tracking?

For Meta, the Commercial Terms update on November 20, 2026 and the removal of Graph API v21.0 on January 21, 2027 (terms; changelog). On every platform, opt-out signals and new consent rules for sensitive data change what a site may send; Curve Compliance sends each platform a fixed list of fields and strips PHI before data reaches an ad platform.

Talk to Curve Compliance

Book a call. Plan 2027 around what your site actually sends. Curve Compliance strips PHI before data reaches an ad platform, runs consent management and signs a BAA on every plan. Book a call with Curve.