Is the Meta Ads MCP HIPAA Compliant? What Claude Sees

No, the Meta Ads MCP is not HIPAA compliant: Meta does not sign a Business Associate Agreement for its advertising products, and its Business Tools Terms forbid sending it health information. Through it, Claude sees your account as you labeled it: campaign metrics, ad copy, audience names and sizes, pixel event names and custom conversions. No documented tool returns individual users or lead form answers, so the risk is those labels, plus write tools that can upload customer lists and start spend. Curve sends Meta neutral event names instead of service lines and forwards only the fields you map, with a signed BAA on every plan.

Why the answer is no, and why connecting is not itself the violation

Meta announced its Ads MCP server as an open beta in April 2026 and opened it to developers with their own Meta app in July. It is a remote server Meta hosts at https://mcp.facebook.com/ads. You connect it through Facebook Login for Business or an access token you already hold, and Meta markets the connectors as needing "no developer credentials, API setup, or coding." Nothing in that setup has to pass through IT or compliance.

Three facts decide the verdict:

• No BAA. Meta does not sign BAAs for its ad products, so nothing that is PHI should reach it by any route.
• Terms that prohibit health data. Section 1.h of Meta's Business Tools Terms says advertisers must not share data that "includes or is based on" health information.
• Silence where it counts. None of the Meta MCP pages we reviewed (the overview, the tool references and both launch posts) mentions health or sensitive data.

HIPAA regulates PHI, not software, and a row of campaign spend, impressions and cost per result identifies nobody. So connecting the server is not itself the violation. The question is whether anything that reveals a person's health relationship with your clinic moves through it, in either direction.

What the Meta Ads MCP exposes to Claude

Meta's documentation groups the tools into reporting, ad creation and management, custom audiences, catalogs, signals and datasets, A/B tests and lift studies, activity logs, and help. The read side is broad:

• Reporting. ads_get_ad_entities returns campaigns, ad sets and ads with spend, impressions, CTR, CPC, CPM and conversions, with breakdowns and date ranges. The ads_insights_* tools add anomaly detection, benchmarks and trends.
• Creative. ads_get_creatives, ads_get_ad_preview, ads_get_ad_images and ads_get_ad_videos return your copy, images and rendered previews.
• Audiences. ads_get_ad_account_custom_audiences and ads_get_custom_audience return audience names, sizes, status and subtype. ads_get_custom_audience_adsets shows which ad sets target each one.
• Signals. ads_get_datasets, ads_get_dataset_stats, ads_get_dataset_quality, ads_pixel_event_read and ads_get_customconversions describe your pixel, the events it receives, their match quality and the custom conversions built on them.
• Outside content. ads_library_search pulls other advertisers' ads from the public Meta Ad Library, and ads_get_ig_media lists recent Instagram posts.

No tool page we read describes a tool that returns an individual user or a lead form submission. Claude does not need a patient's name to learn something about your patients, though; the labels you gave your account are enough.

Where health signals live in a Meta ad account

Custom audience names

A customer-list audience called "Active Patients 2025" or "Semaglutide Starts" tells Claude, in plain text, that patient identifiers were uploaded to Meta. The MCP did not cause that disclosure; the upload did. The MCP repeats the evidence to a second vendor. If your audience list reads like a patient roster, run a customer list upload audit before connecting anything.

Event names and custom conversions

The signals tools report the events your pixel and Conversions API deliver, and list the custom conversions and event rules built on them. If the site fires Book_IVF_Consult, or a custom conversion is called "Suboxone intake submitted," Claude reads the service line next to volumes and match quality. Names like these turn a generic lead into health information, and they sit in Meta whether or not an assistant ever reads them. The deeper fix is covered in whether the Meta Pixel or Conversions API is HIPAA-safe.

Lead ads

No tool in the pages we read pulls lead submissions, so the answers patients typed stay where they already were: in Meta and whatever CRM syncs them. Claude can read the ads that point to the form, including the copy that frames the offer. A lead form that asks which condition someone wants treated is a PHI problem inside Meta long before it is an MCP problem, which is why lead form field choices come first.

Campaign names and copy

Condition-specific copy is usually allowed, and an ad identifies no one. The risk is the pairing: a campaign named after a condition, targeting a customer list, optimizing to an event named after a procedure. Claude assembles that picture in one answer.

What the write tools can change: spend, targeting, lists and the pixel

Reading is how health signals already in the account reach the model vendor. Writing is how an assistant creates new ones, or spends money nobody approved. Google's official Ads MCP server is strictly read-only, as our Google Ads MCP verdict explains. Meta's is not.

Its write tools include ads_create_campaign, ads_create_ad_set (targeting, budget and optimization goal), ads_create_ad, ads_create_creative, ads_update_entity, ads_activate_entity and ads_boost_ig_post, plus tools for custom audiences and pixel event rules.

Spend and targeting

Meta's safeguard is real: "Write tools create entities in a paused state; your AI client asks for confirmation before activation." Only ads_activate_entity sets a new entity live, and Meta's own description says it "starts spending budget."

The gap is edits. ads_update_entity changes fields on existing campaigns, ad sets and ads, and Meta's tool page describes no equivalent pause for edits to things already running. A budget or targeting change on a live ad set is live, and an assistant chasing cost per result does not know which audiences and exclusions your compliance team signed off on.

Customer lists and website audiences

ads_update_custom_audience_users will "add or remove users on a customer list audience by uploading hashed personal data." Hashing is how Meta matches a list to people. It does not hide from Meta who is on it. Put a CRM connector in the same conversation and one request, such as "build a lookalike from last quarter's booked consults," becomes a patient-list upload assembled by the assistant.

ads_create_custom_audience also builds website and lookalike audiences, and ads_update_custom_audience edits an audience's rule. A website rule that matches visitors to a condition page creates an audience defined by health interest, with no upload at all. Customer list audiences are also governed by Meta's separate Customer List Custom Audience Terms, not the Business Tools Terms.

Pixel configuration

ads_pixel_event_create adds an event rule to your pixel (it starts inactive), ads_pixel_event_update activates it, and ads_pixel_parameter_create creates "a new parameter extractor." On a clinic website, that is a data-collection change, and it belongs in the same review as a new tag, not a chat window.

The controls Meta gives you

Agents can be held to read-only, approval-required or full access, set per asset in Business Suite or in bulk through the Marketing API. Meta does not document which access level a new connection starts at, so check it rather than assume read-only. Meta says anyone with full control of the business portfolio can govern agent permissions; if your agency holds full control, it holds this switch too.

Any account that serves a covered entity should start at read-only; our read-only setup guide walks through it. Keep one limit in mind: an approval prompt asks whether to run a tool, not whether its arguments contain PHI.

What Claude actually receives, and where it goes next

Every tool result lands in the conversation and becomes context the model processes on every later turn, retained under your Claude plan's terms. That gives you two vendors to account for: Anthropic, which processes everything in the chat, and Meta, which receives whatever a tool call sends. No Claude plan covers both:

• Free, Pro, Max and Team plans. Only Claude Enterprise can enable HIPAA readiness. On any other plan, no BAA covers what Meta's tools return into the chat.
• Enterprise with HIPAA readiness. Anthropic's BAA covers chat, but its own article says data sent to third parties through MCPs and connectors is not covered. The Meta side stays outside every BAA, because Meta signs none.
• The Claude API. The API's MCP connector (mcp_servers) is not HIPAA-eligible, so a homegrown agent that attaches Meta's server through it sits outside the BAA too.

There is an input risk as well. ads_library_search brings in ad text written by strangers, and text in context can carry instructions. An assistant that reads outside copy and can also call write tools is the exact setup described in prompt injection in ad data.

The most common failure is quieter. Someone asks which campaign produced last month's new patients, Claude explains that Meta cannot see who became a patient, and the person pastes a CRM export to help. Now the chat holds PHI next to ad data, often on a plan with no BAA, which is why you cannot paste a patient funnel into a chatbot.

How Curve keeps service lines out of Meta and limits what Claude receives

For the event path, the durable fix is upstream: an event Meta never receives cannot surface in anything that reads Meta. Curve's tracking script installs in place of the Meta Pixel, and events reach Curve's US-hosted infrastructure first, not Meta.

Curve fixes the event path, not the rest of the account. It does not rename custom audiences, campaigns or custom conversions someone built in Events Manager, and it does not change lead form questions; that cleanup is still yours.

• Per-destination field mapping. Only fields you explicitly map forward to Meta's Conversions API. The default is that nothing goes.
• Neutral event aliases. Meta receives a neutral event name instead of the service line, so the event names Claude reads in Meta's signal diagnostics describe a lead, not a condition.
• Hashed identifiers. Identifiers you choose to send are SHA-256 hashed, as Meta's Conversions API requires, and travel with a neutral event, not a diagnosis.
• PHI-pattern monitoring. PHI-shaped values such as SSNs, MRN-style IDs and dates are flagged for review. This is detection, not redaction; the protection is the mapping.

For the question clinics actually ask (which Meta campaigns produce results, at what cost), Curve MCP takes a different route. It works with any MCP-capable client, such as Claude, ChatGPT or Cursor, and is read-only, with no write tools. It reconciles your server-side campaigns: each campaign's spend, clicks and impressions as Meta reports them sit next to the conversions Curve's server-side tracking recorded (attributed on a last-touch basis, which can differ from the results Meta reports), with cost per conversion by completed week. One link opens the full sent, accepted and matched view inside Curve.

• Small groups are withheld, counts and spend are rounded, and any number that could be subtracted from another to expose a small group is withheld too.
• A campaign name appears only if your organization approved it. Otherwise Claude sees "(label hidden)", which matters when campaign names carry conditions.
• Inputs are fixed choices, not free text, and nothing a website visitor can set (UTMs, page paths, referrers) ever comes back.
• A final check blocks any answer that looks like it contains an email, phone number, ID, date or name, and fails closed if the check cannot run.
• Access uses scoped tokens that expire. Every call is logged, and if the log cannot be written, no data is returned.

Person-level questions get a single-use link that opens Curve Analyst behind a Curve login. The link carries no data, so patient-level work stays in the platform instead of a chat transcript.

Frequently asked questions

Does Meta sign a BAA for the Ads MCP?

No. Meta does not sign BAAs for its advertising products, and the MCP pages we reviewed do not address health data. Treat anything that reaches Meta, through the MCP or any other route, as outside HIPAA protection. That is why the vendor between your site and Meta needs one; see why a BAA comes with every account.

Can Claude see patient names through the Meta Ads MCP?

Not through the read tools we reviewed. None returns an individual user or a lead submission, and customer-list audiences come back as names, sizes and status, not members. Claude can still see a patient group described in an audience or event name. Names usually enter the chat another way: someone pastes them in.

Can the Meta Ads MCP spend money without approval?

Not on new campaigns, but possibly on live ones. New campaigns, ad sets and ads are created paused, and your AI client asks for confirmation before ads_activate_entity starts spend. ads_update_entity edits entities that are already running, and Meta documents no pause for those edits, so a budget change applies to an ad set that is already spending. For a clinic account, set agent access to read-only in Business Suite, or in bulk through the Marketing API.

Can you see what Claude changed in a Meta ad account?

Partly. Meta's ads_account_get_activity_logs tool retrieves "activity log entries for an ad account, optionally scoped by object, time window, event category, or user." Meta's documentation does not say whether an entry marks an agent's change differently from a person's, so connect the assistant through its own identity, as the read-only setup guide describes, and its edits become attributable.

Does a Claude Enterprise BAA cover the Meta Ads MCP?

No. Anthropic's BAA excludes data sent to third parties through MCPs and connectors, and Meta signs no BAA of its own, so neither end of the Meta connection is covered. Plans other than Enterprise cannot enable HIPAA readiness at all; more in whether Claude is HIPAA compliant.

What can Curve MCP tell Claude about Meta campaigns?

It reconciles your server-side Meta campaigns: per-campaign spend, clicks and impressions as Meta reports them, next to Curve's server-side conversions and cost per conversion, over fixed windows of the last week or the last 4, 13 or 52 completed weeks. Unapproved campaign names come back hidden.

Where to start

Before anyone connects Meta's server, read your ad account the way Claude would: audience names, event names, custom conversions, campaign names. If any of them names a condition or a patient group, fix that first, because the MCP only makes it visible. The free compliance scanner shows what your website sends to ad platforms today.

If you want Claude answering Meta campaign questions without reading Meta's raw account, book a Curve MCP demo. You will see exactly what Claude receives. To start with the tracking layer, see how Curve controls what reaches Meta's Conversions API, with a signed BAA on every plan.

Reviewed September 2026. Tool names and quotes come from Meta's Ads MCP developer documentation, Meta's Business Tools Terms and Anthropic's BAA documentation as published at review time. Meta's tool list may change.