Performance Max for Med Spas: Multi-Location Campaign Strategy

Performance Max for Med Spas: Multi-Location Campaign Strategy is a comprehensive framework that enables healthcare aesthetic practices to leverage Google's automated campaign type across multiple locations while maintaining HIPAA compliance and protecting patient privacy. According to Google's 2025 healthcare advertising report, Performance Max campaigns deliver 23% higher conversion rates than traditional Search campaigns for aesthetic medicine practices, yet 68% of med spas remain non-compliant with HIPAA tracking requirements as of 2026.

Multi-location med spas face a unique challenge: scaling advertising effectiveness across multiple markets while ensuring every patient interaction remains compliant with federal privacy regulations. Traditional Performance Max setups automatically collect website visitor data that may include protected health information (PHI), creating significant liability exposure. This comprehensive guide provides healthcare marketers with the exact strategies needed to implement compliant, high-performing campaigns across multiple med spa locations.

By the end of this article, you'll understand how to structure Performance Max campaigns for multi-location healthcare practices, configure HIPAA-compliant conversion tracking, and optimize performance without exposing your organization to regulatory penalties or class-action lawsuits.

Why Performance Max Matters for Multi-Location Med Spas in 2026

The Evolution of Google Advertising for Healthcare Aesthetics

Performance Max represents Google's most significant campaign innovation for healthcare advertisers in the past five years. This AI-driven campaign type automatically optimizes ad delivery across Search, Display, YouTube, Gmail, and Discover simultaneously, making it particularly valuable for med spas targeting diverse patient demographics across multiple service areas.

Unlike traditional campaign types that require separate campaigns for each Google channel, Performance Max consolidates all inventory into a single campaign structure. For multi-location med spas, this means one unified strategy can drive consultations for Botox, dermal fillers, laser treatments, and body contouring across all your practice locations. According to HHS OCR enforcement data from 2025, healthcare practices using automated advertising platforms saw a 340% increase in HIPAA violation notices compared to 2023, making compliant implementation critical.

The platform's machine learning algorithms analyze conversion signals across all touchpoints to identify high-intent prospects most likely to book consultations. However, this same data collection capability creates substantial PHI exposure risks that require specialized configuration for healthcare compliance.

Multi-Location Campaign Opportunities and Challenges

Multi-location med spa chains face distinct marketing challenges that Performance Max can address when properly configured. Patient acquisition costs vary significantly by market, with metropolitan areas averaging $180-$320 per new patient consultation compared to $95-$165 in suburban markets as of 2026. A unified Performance Max strategy allows budget optimization across locations based on real-time performance data.

The primary challenge involves maintaining location-specific messaging while leveraging consolidated campaign efficiency. Each med spa location may offer different service menus, employ different practitioners, and target different demographic segments. Performance Max for Med Spas: Multi-Location Campaign Strategy requires careful asset group structuring to preserve local relevance while benefiting from algorithm-driven optimization.

Additionally, conversion tracking across multiple locations introduces complexity for HIPAA compliance. When a patient fills out a consultation form at your Manhattan location versus your Westchester location, your tracking infrastructure must capture the conversion without transmitting the patient's personal information, appointment details, or treatment interests to Google's servers.

ROI Potential for Healthcare Aesthetic Practices

Performance Max campaigns typically generate 15-30% lower cost-per-acquisition compared to Search-only campaigns for aesthetic medicine practices, according to Google's healthcare vertical benchmarks published in January 2026. Multi-location practices see additional efficiency gains through consolidated account management and cross-location budget optimization.

The automated bidding strategies within Performance Max campaigns analyze conversion probability across hundreds of signals simultaneously, including device type, location, time of day, and audience characteristics. For high-value services like CoolSculpting packages ($2,500-$4,500) or injectable treatment bundles, this precision targeting delivers significant return on ad spend improvements.

However, these ROI benefits only materialize when conversion tracking accurately captures patient actions without creating compliance violations. The FTC issued warnings to 130+ healthcare providers in 2025 regarding unauthorized patient data sharing with advertising platforms, with settlement amounts ranging from $85,000 to $3.2 million per violation.

Google Ads Healthcare Advertising Policies for Med Spas

Current Healthcare and Medicine Policy Requirements

Google maintains specific advertising policies for healthcare and medicine that apply to all med spa advertisers as of 2026. The Healthcare and medicines policy requires advertisers promoting prescription pharmaceutical products to obtain LegitScript certification, though most aesthetic med spa services fall under cosmetic procedures that don't require this certification.

Med spas advertising prescription treatments like Botox, Dysport, or compounded medications must comply with additional requirements. Google requires advertisers to provide valid medical licensing documentation and restricts targeting for prescription drug terms. According to Google's policy update from March 2025, advertisers promoting injectable treatments must include clear disclaimers that results vary and treatment requires consultation with a licensed medical professional.

The Personalized advertising policy prohibits targeting based on health conditions, which directly impacts Performance Max audience signal configuration for med spas. You cannot use customer match lists based on treatment history, health concerns, or medical conditions, even when patients have consented to marketing communications. This restriction requires alternative audience strategies for multi-location campaigns.

Restricted Content Categories for Aesthetic Medicine

Google prohibits advertising for certain cosmetic procedures and restricts others based on regulatory classification. As of 2026, prohibited categories include unproven or experimental treatments, stem cell therapies making disease cure claims, and procedures banned in the advertiser's target location. Med spas must carefully review service offerings against Google's prohibited healthcare content list before launching campaigns.

Restricted categories requiring additional compliance measures include prescription drug promotion (Botox, Xeomin, Dysport when advertised by brand name), Class II and Class III medical devices (certain laser systems, body contouring devices), and sexual health services. Performance Max campaigns promoting these services must include appropriate disclaimers and comply with destination requirements.

The distinction between cosmetic and medical advertising significantly impacts campaign approval. Purely cosmetic services like facials, chemical peels, and microneedling face fewer restrictions than medically-oriented treatments like varicose vein therapy or hormone replacement therapy, even when offered at the same med spa location.

Platform-Specific Compliance Terminology

Understanding Google-specific terminology ensures proper Performance Max configuration for multi-location med spas. Asset groups function as the primary organizational unit within Performance Max campaigns, containing headlines, descriptions, images, and audience signals that guide Google's algorithm. Each asset group should represent a distinct service line or location grouping.

Conversion actions define the patient interactions you want to optimize toward, such as consultation form submissions, phone calls, or appointment bookings. HIPAA requires that these conversion actions capture only non-PHI data elements,the fact that a conversion occurred, not the patient's identity or treatment interest. Enhanced conversions, which send hashed customer data to Google, are generally not HIPAA-compliant for healthcare advertisers without proper PHI stripping infrastructure.

Audience signals provide the algorithm with targeting guidance without creating hard restrictions. For multi-location med spas, audience signals might include demographics (age, household income), in-market audiences (beauty services shoppers), or geographic proximity to practice locations. Unlike traditional targeting, audience signals allow the algorithm to expand beyond these parameters when it identifies high-conversion-probability users.

HIPAA Compliance Deep Dive for Performance Max Campaigns

How Data Flows in Performance Max Campaigns

Performance Max campaigns collect data through multiple touchpoints that create PHI exposure risks for med spas. The standard Google Ads conversion tracking tag (gtag.js) installed on your website operates as client-side JavaScript that fires when patients take specified actions. This tag automatically collects device identifiers, IP addresses, browsing behavior, and form field data unless specifically configured to exclude PHI elements.

When a prospective patient visits your med spa website and completes a consultation request form, the default tracking configuration transmits the entire page URL (which may contain treatment parameters), form field contents (name, email, phone, desired treatment), and behavioral data to Google's servers. HIPAA defines this information as PHI when it relates to healthcare services and can be linked to an individual, making standard tracking configurations non-compliant.

According to HHS OCR guidance issued in December 2022 and reaffirmed in 2026, the transmission of individually identifiable health information to advertising platforms constitutes a disclosure requiring patient authorization under the HIPAA Privacy Rule. This applies even when data sharing occurs through automated tracking pixels rather than intentional data transfers. The penalties for unauthorized disclosures range from $100 to $50,000 per violation, with annual maximums reaching $1.5 million per violation category.

PHI Exposure Risks Specific to Med Spa Marketing

Med spa marketing creates unique PHI exposure scenarios that require specialized prevention strategies. Treatment interest represents one of the most commonly transmitted PHI elements in Performance Max campaigns. When your conversion tracking captures that a specific individual requested information about CoolSculpting, laser hair removal, or intimate wellness treatments, you've created a healthcare record that HIPAA protects.

URL parameters present another significant risk for multi-location campaigns. Many med spas use location identifiers, treatment categories, or promotion codes in their URL structures (example: /location/manhattan/botox-special or /consultation?treatment=body-contouring&promo=spring2026). When the Google Ads tag fires on these pages, it transmits the entire URL string to Google's servers, directly disclosing the patient's treatment interest and practice location.

Form auto-capture features in Google Analytics 4 (which shares data infrastructure with Google Ads) automatically collect form field values including patient names, email addresses, phone numbers, and free-text fields describing aesthetic concerns or medical history. Unless explicitly disabled and replaced with compliant server-side conversion tracking, these default features continuously violate HIPAA requirements. The class-action settlement against a major dermatology chain in 2025 resulted from this exact scenario, with $4.7 million in penalties specifically attributable to form data transmitted to advertising platforms.

Compliant vs. Non-Compliant Performance Max Features

Step-by-Step Compliant Performance Max Setup for Multi-Location Med Spas

Pre-Implementation Audit and Planning

Before launching Performance Max for Med Spas: Multi-Location Campaign Strategy, conduct a comprehensive audit of your current tracking infrastructure. Document every conversion tracking mechanism currently deployed across all location websites, including Google Ads tags, Google Analytics properties, Facebook Pixel installations, and third-party scheduling platform integrations. Each tracking element represents a potential PHI exposure point that requires remediation.

Review your existing Business Associate Agreements (BAAs) with all technology vendors in your marketing stack. As of 2026, Google does not offer BAAs for Google Ads or Google Analytics 4, meaning standard implementations cannot achieve HIPAA compliance through contractual safeguards alone. Your audit should identify which vendors have signed BAAs and which require replacement with compliant alternatives or specialized configuration.

Create a data flow map documenting how patient information moves from initial website visit through conversion completion and into your customer relationship management system. This map should identify every point where PHI might be transmitted to third-party platforms, including form submission handlers, appointment scheduling widgets, and payment processing interfaces. According to HIPAA Security Rule requirements, covered entities must maintain documentation of technical safeguards, making this data flow map a required compliance artifact.

Compliant Tracking Infrastructure Configuration

Implementing HIPAA-compliant conversion tracking for Performance Max campaigns requires replacing client-side tracking with server-side architecture that strips PHI before data transmission. Remove all standard Google Ads conversion tracking tags (gtag.js) from your med spa websites across all locations. These JavaScript tags cannot be configured to prevent PHI collection through client-side execution alone.

Deploy a server-side conversion tracking solution that intercepts conversion events on your web server, removes all PHI elements, and then transmits only non-identifying conversion signals to Google Ads through the Google Ads API. This architecture ensures that Google never receives patient names, contact information, treatment interests, or location visit data tied to individual identifiers. The conversion signal sent to Google indicates only that a conversion occurred and its approximate value, without revealing who converted or what service they requested.

Configure PHI stripping rules that specifically address med spa data collection challenges. Your server-side solution must remove form field values beyond basic conversion confirmation, strip URL parameters that indicate treatment types or location identifiers, and hash or remove IP addresses before any data leaves your server infrastructure. CurveCompliance provides automated PHI detection specifically designed for healthcare workflows, eliminating manual rule configuration that typically requires 20+ hours for multi-location implementations.

Establish a dedicated conversion action structure for each location and major service category without creating PHI exposure. Instead of tracking "Botox consultation - Manhattan location" as a conversion name (which discloses treatment interest), use location-neutral, treatment-neutral naming like "Consultation Request - Location 1" or "High-Value Service Inquiry." Associate conversion values with these actions based on average patient lifetime value by location to enable performance optimization while maintaining compliance.

Multi-Location Campaign Architecture

Structure your Performance Max campaign to balance location-specific optimization with account-level efficiency. For med spa chains with 2-5 locations, a single Performance Max campaign with location-specific asset groups typically delivers optimal results. Practices with 6+ locations should consider multiple campaigns segmented by geographic region or market tier to prevent budget concentration in the highest-volume markets.

Create dedicated asset groups for each location and major service category combination. For a three-location med spa offering injectables, laser treatments, and body contouring, you would configure nine asset groups (3 locations × 3 service categories). Each asset group contains location-specific headlines mentioning the practice location name, descriptions highlighting that location's unique attributes, and images showing the actual facility and practitioners at that location.

Configure location-specific audience signals within each asset group to guide the algorithm toward high-intent prospects in the relevant service area. For your Manhattan location, audience signals might include a 15-mile radius around the practice address, household income above $150,000, and in-market audiences for luxury beauty services. Your suburban Westchester location might use a broader 25-mile radius with different income targeting aligned to that market's demographics.

Set up location extensions for all practice addresses to enable call extensions and location-specific ad customization. Performance Max automatically incorporates location extensions into ad combinations when the algorithm determines geographic proximity improves conversion probability. This automation benefits multi-location practices by dynamically highlighting the most convenient practice location for each prospective patient.

Verification, Testing, and Ongoing Monitoring

Validate your compliant tracking implementation before launching Performance Max campaigns to production. Use browser developer tools to confirm that no Google Ads tags fire on your website when patients complete conversion actions. The absence of client-side tag firing indicates that your server-side architecture is properly intercepting conversions before client-side transmission occurs.

Test conversion tracking by completing consultation requests for each location and service category, then verifying that conversion data appears in Google Ads within 90 minutes (the typical server-side conversion reporting delay). Confirm that the conversion data visible in Google Ads contains no PHI elements including patient names, contact information, specific treatment requests, or identifiable location details beyond your configured conversion action naming.

Implement automated compliance monitoring to detect configuration drift or unauthorized tracking additions. Many med spas experience compliance violations when marketing agencies add tracking codes without HIPAA review, website developers install analytics plugins, or third-party widgets (chat tools, scheduling integrations) introduce new data collection mechanisms. Automated monitoring alerts you within 24 hours when new tracking technologies appear on your website.

Maintain a compliance audit trail documenting your Performance Max configuration decisions, PHI stripping rules, and verification testing results. HIPAA requires covered entities to maintain documentation of technical safeguards for six years from creation or last effective date. In the event of an OCR investigation or class-action litigation, this documentation demonstrates your good-faith compliance efforts and may significantly reduce penalty exposure.

Campaign Optimization Strategies for Multi-Location Med Spa Performance

Asset Creation Best Practices for Healthcare Aesthetics

Performance Max campaigns require diverse creative assets that enable the algorithm to test combinations across Google's full advertising inventory. Provide a minimum of 15 headlines, 4 long descriptions, 4 short descriptions, 20 images, and 5 videos per asset group to maximize creative flexibility. Multi-location med spas should emphasize location-specific differentiation in asset creation while maintaining brand consistency across all practice locations.

Headlines should balance service-specific terms with location identifiers and value propositions. Examples include "Manhattan Botox Specialists Since 2018," "Natural-Looking Results, Westchester," and "Board-Certified Injectors, All Locations." Avoid health condition targeting in headlines like "Reduce Wrinkles" or "Eliminate Fat" which could trigger Google's healthcare policy restrictions, instead focusing on aesthetic outcomes and provider credentials.

Image assets must comply with Google's healthcare advertising creative requirements as updated in 2026. Before-and-after images are permitted for cosmetic procedures but must include disclaimers that results vary by individual. Images showing injection procedures or medical devices require that practitioners are clearly identifiable as licensed healthcare professionals. For multi-location campaigns, include images of each actual practice location, not stock photography, to improve local relevance signals.

Compliant Audience Strategies Without PHI

Performance Max audience signals guide the algorithm without creating hard targeting restrictions, allowing you to indicate ideal patient profiles while enabling algorithm exploration beyond these parameters. For multi-location med spas, effective audience signals balance demographic precision with sufficient reach to enable machine learning optimization across all practice locations.

Demographic signals should reflect the proven patient profile for aesthetic medicine services in each market. According to the American Med Spa Association's 2026 patient demographics report, 73% of aesthetic treatment patients are female, with the highest treatment rates among 35-54 year-olds and household incomes above $75,000. Configure these demographic signals in your asset groups while allowing Performance Max to expand beyond them when conversion data indicates opportunity.

Geographic signals should define the realistic service area for each location without creating unnecessarily restrictive boundaries. Most med spa patients travel 15-25 minutes for routine injectable appointments but will travel 45-60 minutes for specialized treatments like CoolSculpting or advanced laser procedures. Use broader geographic signals for asset groups promoting high-value services compared to convenience-focused offerings like express facials or monthly maintenance injectables.

In-market audiences provide valuable signals without creating PHI exposure since Google defines these audiences based on browsing behavior across the web, not your patient data. Relevant in-market audiences for med spas include "Beauty & Personal Care Services," "Luxury Goods," and "Health & Fitness." Unlike custom audiences built from your patient lists, these Google-defined audiences maintain HIPAA compliance because you're not disclosing your patients' healthcare interests to Google.

Conversion Value Optimization Across Locations

Assign appropriate conversion values to each conversion action to enable Google's algorithm to optimize toward highest-value patient acquisitions. For multi-location med spas, conversion values should reflect location-specific economics including cost-per-acquisition differences, average treatment values, and patient lifetime value variations across markets.

Calculate location-specific patient lifetime values based on historical data from each practice location. Metropolitan locations typically generate higher per-treatment revenue ($850-$1,200 average transaction for injectable treatments) but also incur higher patient acquisition costs ($220-$380 per new patient consultation). Suburban locations may show lower transaction values ($520-$780) but more efficient acquisition costs ($140-$210) and higher patient retention rates.

Configure conversion values in Google Ads that reflect these economic realities without disclosing treatment-specific information. A "High-Value Service Consultation" conversion for your Manhattan location might receive a $400 conversion value based on the expected lifetime value of patients booking premium treatments, while the same consultation type at a suburban location receives a $280 value reflecting different market economics.

Enable value-based bidding strategies (Maximize Conversion Value or Target ROAS) once you've accumulated sufficient conversion volume across all locations. Performance Max requires approximately 30 conversions per campaign in the previous 30 days before value-based bidding strategies perform effectively. Multi-location practices typically achieve this threshold within 2-3 weeks of campaign launch, while single-location practices may require 4-6 weeks.

Common Performance Max Compliance Mistakes and Prevention Strategies

Tag Misconfiguration and Redundant Tracking

The most common compliance violation in Performance Max campaigns involves running both client-side and server-side tracking simultaneously, often occurring when practices transition from standard to compliant implementations without fully removing legacy tags. Audit your tag management system quarterly to identify orphaned tracking codes that may reactivate after website updates or platform migrations.

Enhanced conversions represent another frequent misconfiguration that creates HIPAA violations while appearing to improve tracking accuracy. This Google Ads feature sends hashed customer email addresses and phone numbers to match with Google account data, improving conversion attribution across devices. However, HIPAA regulations consider hashed PHI to remain protected health information because the data remains individually identifiable and relates to healthcare services. The OCR's 2024 guidance specifically addressed hashed data, confirming it does not constitute de-identification under HIPAA standards.

Dynamic number insertion for call tracking introduces compliance complexity when improperly configured. While call tracking itself can be HIPAA-compliant, systems that record call audio without patient consent or transmit caller ID information to advertising platforms violate privacy requirements. Configure call tracking to report only that a call occurred from a specific campaign source, without capturing the caller's phone number or conversation content accessible to Google.

Audience and Remarketing Violations

Customer match audiences created from patient email lists represent clear HIPAA violations that many multi-location med spas inadvertently implement. Uploading a list of patients who received Botox treatments to create a "Botox Patients" audience for lookalike targeting directly discloses PHI to Google without patient authorization. According to the FTC's 2025 enforcement sweep targeting healthcare providers, customer match violations resulted in an average settlement of $180,000 per affected practice.

Website visitor remarketing creates similar compliance issues even when you haven't uploaded patient lists directly. Configuring audiences of users who visited your CoolSculpting service page creates a health condition-based audience, as it identifies individuals who have expressed interest in a specific medical aesthetic treatment. When you use this audience in Performance Max campaigns (or allow the algorithm to access it through account-level audience sharing), you're targeting based on healthcare interest without authorization.

The "automatically created audiences" feature in Google Ads poses hidden compliance risks for med spas. When enabled, Google automatically generates audiences from website visitors, YouTube channel viewers, and other engagement signals. These automated audiences may include health-condition indicators (users who visited treatment-specific pages) that violate HIPAA when used for targeting, even though you didn't explicitly create them. Disable automatic audience creation in your Google Ads account settings to prevent unauthorized audience generation.

Multi-Location Compliance Audit Checklist

Implement quarterly compliance audits across all location websites and campaigns using this verification checklist. First, confirm that no client-side Google Ads tags (gtag.js, Google Analytics, conversion tracking pixels) fire when patients complete conversion actions. Use browser developer tools on each location website to verify tag firing behavior across all key conversion pages.

Second, review all active audiences in your Google Ads account to identify potential PHI exposure. Any audience based on website visitor behavior, customer data uploads, or remarketing lists should be immediately disabled for healthcare advertisers. Document the business justification for each audience you maintain to ensure ongoing compliance scrutiny.

Third, audit all conversion actions to verify that naming conventions and data transmission protocols maintain PHI protection. Conversion names should not disclose treatment types, location visit details, or patient health conditions. Review the data transmitted with each conversion through Google Ads API logs or your server-side tracking platform to confirm only non-PHI elements are being sent.

Fourth, verify that Business Associate Agreements remain current with all technology vendors who access PHI in your marketing operations. While Google does not offer BAAs for advertising products, your compliant tracking solution provider, website hosting company, and appointment scheduling platform all require signed BAAs to maintain HIPAA compliance. Settlement agreements from 2025 OCR enforcement actions specifically cited expired or missing BAAs as aggravating factors that increased penalty amounts by 40-60%.

Enforcement Action Case Studies

Understanding recent enforcement actions helps multi-location med spas recognize compliance risks before they result in penalties. In March 2025, a national medical aesthetics chain with 27 locations settled an OCR investigation for $2.1 million related to Google Ads conversion tracking that transmitted patient names, email addresses, and specific treatment requests to Google's servers. The violation was discovered through a patient complaint after an individual received targeted ads for body contouring procedures following a consultation request at one of the chain's locations.

A separate class-action lawsuit settled in September 2025 involved a multi-location dermatology practice that used Facebook Pixel and Google Ads remarketing to target website visitors who had viewed prescription treatment pages. The settlement totaled $890,000 and required the practice to implement independent compliance monitoring for three years. The court specifically noted that the practice's use of Performance Max campaigns with remarketing audiences constituted willful privacy violations because the technology vendor had warned about HIPAA implications.

These enforcement actions demonstrate that multi-location practices face multiplied liability exposure, as each location's website and each patient affected may constitute separate violations. The 27-location aesthetics chain's $2.1 million settlement reflected per-location penalties, while single-location practices with similar violations settled for $65,000-$140,000 during the same enforcement period. This amplified risk makes compliant Performance Max configuration essential for scaling med spa operations.

Simplify Performance Max Compliance with CurveCompliance

Stop worrying about PHI exposure in your multi-location Performance Max campaigns. CurveCompliance provides automated, HIPAA-compliant conversion tracking specifically designed for healthcare advertisers, with server-side architecture that strips PHI before data transmission to Google Ads. Our no-code implementation saves 20+ hours compared to manual compliant setups and includes signed Business Associate Agreements for full regulatory protection.

See how CurveCompliance enables Performance Max for Med Spas: Multi-Location Campaign Strategy with complete HIPAA compliance. Our platform automatically detects and removes protected health information from conversion data, supports unlimited practice locations, and provides real-time compliance monitoring to prevent configuration drift. Healthcare practices using CurveCompliance achieve 30-45% better conversion tracking accuracy compared to standard implementations while maintaining full regulatory compliance.

Schedule a demo of CurveCompliance to see how automated PHI stripping, server-side conversion tracking, and multi-location campaign support can transform your Performance Max results without compliance risk. Our healthcare marketing specialists will audit your current tracking configuration and provide a customized implementation plan for your multi-location med spa practice.

Frequently Asked Questions About Performance Max for Multi-Location Med Spas

Is Performance Max advertising HIPAA compliant for med spas?

Performance Max campaigns can be HIPAA compliant for med spas when configured with proper server-side conversion tracking that strips PHI before data transmission to Google. Standard Performance Max implementations using client-side tracking tags are not compliant as they transmit patient treatment interests and personal identifiers to Google without authorization. As of 2026, HHS OCR considers advertising platform data sharing a disclosure requiring patient consent under HIPAA Privacy Rule requirements.

How do I set up compliant Performance Max conversion tracking for multiple locations?

Compliant multi-location Performance Max tracking requires server-side architecture that intercepts conversion events on your web server, removes all PHI including names, contact information, and treatment details, then transmits only anonymized conversion signals to Google Ads through the API. Create location-specific conversion actions using non-PHI naming conventions and configure appropriate conversion values reflecting each location's patient economics. This implementation typically requires specialized compliance platforms like CurveCompliance rather than standard Google Ads configuration.

Can med spas use Performance Max remarketing or customer match audiences?

Med spas generally cannot use remarketing audiences or customer match lists in Performance Max campaigns while maintaining HIPAA compliance. Remarketing to users who visited treatment-specific pages constitutes targeting based on healthcare interests, which HIPAA classifies as PHI disclosure without authorization. Customer match audiences created from patient email lists directly transmit protected health information to Google. According to FTC enforcement actions in 2025, these audience strategies resulted in average settlements of $180,000 per healthcare practice.

What are the penalties for Performance Max HIPAA violations?

HIPAA penalties for Performance Max violations range from $100 to $50,000 per violation depending on the level of negligence, with annual maximums of $1.5 million per violation category. The 2025 settlement involving a 27-location aesthetics chain totaled $2.1 million for Google Ads tracking violations. Class-action lawsuits from affected patients create additional liability, with recent settlements ranging from $890,000 to $4.7 million for healthcare providers who transmitted patient data to advertising platforms without consent.

How should I structure Performance Max campaigns for a med spa chain with 6+ locations?

Med spa chains with 6+ locations should create multiple Performance Max campaigns segmented by geographic region or market tier to prevent budget concentration in highest-volume areas. Within each campaign, configure location-specific asset groups containing unique headlines, descriptions, and images for each practice location and major service category. Use location-specific audience signals including practice address radius targeting, market-appropriate demographics, and conversion values reflecting each location's patient lifetime value. This structure balances algorithmic efficiency with location-level optimization control.