Telehealth Licensure and Ad Geo-Targeting Limits

A telehealth company should only run ads in states where its clinicians are actually licensed, which makes geo-targeting a licensure compliance control rather than a budget setting, and Curve is the HIPAA-compliant tracking and attribution layer that lets you verify where your traffic and conversions actually came from without exposing patient data. The complication is that ad platforms do not enforce this for you and their location targeting is approximate by design. You need a second layer that measures where conversions really originated. Curve includes a signed BAA on every plan.

Why this is a licensing problem, not a marketing preference

Telemedicine practice is governed by the patient's location, not the clinician's. A physician in Texas treating a patient physically in Ohio is practicing medicine in Ohio and needs Ohio authority to do it. Every state medical board takes this position.

Advertising sits upstream of that. Soliciting patients in a state where you cannot lawfully treat them is a problem in two distinct ways. First, state boards and attorneys general have treated advertising as evidence of holding oneself out to practice. Second, and more immediately, you have spent money generating demand you cannot legally serve, which produces refunds, complaints, and a support queue full of angry people.

The second problem is what usually surfaces first. A telehealth company scaling nationally discovers a meaningful share of its signups come from states it does not serve, and only then works backward to the targeting.

The licensure map moves

Most telehealth companies do not have a stable state list. Clinicians are added and lose licenses, compact privileges change, new states open, and license renewals lapse quietly.

The Interstate Medical Licensure Compact, the Nurse Licensure Compact, PSYPACT for psychologists, and the counseling compact all expand reach, but each has its own membership and its own rules about what privilege actually conveys. A compact makes obtaining a license faster; it does not usually make one license work everywhere.

The practical consequence is that your geo-targeting configuration is a document that goes stale. Treating it as set-and-forget guarantees drift.

Why ad platform geo-targeting is not sufficient on its own

Every major ad platform offers location targeting, and every one of them is approximate.

Location targeting includes people "interested in" a location by default. On Google, the default setting historically included people showing interest in your targeted locations, not just people in them. On a state-level campaign this is exactly the wrong behavior for licensure, and it needs to be changed to presence only.

IP geolocation is imprecise. Mobile carrier IPs, corporate VPNs, and consumer privacy features routinely place a user in the wrong state. Border metros are the worst case: a Kansas City or Philadelphia campaign can spill across a state line invisibly.

Radius targeting ignores state lines. A fifty mile radius around a border city covers two or three jurisdictions.

Exclusions are not symmetrical with inclusions. Adding your licensed states does not automatically exclude everything else in every platform and campaign type, and some campaign types (broad reach, automated placements) behave differently than the manual settings suggest.

None of this means geo-targeting is useless. It means it is a first filter and not a control you can attest to.

The second layer: verify where conversions actually came from

The control that actually holds is measuring the geography of your conversions independently of what the ad platform says it targeted.

That gives you three things. A drift alarm, when signups start appearing from unlicensed states. A spend audit, showing what fraction of budget generated unusable demand. And documentation, which matters if a board or an AG ever asks what steps you took.

The geography you measure should be coarse. State level is what licensure needs. Collecting finer location data on healthcare prospects creates a privacy problem in exchange for precision you do not use.

State should be gathered at intake, not inferred

The authoritative answer to "where is this patient" comes from asking them, early, before any clinical information is collected. A state selector as the first field of intake does three jobs at once: it blocks unserviceable signups before they consume support time, it gives you a clean measurement dimension, and it removes the need to rely on IP inference for the decision that actually matters.

What the state selection must not do is travel to an ad platform attached to an identifiable person alongside a service line. State plus hashed email plus a conversion named for a treatment category is a disclosure.

Where advertising rules stack on top of licensure

Geo-targeting for licensure is one constraint. Telehealth advertisers usually have several more running at the same time, and they interact.

Meta requires prior authorization for prescription drug advertising, and only pharma manufacturers, online pharmacies, and telehealth providers qualify. It rejects branded pharmaceutical weight loss terms and most before-and-after weight loss imagery.

The FDA has been active with telehealth specifically: 30 warning letters went out to telehealth companies over compounded GLP-1 claims on 2026-03-03, and 25 more the week of 2026-06-15. Claims about compounded products are being read closely.

State pharmacy and telehealth rules also differ on what may be prescribed after an asynchronous visit, which means a campaign promising same-day prescriptions may be accurate in one state and misleading in another. Creative that works nationally can be a state-specific compliance problem.

The clean structure separates campaigns by state group where the rules differ, rather than running one national campaign with a targeting list. It costs efficiency and buys the ability to make true statements everywhere.

How Curve supports geographic verification without PHI

Curve is HIPAA-compliant ad tracking, marketing attribution, and analytics for healthcare, and telemedicine is a core vertical. The tracking script installs in place of the Meta Pixel and Google tag, so events reach Curve's US-hosted infrastructure rather than going directly to ad platforms. That gives you a place to see the truth before anything is forwarded.

• Geographic attribution in your own analytics. Sessions and conversions carry geographic dimensions inside Curve, so you can compare where a campaign said it was targeting against where conversions actually originated.
• Per-destination field mapping. Only explicitly mapped fields forward to a given destination, and the default is that nothing goes. State of residence collected at intake stays in your systems unless someone deliberately maps it outward, which for a healthcare advertiser they should not.
• Neutral event aliases. The ad platform sees a neutral conversion name rather than the service line, so a state-segmented campaign does not disclose what a person in that state signed up for.
• SHA-256 identifier hashing. Contact identifiers are hashed per each platform's conversion API requirements before forwarding.
• Bridge tokens. Attribution survives when a prospect clicks out to a separate intake or scheduling tool such as IntakeQ or Calendly, which is where most telehealth funnels lose the chain.
• Incoming webhooks. Your EHR or intake platform posts qualification outcomes back, matched by email, click ID, or bridge token, so you can measure the unserviceable-state rate as a real number rather than an anecdote.
• PHI-pattern detection. Payloads carrying PHI-shaped values are flagged as a monitoring signal, useful when an intake tool starts passing more than it used to.

Curve forwards clean conversions server-side to Meta CAPI, Google Ads Enhanced Conversions, Microsoft, TikTok, and LinkedIn, with a signed BAA on every plan. Related reading: what changed for DTC telehealth after the FTC action and subscription telehealth privacy and billing.

An operating routine that keeps this current

The failure mode is not a bad initial setup. It is drift, so the routine matters more than the configuration.

1. Keep one authoritative state list owned by whoever manages clinician credentialing, not by marketing. Marketing consumes it; it does not maintain it.
2. Re-sync targeting on a fixed cadence, monthly at minimum, and immediately when a clinician leaves or a license lapses. A departure that removes your only licensee in a state is a same-day targeting change.
3. Set location targeting to presence only in every campaign, and re-check after any platform interface change, because defaults reset more often than anyone expects.
4. Watch the unserviceable-state rate weekly. If signups from unlicensed states rise, something changed in targeting, creative, or platform behavior.
5. Gate intake on state selection before any clinical questions, so an unserviceable prospect never becomes a record you have to handle.
6. Keep a written record of the list, the sync dates, and the observed rates. This is the artifact that demonstrates diligence.

Frequently asked questions

Does the patient's location or the clinician's determine licensure?

The patient's physical location at the time of the visit. That is the standard position of state medical boards, and it is why advertising geography has to match your license map rather than your office locations.

Is it illegal to advertise in a state where we are not licensed?

It varies by state and depends on how the advertising is framed, but boards and attorneys general have treated soliciting patients as holding oneself out to practice. Even where the legal risk is arguable, the operational cost of unserviceable demand is not.

Can we rely on Google and Meta location targeting alone?

No. Location targeting is approximate, includes interest-based matching unless you set presence only, and behaves differently across campaign types. Treat it as a filter and verify conversion geography separately.

Does a licensure compact let us advertise across all member states?

Only where the compact has actually granted your clinician authority in that state. Compacts speed up licensure; they do not usually make one license valid everywhere. Track actual granted authority, not compact membership.

Should we send state data to ad platforms for optimization?

No. State attached to an identifiable person alongside a health service conversion is a disclosure to a platform that has not signed a BAA. Segment by state in campaign structure instead, so geography lives in the campaign rather than in the payload.

How do we handle a patient who travels to another state mid-treatment?

That is a clinical and licensure question for your care team, not a marketing one. On the measurement side, nothing about it should be flowing to an ad platform in the first place.

What is the fastest way to find out if we have drift right now?

Compare conversions by state in your own analytics against your authoritative license list. Any state producing conversions that is not on the list is drift, and the volume tells you how urgent it is.

Where to start

Get the authoritative license list in one place with an owner outside marketing, then compare it against your last ninety days of conversions by state. That comparison is usually uncomfortable and always informative.

Fix presence-only targeting across every campaign, add a state gate at the top of intake, and put the unserviceable rate on your weekly dashboard so drift shows up as a number rather than as a support complaint.

Curve provides the measurement side: server-side collection to US-hosted infrastructure, geographic attribution in your own analytics, per-destination field mapping so state and intake data stay behind, neutral event aliases, hashed identifiers, bridge tokens across intake handoffs, webhook outcome matching, PHI-pattern monitoring, and a signed BAA on every plan.

Run the free compliance scanner against your site, read the HIPAA-compliant conversion tracking setup, or visit curvecompliance.com to build the verification layer.

Reviewed August 2026. State licensure rules, compact membership, and ad platform policies change frequently. Verify current requirements with counsel before implementation.