Which Ad Platforms Sign a BAA? Meta, Google, TikTok, More

No major ad platform we checked offers a BAA in its ad terms: Curve's BAA Directory lists Meta, Google Ads, TikTok, Microsoft Advertising, LinkedIn, Reddit and Snapchat as not signing one, and the ad terms and policies we read for X, Amazon Ads and ChatGPT Ads mention none and restrict health data. So the task is not finding a platform that will sign. It is sending each platform conversions that carry no protected health information (PHI). Curve Compliance signs a BAA on every plan, removes PHI before anything is sent to an ad platform, and sends conversions server-side with a fixed list of fields, so your campaigns still get the signal they optimize on.

Book a call. Curve's team sets up server-side conversions to Meta, Google and TikTok for you and strips PHI before data reaches an ad platform. Book a call with Curve.

Which ad platforms sign a BAA: the table

Each row quotes the platform's own terms or help page, opened on October 26, 2026. "No" means Curve's BAA Directory lists the platform as not signing, based on those terms; the platform name links to its entry. X, Amazon Ads and ChatGPT Ads have no Directory entry, so their cells say only what their pages show.

Platform	Signs a BAA?	What its terms say about health or sensitive data	Source
Meta	No	You will not share data that "includes or is based on, directly or otherwise, health information"	Business Tools Terms, 1.h
Google Ads	No	"Google does not intend use of the Communication Features to create obligations under the Health Insurance Portability and Accountability Act" (call features)	Call Ads Supplemental Terms
TikTok	No	"Make sure you don't use your TikTok Pixel on web pages where you may share personal health or financial information."	TikTok Ads Help
Microsoft Advertising	No	"Microsoft does not offer Business Associate Agreements (BAAs) for UET and does not represent that UET meets HIPAA requirements."	Microsoft Advertising Help
LinkedIn	No	Bars Sensitive Data, "including by way of installing the Insight Tag on a page that collects medical, financial, or other Sensitive Data about identified or identifiable individuals"	LinkedIn Ads Agreement, section 5
Reddit	No	Bars data that "is or includes sensitive data or special categories of data", including "health, genetic, or biometric information"	Reddit Business Tool Terms
Snapchat	No	Personal data sent to Snap must not include "any sensitive information or special category data", including "health information"	Snap Personal Data Terms
X	Not mentioned in the pages checked	X "prohibits the creation of custom audiences or conversion events based on any sensitive information", and health is on its list	X Conversion Tracking and Custom Audiences policy
Amazon Ads	Not mentioned in the pages checked	Do not use an Amazon cookie "to reach audiences based on sensitive personal information", including "health / medical information"	Amazon Ads pixel requirements
ChatGPT Ads	Not on OpenAI's list of products available with a BAA	You "will not provide Prohibited Data", which covers data that could "identify an individual's past, present, or future physical or mental health status"	OpenAI Conversion Terms; Ad Tools Terms; OpenAI Help

What each platform's terms say

Meta. The Business Tools Terms govern data from Meta ad products, which "include, but are not limited to, Meta Pixel, Conversions API." Section 1.h adds: "The names you choose and criteria you establish for your events, conversions, and any custom audiences you create must not reflect, imply or be based on any category of information described in this Section 1.h." So the rule reaches server-side events and event names, not only the pixel. Meta's Business Tools Terms on health data goes clause by clause.

Google Ads. Google's Call Ads Supplemental Terms cover call features such as click-to-call ads. A covered entity or business associate that wants them "should not accept these Supplemental Terms" and should ask Google to exclude its calls from monitoring and recording. Accepting them means warranting "you will not use the Communication Features for any purpose or in any manner involving Protected Health Information."

TikTok. TikTok's help center says "At TikTok, we don't allow advertisers to share information about children, health or financial information, or other categories of prohibited data," and applies that to the Events API as well as the pixel. Clause 2.8 of its Business Products (Data) Terms bars data that "includes health or financial information, or other categories of sensitive information." Already flagged? See TikTok's prohibited data notice on a health site.

Microsoft Advertising. The UET safeguards page says "Do not place UET tags on pages subject to HIPAA regulations" and "Do not include any personally identifiable information (PII) or protected health information (PHI) in custom parameters." More in Microsoft UET and HIPAA.

LinkedIn, Reddit and Snapchat. LinkedIn's Ads Agreement adds "You may not target Ads based on Sensitive Data." Reddit's Business Tool Terms cover "the Reddit Pixel, Reddit's advertising APIs, postback URLs, SDKs, data clean rooms, Reddit Custom Audiences" and more. Snap's Personal Data Terms apply when you send personal data "through Snap tools like pixels, JavaScript SDKs, APIs or cookies." For LinkedIn, see the Insight Tag on health sites.

X and Amazon Ads. X's policy also requires website advertisers to give "legally sufficient notice" of conversion tracking and get "legally sufficient consent." Amazon's pixel requirements add: "Not collect or pass to Amazon any personally identifiable information through the cookie, including but not limited to, names, email addresses, and telephone numbers." Neither page mentions a BAA. Amazon Web Services does sign one for the cloud services it lists (AWS in the Directory), but AWS is a different product from Amazon Ads.

ChatGPT Ads. OpenAI's Conversion Terms apply to "an API, pixel, software development kit, data integration, or similar data ingestion tool" and say "you will not provide Prohibited Data." The Ad Tools Terms define that to include data that could constitute "Consumer Health Data" under the Washington My Health My Data Act. OpenAI's list of HIPAA eligible products available with a BAA names ChatGPT and API products, not its ad tools. See also ChatGPT Ads for health brands.

If no ad platform signs a BAA, how do clinics measure ads?

For HIPAA covered entities, the HHS bulletin on online tracking says "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI," and that if the vendor is not a business associate, "the individuals' HIPAA-compliant authorizations are required before the PHI is disclosed to the vendor." A June 20, 2024 court order vacated one part of the bulletin, about linking an IP address to a visit to an unauthenticated public page on health conditions or providers (the bulletin, annotated). Outside HIPAA, the platform terms above still restrict health data. For which rules apply to your business, talk to your counsel.

So the workable route is to send each platform only what its terms allow:

• Keep browser ad pixels off pages that collect health details. TikTok, LinkedIn and Microsoft each say so in their own words.
• Send conversions server-side, so you choose every field that leaves your site.
• Use neutral event names. Meta's terms reach the names of events and conversions, not only what they carry.
• Keep page URLs, form answers and free text out of events. A URL can name a condition; see what counts as PHI on a website.
• Check identifiers too. Whether a hashed email counts as PHI has its own page: is a hashed email PHI?

Server-side alone does not settle it; what matters is what the server sends (why server-side is not compliance by itself). The step-by-step setup for each platform is in how to measure ads without tracking pixels.

What a BAA with your tracking vendor covers

A BAA is a contract between you and one vendor, and it covers the PHI that vendor handles for you (what a BAA is; what one covers). When your tracking vendor signs one, the data inside that vendor is covered. Meta, Google and the other platforms are not parties to it, so the vendor has to remove PHI before anything is sent to them.

The same question applies to every tool in your stack. The BAA Directory answers it tool by tool from each vendor's own page, and Curve keeps lists for AI tools, CRMs, email platforms, marketing automation, form builders, scheduling software and cloud storage. Whether your ads may run at all is a separate question; see LegitScript certification for healthcare ads.

How Curve Compliance helps

Curve Compliance signs a BAA on every plan and replaces browser ad pixels with one script. Conversions go server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and each platform receives only a fixed list of fields. Events can use neutral names, so a conversion says that someone booked, not what they booked for. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and flags them so they can be stopped at the source. Contact identifiers are off by default on Meta, Google Ads and TikTok. Event Logs show what Curve sent to each platform and what the platform accepted.

Curve's BAA covers the data Curve handles for you. The ad platforms are not parties to it, which is why Curve removes PHI before anything is sent to an ad platform. To see what your site sends today, run the free website scan, which lists the pixels and trackers on a page. Curve's team does the setup, typically live in about a week. More on Curve conversion tracking.

Sources, checked October 26, 2026: Meta Business Tools Terms; Google Ads Call Ads Supplemental Terms; TikTok Ads Help on prohibited data sharing; TikTok Business Products (Data) Terms; Microsoft Advertising, UET technical safeguards for sensitive data; LinkedIn Ads Agreement; Reddit Business Tool Terms; Snap Personal Data Terms; X Conversion Tracking and Custom Audiences policy; Amazon Ads pixel requirements; OpenAI Conversion Terms, Ad Tools Terms and HIPAA eligible products; HHS bulletin on online tracking technologies.

Frequently Asked Questions

Which ad platforms sign a BAA?

None of the ten we checked on October 26, 2026 offers one in its ad terms: Meta, Google Ads, TikTok, Microsoft Advertising, LinkedIn, Reddit and Snapchat do not sign one (BAA Directory), and the terms and policies we read for X, Amazon Ads and ChatGPT Ads mention none and restrict health data. Send them conversions with no PHI instead.

Does Meta sign a BAA?

No (Directory entry). Meta's Business Tools Terms say you will not share data that "includes or is based on, directly or otherwise, health information," and that the names of your events and conversions must not reflect it either.

Does Google Ads sign a BAA?

No, per Curve's Directory entry. Google's Call Ads Supplemental Terms say Google "does not intend use of the Communication Features to create obligations under" HIPAA, and that covered entities and business associates "should not accept these Supplemental Terms."

Is the TikTok pixel HIPAA compliant?

Not on pages that handle health information. TikTok does not sign a BAA (Directory entry), and its help center says "Make sure you don't use your TikTok Pixel on web pages where you may share personal health or financial information."

Does Microsoft Advertising sign a BAA for UET?

No. Microsoft says "Microsoft does not offer Business Associate Agreements (BAAs) for UET and does not represent that UET meets HIPAA requirements," and "Do not place UET tags on pages subject to HIPAA regulations" (Microsoft Advertising Help; Directory entry).

Can I use the LinkedIn Insight Tag on a clinic website?

Not on pages that collect medical data. LinkedIn's Ads Agreement bars Sensitive Data, "including by way of installing the Insight Tag on a page that collects medical, financial, or other Sensitive Data about identified or identifiable individuals." See the Directory entry.

Does ChatGPT Ads sign a BAA?

OpenAI's list of HIPAA eligible products available with a BAA names ChatGPT and API products, not its ad tools. Its Conversion Terms say "you will not provide Prohibited Data," which the Ad Tools Terms define to include data that could identify a person's past, present, or future physical or mental health status.

If my tracking vendor signs a BAA, are Meta and Google covered?

No. A BAA covers the vendor that signs it, and the ad platforms are not parties to it (what a BAA covers). Curve signs one on every plan for the data it handles, which is why Curve removes PHI before anything is sent to an ad platform.

Talk to Curve Compliance

Book a call. Curve signs a BAA on every plan and sends your conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn server-side, with a fixed list of fields and PHI removed before anything is sent. Curve's team does the setup, typically live in about a week. Book a call with Curve.