In 2025, the fix was simple, or at least it looked that way: rename Purchaseto something Meta wouldn't flag, and your conversion data would keep flowing.
That advice is now dangerously incomplete.
Meta's health and wellness restrictions govern how much conversion data supplement brands, telehealth providers, med spas, CBD sellers, and wellness apps are allowed to share with Meta's ad platform — and enforcement has moved a long way since early 2025. It now runs on a three-tier system, classifies domains independently of ad creative review, and — as of the 2025–2026 enforcement expansion — actively scans the content of custom events, not just their names. An event called event_01 that still carries content_name: "blood pressure monitor" in its payload gets blocked exactly like Purchase did.
If your brand sells supplements, runs a med spa, operates in telehealth, or sells anything the algorithm associates with a health condition, the workaround you set up last year may already be quietly failing.
This guide covers what “health and wellness” means to Meta, why it restricts these brands, how to check your exact restriction level, what's actually changed since 2025, and the compliant architecture that restores conversion data without violating Meta's terms.
What Meta's health and wellness restrictions actually are
Meta's Business Tools Terms prohibit advertisers from sending Meta any information they know or reasonably should know is sensitive — including health information. In practice, this splits into two categories that get discussed together but work differently.
Personally Identifiable Information (PII) is data that identifies a specific person: name, email, phone number, IP address, device ID, precise location.
Protected Health Information (PHI)is the subset of that data tied to a person's health: medical records, prescriptions, test results, appointment types, symptoms, diagnoses.
Neither of these has to be sent deliberately to cause a problem. Meta's classification systems can infer PHI from data that looks harmless on its own — which is exactly why “just don't send medical records” isn't a sufficient policy for most health and wellness brands.
Because a customer purchasing a specific health product can itself imply something about that customer's health condition, Meta treats standard commerce events from these brands as a category-level risk, not a case-by-case one. That's why the restriction applies at the domain level rather than to individual ads.
Who Meta classifies as health and wellness
Meta's own guidance defines a health and wellness business as one “associated with medical conditions, specific health statuses, or provider/patient relationships.” In practice, that definition gets applied through behavioral inference, not just keyword matching on your business category — if buying your product implies something about a health condition, the classifier can flag the domain regardless of the language on your site.
Brands that are reliably classified:
- Supplements and vitamins, especially with condition-adjacent positioning (blood sugar, hormone balance, sleep, cognitive function)
- Weight loss and GLP-1-adjacent products or services
- Telehealth, online pharmacies, and provider/patient portal services
- Med spas and cosmetic procedures (Botox, fillers, laser, body contouring)
- CBD, THC, and other regulated substances
- Mental health services, therapy apps, and psychiatry platforms
- Reproductive health, fertility, and menopause care
- Substance use treatment providers
Brands that are frequently surprised to find themselves classified:
- Skincare brands using acne, redness, or condition-specific language
- Fitness equipment or apparel brands using pain or recovery messaging
- Functional food brands making health-outcome claims
- General wellness or mindfulness apps
If your product sits anywhere near a physical or mental health condition in a customer's mind, it's worth checking your classification even if you don't think of your business as “health and wellness.”
Why this restriction exists
This isn't Meta being arbitrary. It's a defensive response to real legal exposure: HIPAA enforcement in the US, GDPR in the EU, FTC scrutiny of health-data handling, and active class-action litigation over ad-tech platforms receiving health-adjacent data from hospitals and health apps. Sharing a user's purchase of a specific medication or condition-linked product with an advertising platform creates liability that Meta would rather not carry — for itself or its advertisers. This dynamic is part of a broader pattern of fragile cross-system signals — see Why Marketing Attribution Breaks Across Meta, Google, TikTok, CRM and WhatsApp.
That context matters for strategy. This is not a policy preference that gets reversed by lobbying, feedback, or a strongly worded appeal. It is structurally connected to Meta's legal risk, and every signal from 2025 into 2026 points toward broader enforcement, not narrower.
How Meta can infer sensitive information you never meant to send
The reason a “just don't send anything sensitive” mindset fails is that sensitive context leaks in through channels most teams don't think to check:
- URLs and query parameters. A path like
/appointments/schedule?type=cardiologyor/shop/blood-sugar-supporttells Meta's crawler exactly what it needs to know, independent of any event you fire. - Event-specific data. Actions like “Schedule Consultation” or “Download Test Results” carry health context in the event name itself.
- Custom parameters. Fields like
content_name,diagnosis_code, orproduct_categorypassed through the Conversions API can reveal PHI even inside an otherwise neutral event. - Behavioral patterns. Repeated visits to condition-specific pages, tied to a device ID, let Meta infer sensitive interests even without an explicit event.
- Hashed identifier matching. Sharing hashed email or phone data via Advanced Matching can connect a user's health-adjacent activity to their broader profile.
This is why event names alone were never the real lever — and why Meta's 2025–2026 enforcement expansion, which added active scanning of custom event payload content, closed a gap that a lot of “rename it and you're fine” advice depended on.
The three-tier restriction system
Meta classifies restricted domains into three levels, and each one breaks a different part of your funnel.
Level 1 — Core Setup restrictions.Events still arrive at Meta, but sensitive parameters — custom data fields, URL parts beyond the domain — are stripped before they're used. Automatic Advanced Matching may stop working. Your data gets less precise, not absent. Custom audiences built on this data may shrink.
Level 2 — Standard Event restrictions.Purchase, Lead, AddToCart and other high-intent events stop arriving entirely. Upper-funnel events (PageView, ViewContent, Landing Page View) keep working. Campaigns shift into blind optimization — spending against impressions with no bottom-funnel signal to steer them. Custom events with genuinely neutral, registered names can still work here, but only if the full payload is also clean.
Level 3 — Full Domain restrictions. All conversion event sharing is cut off, regardless of event name. Custom events fail here too. The account can still run ads, targeted only by broad demographics. It does so with zero data.
How to check which level you're at
Go to Events Manager → your Pixel/Dataset → Settings → Manage Data Source Categories. You'll typically see one of these signals:
- A yellow warning indicator — Level 1. Compare your reported purchases to your actual order data (Shopify, your CRM); if they roughly match, you're likely at this level with limited impact.
- A red restriction indicator, Purchase/AddToCart missing but PageView working — Level 2. Your bottom-funnel numbers will visibly diverge from your real sales data.
- A red restriction indicator with PageView and ViewContent also missing — Level 3, often seen in EU accounts or for the most sensitive categories.
Meta also sends a notification to your Business Manager email when a restriction is applied — but that inbox isn't the one most marketing teams check daily, which is exactly why so many brands discover the problem only after a ROAS decline forces an investigation, weeks after the restriction actually started.
It's not just tracking — ad content rules apply too, and they got sharper in 2026
“Meta health and wellness restrictions” covers two separate systems that often get conflated: the data-sharing restrictions above, and content policy rules that apply to the ads themselves, reviewed independently through Meta's creative review pipeline. Both tightened materially in 2026, and the content side picked up several specific, easy-to-miss requirements.
The “implied transformation” ban now goes further than before/after. The long-standing ban on split before/after imagery was expanded in 2026 to cover impliedtransformations — a product shown next to an image of a visibly fit or healthy person is now treated the same as a literal before/after split, and a testimonial video where a customer describes their “journey” while looking healthy on camera can trigger the same classifier. This closed a common creative workaround from 2025.
Supplement ads now require an in-ad disclaimer, not just a landing-page one.Meta requires the line “This product is not intended to diagnose, treat, cure, or prevent any disease” to appear in the ad copy itself; ads missing it are auto-rejected. For EU-targeted campaigns, claims are additionally checked against the EFSA authorized health claims database.
Weight loss creative can no longer cite specific numbers or timelines.Claims like “lose 10 lbs in 30 days” are banned outright, alongside any time-bound transformation promise. Age targeting under 18 is prohibited without exception, and that restriction extends to lookalike audiences — a lookalike built from a source audience that includes minors can trigger enforcement even when the primary campaign targeting is configured correctly.
Medical devices and consumer wellness tech are policed differently based on positioning, not the product itself.The same physical device can fall under Meta's stricter Drugs and Pharmaceuticals policy or the lighter general wellness rules depending entirely on how it's marketed. Continuous glucose monitors are a specific 2026 enforcement focus: advertising a CGM for general wellness tracking to non-diabetic consumers gets scrutinized differently than advertising the same device for medical monitoring.
Mental health advertising now runs on three tiers. Licensed therapy and psychiatry platforms need healthcare authorization and credential verification. Meditation, sleep, and stress-management products face claim substantiation and exploitation-prevention rules without needing clinical licensing. Self-published or unlicensed-coach content is generally prohibited the moment its claims cross into medical territory. Underneath all three, Meta has tightened enforcement around targeting users showing behavioral signals of a mental health crisis, and around anxiety or depression treatment claims made without appropriate licensing.
Reproductive health and adult products: ads must target 18+, must frame messaging around medical benefit rather than pleasure, and cannot promote arousal products or services. Contraceptives, fertility apps, and family planning services are permitted within these limits.
Prescription drugs: telehealth providers, online pharmacies, and pharmaceutical manufacturers need LegitScript certification and Meta pre-approval; direct sale of prescription drugs on-platform is prohibited outright.
The throughline across all of it: second-person language that implies something about the viewer (“you have,” “are you struggling with”) is treated as higher risk than neutral, product-first, third-person framing — whether it's tripping the creative reviewer or contributing to a domain's data classification.
How Meta actually enforces this: the Multimodal Ad Review System
Since a Q1 2026 update, Meta's creative review runs on what's referred to as its Multimodal Ad Review System — an automated pipeline that reads ad text, imagery, video, and the destination landing page as a single connected unit rather than reviewing each in isolation, before the ad ever serves a first impression. That's a meaningful shift from 2025, when a compliant ad pointing to a non-compliant landing page could still get approved. In 2026, the landing page is part of what gets scored.
Following Meta's March 2026 enforcement update, health, wellness, and beauty advertisers saw rejection rates rise sharply quarter-over-quarter — consistent with retroactive auditing of previously approved ads, not just tighter review of new submissions. An ad that was compliant and running in late 2025 is not guaranteed to still be compliant under 2026 review, even if nothing about the ad itself changed.
Where brands still get the tracking fix wrong
A few pieces of advice keep circulating that no longer hold up on their own. Each one addresses a real part of the problem, but none of them is sufficient by itself.
- “Just rename the event.” Renaming
PurchasetoCompletedOrderchanges the label Meta sees, not the payload underneath it. If that payload still contains a product name, content ID, or URL path that implies a health condition, the event gets caught regardless of what it's called. The name is the least important variable in the payload. - “Switch to server-side tracking and CAPI, that bypasses it.” The Conversions API is subject to the same domain-level data sharing rules as the browser pixel. If the domain is restricted, server-side events carrying the same sensitive payload are suppressed on arrival, the same way browser events are. CAPI is the correct delivery mechanismfor a compliant setup, but it doesn't launder a payload that shouldn't have been sent in the first place.
- “Move the pixel to a subdomain.”Meta's restrictions apply at the root domain level. A subdomain pointing to the same flagged root inherits the classification — this masks nothing for Level 2 and above.
- “File an appeal.”Meta's review process for data source categories is automated, takes no supporting documentation, and rejects most submissions within days. It's worth filing if your domain was genuinely misclassified — an ergonomic furniture brand flagged as medical equipment, for example. If your domain legitimately sells supplements, telehealth services, or anything condition-adjacent, the classification is accurate, and an appeal isn't going to reverse an accurate read.
- “Move budget to top-of-funnel campaigns instead.”Optimizing for Traffic or Landing Page Views when Purchase events are blocked gets you people who click, not people who buy. It's a different, weaker campaign — not a workaround for the one you had.
What a compliant setup actually requires
The events that survive Meta's 2026 enforcement share three properties at once. Missing any one of them is why partial fixes keep failing.
1. The event name is genuinely neutral. Not a disguised synonym for Purchase or Lead— a name with no semantic tie to the action or the product category. This is necessary, but on its own it does almost nothing.
2. The full payload is cleansed, not just the event name. Every field the event carries — product name, content ID, category, custom parameters, and the URL path itself — needs to be scrubbed of anything that implies a specific health condition or treatment. “Diabetes Management Kit” and /shop/blood-sugar-support are both classification triggers regardless of what the event around them is called. What Meta should receive is a payload that confirms a valid commercial action happened, without describing what was actually bought.
3. Delivery happens server-side, with deduplication.Once the payload is clean, it should be sent through the Conversions API rather than relying solely on the browser pixel, which is fragile under iOS tracking prevention and ad blockers to begin with. Where browser and server events overlap, they need matching event IDs so Meta doesn't double-count the same action.
This is close to what we described in our breakdown of Conversions API vs. pixel vs. server-side tracking — the difference here is that for a restricted health and wellness domain, the payload design has to happen before the delivery method matters at all.
For accounts sitting at Level 3, this three-part fix restores signal quality but not full event flow, since Level 3 blocks event sharing outright regardless of payload. Recovering from full domain restriction is a structural conversation, not a tracking-configuration one, and it's worth treating as a separate workstream rather than expecting a single event-mapping fix to solve it.
What this looks like in practice
We rebuilt exactly this pipeline for an online pharmacy client whose AddToCart and Purchase events had been restricted under Meta's health and wellness controls. Their catalog — medicines, vitamins, mother-and-baby products, medical equipment — meant almost every product page and event parameter carried some health-adjacent context by default.
The fix wasn't a workaround. It was compliant event filtering, a neutral event taxonomy that described the commerce stage without describing the medical need behind it, URL and parameter sanitization before anything left the browser, server-side delivery through Meta's Conversions API, and browser/server event deduplication — all sitting on top of first-party attribution so the business had a view of revenue that didn't depend entirely on what Meta's dashboard could still see.
The result was cleaner conversion feedback reaching Meta, stronger campaign optimization, and a more dependable attribution view than platform reporting alone could offer. Read the full case study.
The principle underneath it, worth repeating: Meta needs to know a valid commerce outcome happened. It does not need the sensitive context surrounding that outcome. Every part of a compliant setup exists to preserve the first half of that sentence while removing the second.
A practical checklist
If you haven't already been flagged, treat this as a pre-emptive build, not a contingency:
Implementation Checklist
- Check your classification now. Events Manager → your Pixel/Dataset → Settings → Manage Data Source Categories. Don't wait for a ROAS drop to go looking.
- Audit payloads, not just event names. Pull every parameter your current events send — product names, content IDs, category fields, URL paths — and flag anything condition-adjacent.
- Audit your URLs separately. Page paths and query strings are classified independent of any pixel event; a health-adjacent slug can trigger classification on its own.
- Design a neutral event taxonomy before you need it. Custom events require a training period; Meta's algorithm has to accumulate data before it can optimize against a new event name. Set this up while standard events are still functioning, not after they've been cut off.
- Move delivery server-side with CAPI, and deduplicate. This is the transport layer for the cleansed payload, not a bypass on its own.
- Never place tracking on patient portals or account dashboards. Pages where a user views personal health records or order history should not carry a browser pixel at all.
- Keep a first-party attribution layer running underneath. Platform reporting changes when policy, consent, or technical restrictions change. A first-party view of revenue is the part that doesn't move when Meta's rules do.
- Separately, audit your creative against the 2026 content rules. Confirm supplement ads carry the required disclaimer in the ad copy itself, weight loss creative avoids specific numbers or timelines, and no image implies a before/after transformation even indirectly. This is a different review track from the tracking fixes above, but it's evaluated by the same review pipeline and can independently trigger rejection or re-classification.
Feeling overwhelmed? Aixel handles the pipeline
Designing a neutral event taxonomy, sanitizing every payload field, standing up server-side delivery, and keeping browser and server events deduplicated is a real engineering project — one most marketing teams don't have the bandwidth to own on top of running campaigns.
Aixel builds and maintains exactly this pipeline: compliant event filtering, neutral event mapping, URL and parameter sanitization, server-side delivery through Meta's Conversions API, deduplication, and a first-party attribution layer that keeps working even as platform rules change. It's the same architecture behind the online pharmacy case study above, and it connects to the same unified measurement layer we use to tie web, CRM, WhatsApp, and offline revenue together for brands beyond just Meta (see WhatsApp Is Your Sales Floor and Generative Engine Optimization in 2026 for broader channel applications).
Don't wait for a silent restriction to show up as a ROAS drop three weeks from now.
Frequently Asked Questions
What is the difference between PII and PHI in Meta's health and wellness policy?
PII (Personally Identifiable Information) is any data that identifies a specific person — name, email, phone, IP address. PHI (Protected Health Information) is the subset of PII tied to health — medical records, prescriptions, diagnoses, appointment types. Meta's health and wellness restrictions exist specifically to prevent PHI, or data that implies PHI, from reaching its ad systems, even when that data is combined with otherwise-ordinary PII like a hashed email.
Does renaming a Purchase event to a custom event name fix Meta's health and wellness restriction?
Not on its own. Meta evaluates the full content of the event payload, not just the event name string. A custom event that still carries a sensitive product name, category, or URL path in its parameters will be detected and suppressed. The name has to be neutral and the payload has to be cleansed — both conditions, not either one.
Does switching to the Conversions API bypass the restriction?
No. CAPI is subject to the same domain-level data sharing rules as the browser pixel. If the domain is restricted, server-side events carrying a sensitive payload are suppressed on arrival the same way browser events are. CAPI is the right delivery mechanism for a compliant, already-cleansed payload — it isn't a workaround by itself.
Is it worth appealing a health and wellness classification?
Only if the classification is genuinely wrong for what you sell — for example, a fitness apparel brand flagged as weight-loss, or a food brand flagged as supplements. If your domain legitimately sells supplements, telehealth, or condition-adjacent products, the classification reflects reality, and the appeal process is unlikely to reverse it.
Does moving to a subdomain avoid the restriction?
No. Meta's classification applies at the root domain level, and a subdomain pointing to a restricted root inherits the same classification. This provides no relief at Level 2 or above.
Do these restrictions only apply to obvious healthcare brands?
No. Meta's classification uses behavioral inference, not just clinical keywords. Supplement brands, fitness equipment sellers, skincare brands with acne or redness messaging, and mental wellness apps have all been flagged. If your product is associated with a physical or mental health condition in the buyer's mind, it's worth checking your classification even if you don't think of yourself as a health brand.
Are CBD, telehealth, and med spa brands affected the same way?
They're generally affected more severely, not the same way. CBD and other regulated substances, telehealth and provider/patient portal services, and cosmetic procedures at med spas are among the categories most likely to land at Level 2 or Level 3, since the product or service itself directly implies a health condition or treatment relationship.
How long does it take for a restriction to affect campaign performance?
It depends on the level. Level 1 degrades attribution and audience quality gradually as parameters get stripped. Level 2 produces an immediate drop in lower-funnel reporting, with the full impact on optimization and CPM building over the following weeks as Meta's algorithm loses its conversion signal. Level 3 is an immediate blackout in all event data.
Do supplement ads need a disclaimer on Meta in 2026?
Yes. As of 2026, Meta requires the line 'This product is not intended to diagnose, treat, cure, or prevent any disease' to appear in the ad copy itself, not only on the landing page. Ads missing it are auto-rejected. Campaigns targeting the EU face an additional check against the EFSA authorized health claims database.
Does showing a product next to a fit or healthy-looking person count as a before/after ad?
It can. Meta's 2026 policy expanded the before/after ban to cover 'implied transformations' — a product placed next to an image of a visibly fit or healthy person is evaluated the same way as a literal before/after split, and testimonial videos describing a customer's 'journey' while looking healthy can trigger the same classifier.
Can I advertise a continuous glucose monitor or similar wellness device on Meta?
It depends entirely on positioning, not the device itself. The same physical product can fall under Meta's stricter Drugs and Pharmaceuticals policy or its lighter general wellness rules depending on how it's marketed. CGM advertising to non-diabetic consumers for general wellness tracking is a specific 2026 enforcement focus and is reviewed differently than the same device marketed for medical monitoring.
Ready to recover your attribution signal?
Connect Meta, Google, TikTok, and WhatsApp in one platform. No code required.
Get started free
