- Meta enforces three healthcare advertiser tiers starting January 2025: Core Setup, Mid-Restricted, and Fully Restricted, each with different limits on what conversion data can be sent to the platform.
- Deep-funnel standard events including appointments scheduled and lead submissions are no longer available for campaign optimization for most healthcare advertisers.
- Custom events remain available to Core Setup and Mid-Restricted advertisers but must be registered, cannot mirror standard event names, and cannot include health-sensitive identifiers.
- Meta Conversions API is now required infrastructure for any healthcare advertiser still running performance campaigns on Meta, as browser-side pixels trigger restriction flags.
- Classification is automated and cannot be changed through software or appeals; no organization has successfully overturned a Fully Restricted classification through Meta's standard process.
- For the broader HIPAA compliance context behind these restrictions, see our HIPAA-Compliant Digital Health Marketing guide and HIPAA Attribution guide.
Starting January 2025, Meta enforced new data-sharing restrictions on healthcare advertisers. Here is what changed, what still works, and how Matchnode’s clients are adapting without sacrificing campaign performance.
Starting January 2025, Meta enforced new data-sharing restrictions that fundamentally changed how healthcare advertisers track conversions, optimize campaigns, and measure performance on Meta’s platforms. For digital health companies that had built patient acquisition programs on Meta’s pixel-based infrastructure, the enforcement did not arrive gradually. It arrived as a hard operational break.
The changes have more questions attached to them than answers. Meta categorized health and wellness advertisers into three restriction tiers, eliminated most deep-funnel standard events as optimization signals, and placed the compliance burden directly on advertisers. The platform’s messaging has evolved continuously since the initial announcement, and the practical implications differ significantly depending on which restriction tier an organization falls into. Getting that classification wrong in either direction, assuming more restriction than exists or less, produces bad campaign architecture.
This post covers what Meta’s data restrictions actually require, how the three classification tiers work in practice, what custom events can and cannot do under the new rules, and what Matchnode’s team has observed working with digital health clients through the transition. For the broader HIPAA compliance infrastructure context behind these restrictions, including server-side event routing, BAA requirements, and data minimization protocols, see our HIPAA-Compliant Digital Health Marketing guide. For the attribution infrastructure that replaces pixel-based tracking in this environment, see our HIPAA-compliant attribution guide.
Matchnode has been operating at the intersection of Meta advertising and healthcare compliance since before the 2022 HHS bulletin changed the baseline. Co-Founder Brian Davidson joined a roundtable hosted by Adam Putterman of Ours Privacy alongside Chris Turitzin, former Chief Growth Officer at Bicycle Health, and Yulia Kachalina of MedsGo to work through the implications of these restrictions in real time. What follows reflects both that collaborative analysis and our ongoing work with digital health clients adapting their Meta programs to the new environment.
Why Meta Restricted Healthcare Advertiser Data
Meta’s restrictions on healthcare advertiser data did not arrive without context. The platform was responding to the same regulatory pressure that produced the HHS pixel-tracking bulletins in 2022 and 2024, the accumulation of class-action settlements exceeding $100 million in healthcare pixel-tracking cases, and growing scrutiny of how health-sensitive behavioral signals flow from advertising pixels to ad platform servers. Meta’s response, categorizing health and wellness advertisers into restriction tiers and limiting what conversion data could be transmitted, placed the compliance infrastructure burden on advertisers while allowing the platform to reduce its own liability exposure.
The practical effect for digital health brands was significant. Meta had been one of the most effective patient acquisition channels in the sector because its broad audience reach combined with behavioral targeting allowed campaigns to reach high-intent health audiences at scale. The restrictions did not eliminate Meta as a channel, but they fundamentally changed the measurement and optimization architecture that made campaigns on the platform measurable and improvable.
The Three Restriction Tiers: What Each Means in Practice
Meta categorized health and wellness organizations into three tiers, each with materially different implications for campaign architecture. Understanding which tier your organization falls into is the prerequisite for every other decision.
Core Setup (Default for Most Health Advertisers)
Core Setup is the default classification for most health and wellness advertisers. It restricts the transmission of custom parameters and any information in a URL following the domain. Advertisers must ensure event tracking does not include prohibited data or custom parameters. Top-of-funnel events, including page views and content interactions without health-specific URL parameters, remain available for optimization. Registered custom events are allowed, with restrictions on naming and data content. The Conversions API becomes required infrastructure rather than optional enhancement.
To determine your restriction level, go to Events Manager, select your Pixel, open the Settings tab, and find the “Manage data source categories” section. Categories like “Health and Wellness portals” are fully restricted. “Health and Wellness providers” and “Health and Wellness conditions” are partially restricted, allowing limited functionality.
Mid-Restricted (Health Systems and Multi-Discipline Providers)
Mid-Restricted applies to multi-discipline health systems and certain broad healthcare providers. Optimization for mid- and lower-funnel events including appointment scheduling and lead submission is restricted, limiting conversion retargeting and reducing the algorithm’s ability to learn from confirmed patient actions. Some custom event functionality remains available, but the optimization ceiling is lower than Core Setup.
Fully Restricted (Patient Portals and Condition-Specific Platforms)
Fully Restricted applies to organizations Meta classifies as patient portals and condition-specific health platforms. No event data, including custom events, can be sent or processed. Pixel and Conversions API are both unavailable. The only viable use of Meta advertising for Fully Restricted organizations is brand awareness campaigns with no conversion data feedback loop. To date, no organization has successfully overturned a Fully Restricted classification through Meta’s appeals process.
How Classification Works and Why You Cannot Appeal Effectively
Meta’s classification is automated. It is based on how Meta’s systems categorize the organization’s primary domain, the nature of the health and wellness subcategory it falls into, and signals from the organization’s advertising history and website content. There is no software, tag configuration, or technical setup that changes the classification. Meta offers an appeals process through Ads Manager, but it is a basic and automated system that does not allow advertisers to submit supporting documentation or evidence. Matchnode’s experience and reports from across the industry confirm: no organization has successfully overturned a classification through the standard appeals path.
The practical implication is that classification is a fixed operational constraint. Campaign architecture must be built around it, not against it.
Custom Events: What Still Works and What the Rules Require
Custom events remain available to Core Setup and Mid-Restricted advertisers, but under specific rules that differ from pre-restriction practice. Understanding these rules is essential because the errors that trigger restriction enforcement typically come from misapplied custom event configurations.
- Registration required. All custom events must be registered through Meta’s Events Manager. Custom events that have not been registered are automatically blocked until the advertiser reviews and confirms them.
- Cannot mirror standard events. A custom event cannot be a renamed version of a standard event. Creating a custom event called “IntakeComplete” that fires on the same trigger as a standard “Lead” event is a violation.
- Cannot include sensitive identifiers. Custom event names and parameters cannot reflect, imply, or be based on prohibited health information. Event names like “ScheduledTherapy” or “DiabetesLead” violate the naming rules regardless of the underlying data.
- Not available to Fully Restricted organizations. Custom events are only available to Core Setup and Mid-Restricted organizations.
Brian Davidson on What the Restrictions Actually Mean for Digital Health
Matchnode Co-Founder Brian Davidson recorded a 23-minute breakdown of Meta’s new data restrictions and their impact on digital health companies shortly after enforcement began. The video covers the classification tiers, what the custom event rules require in practice, and how digital health brands should restructure their Meta campaign architecture. For anyone managing or overseeing Meta campaigns for a healthcare organization, this is the clearest operational summary of what the enforcement actually requires.
The Ours Privacy Roundtable: Key Takeaways
Brian Davidson joined a roundtable hosted by Adam Putterman, Co-Founder of Ours Privacy, alongside Chris Turitzin, former Chief Growth Officer at Bicycle Health, and Yulia Kachalina, Co-Founder and COO of MedsGo, to work through the implications of Meta’s restrictions before enforcement began. Several conclusions from that discussion have proven accurate in practice.
- Deep-funnel events are effectively eliminated. Meta confirmed during the roundtable that healthcare organizations would no longer be able to optimize campaigns using deep-funnel conversion events. Without adjustments, most healthcare campaigns would become significantly less effective at patient acquisition.
- Advertiser responsibility is non-negotiable. Meta’s messaging placed the compliance burden on advertisers, not on the platform. This means the technical and operational work of ensuring compliant event configuration falls entirely on the advertising organization or its agency.
- CDPs and privacy-first workflows are the infrastructure requirement. Kevin T. Holland of Holmusk, who attended the roundtable, noted in a post-event summary that building compliant technical stacks using Customer Data Platforms and privacy-first event workflows is the necessary response to the restrictions.
Adapting Your Strategy: What Matchnode Is Testing
For our digital health clients, we are not waiting for policy updates to force changes. We are already testing these approaches to ensure preparedness. Meta’s restrictions may fundamentally change how campaigns are structured, so we are actively experimenting with alternative formats and approaches now.
Build Microsites
Certain general-purpose websites may allow broader tracking capabilities. For digital health businesses, this could mean developing subdomains or microsites designed specifically to run compliant ad campaigns while maintaining essential tracking functionality.
Leverage Lead Ads
On-platform signals like lead forms with dynamic logic and filtering are already proving effective. For example, Matchnode successfully implemented this approach for Bicycle Health, driving leads while staying within compliance.
Maximize Other Platforms
To mitigate the impact of Meta’s restrictions, we are diversifying ad spend across platforms like TikTok, Google, Reddit, and Pinterest. This ensures performance stability while reducing reliance on a single platform.
Experiment with Non-Restricted Events
View Content optimization, search-related events, quizzes, and app installs are being explored as alternatives to traditional conversion events.
Focus on Top-of-Funnel Strategies
Video views, reach campaigns, and Messenger Ads with AI bots are being used to build audiences, with retargeting campaigns following later.
Develop Compliant Websites
If necessary, entirely new websites with legacy conversion optimizations can be built to navigate the stricter requirements.
Audience Strategy Under the Restrictions: What Still Performs
With interest-based health condition targeting restricted and lower-funnel optimization unavailable for most healthcare advertisers, the audience architecture that performs on Meta has shifted to first-party data seeding and broad audience approaches.
- CRM-based Custom Audiences. Uploading hashed email and phone lists from confirmed patient CRM records remains available and effective. These Custom Audiences can seed Lookalike Audiences that let Meta’s algorithm find similar high-intent users without requiring sensitive targeting data.
- Broad audience with algorithm optimization. Meta’s algorithm, when given sufficient compliant signal volume through CAPI-routed custom events, performs comparably to manual interest-stack targeting in most behavioral health categories. Broad audience with algorithm-driven optimization often outperforms restricted interest targeting.
- Meta Limited Data Use (LDU) configuration. LDU settings must be correctly applied to all events where applicable and reviewed against current Meta policy. Incorrect LDU configuration is one of the most common sources of ongoing restriction flags for healthcare advertisers.
What Has Changed Since Enforcement: The 2026 Update
Meta’s approach to healthcare data restrictions has evolved significantly since the January 2025 enforcement date. Three shifts matter most for healthcare advertisers in 2026.
The 3-tier restriction system is now formal and account-level
Level 1 (Core Setup) strips custom parameters and URL components from pixel data, degrading audience quality gradually. Level 2 (Standard Event Restrictions) blocks Purchase, Lead, and AddToCart event optimization and Lookalike audiences built from website activity. Level 3 (Full Domain Restriction) blocks all event sharing regardless of event name or payload. Check your level in Events Manager under Settings, then Manage data source categories. EU enforcement is stricter than US enforcement for the same domain.
A second wave hit healthcare lead generation in early 2026.
Lead-gen events including Schedule, Lead, and CompleteRegistration face further restrictions. Medical practices, behavioral health clinics, telehealth providers, and other lead-driven healthcare advertisers are most affected.
Meta’s Multimodal Ad Review System (MARS) deployed in March 2026.
MARS reviews text, visuals, audio, landing pages, and advertiser history as a single unit, so compliant ad copy paired with a non-compliant landing page now triggers ad-level rejection. Personal-attribute detection was expanded to flag indirect framing like “for people managing diabetes.” Behavioral inference now drives classification, so adjacent product categories can trigger Health and Wellness restrictions without clinical language in the ad.
The myth that does not work: renaming custom events alone does not bypass restrictions. Custom event names work for Level 1 and Level 2 only when the entire payload is also cleansed of sensitive signals and the event is registered in Events Manager.
What actually works in 2026: a three-part architecture combining server-side payload cleansing via Conversions API (with PHI stripped before transmission), a clean intermediary domain with no restriction history, and a persistent ID system that preserves attribution across domains. Healthcare advertisers running this stack are seeing Event Match Quality scores of 8.5 to 9 out of 10, compared to 5 out of 10 under default restrictions.
For the implementation layer, see our HIPAA-compliant technical services. For broader regulatory context, see our companion guide on pixels, HIPAA, and the HHS.
May 2026: MARS, the Account Health Score, and Retroactive Auditing
Meta’s enforcement architecture shifted from reactive to proactive in early 2026 with three changes that caught many healthcare advertisers off guard.
- MARS (Multimodal Ad Review System) reviews every ad as a single compliance unit: text, visuals, audio, landing page, and advertiser account history evaluated simultaneously before the first impression is served. Meta implemented 47 documented policy updates in 2026, the most extensive revision cycle since the original Special Ad Categories rollout. Health-related ad rejections spiked 34% in Q1 2026 versus Q4 2025 as MARS replaced the older keyword-based review system.
- The Account Health Score is now a live operational metric. Accounts scoring below 50 face slower review queues. Scores below 25 result in restricted ad delivery regardless of individual ad compliance. Check your score in Account Quality inside Ads Manager.
- Retroactive auditing is now active. Previously approved ads can be flagged under MARS if they fail its multimodal review. Healthcare advertisers who ran broad awareness campaigns in 2025 should audit their active ad inventory against MARS criteria, not just new creative.
One critical nuance on CAPI compliance: CAPI is not a HIPAA solution by itself. Meta does not sign Business Associate Agreements for CAPI any more than for the browser pixel. The compliance comes from what data is sent, not which API sends it. The recommended path routes events through a HIPAA-compliant CDP such as Ours Privacy that signs a BAA, strips PHI from event payloads, and forwards de-identified events to Meta. See our HIPAA-compliant attribution guide for the full server-side implementation checklist.
Spike in health-related ad rejections in Q1 2026 vs Q4 2025 following MARS deployment
Documented Meta policy updates in 2026 alone, the most extensive revision cycle since Special Ad Categories
Event Match Quality score achievable with compliant CAPI stack (server-side cleansing + clean domain + persistent ID)
Event Match Quality score for healthcare advertisers on default CAPI configuration under active data restrictions
Timeline: How the Restrictions Unfolded
We have been tracking Meta’s policy changes in real time since the initial announcement. The accordion below documents every significant update from November 2024 through 2026, including Brian’s full roundtable video and the Matchnode team’s direct observations from client accounts.
Meta has continued to update the ad platform in ways that will impact ad performance if they don’t already. If you are a digital health company or fall under partially restricted advertising, these updates will impact how you track conversions and optimize campaigns.
Real-time event speed is now essential
Meta now prioritizes event speed for ad performance. With pixel redundancy no longer an option, businesses must improve their Conversions API (CAPI) event speed:
- Real-time (0-5 seconds): Best for attribution and machine learning.
- Near real-time (5-30 seconds): Still effective but with minor delays.
- Delayed (30 seconds to 1 hour): Reduces accuracy, especially for retargeting.
- Batch processing (over 1 hour): Poor for real-time optimization.
Note: CAPI is not a HIPAA compliance solution by itself. Meta does not sign BAAs for CAPI. Route your events through a HIPAA-compliant CDP such as Ours Privacy that strips PHI before transmission. See our attribution guide for the full server-side implementation checklist.
Many advertisers in digital health have noticed that CAPI default event speed is around one hour, which can negatively impact performance.
Actionable steps
- Ensure server-to-server (S2S) connections instead of batching via third-party tools.
- Monitor CAPI response times in Meta’s Events Manager.
- Without pixel redundancy, real-time event delivery is more critical than ever.
Domain URL parameter removal
One major change is the removal of domain URL parameters, which previously indicated where conversions were happening. This impacts funnel tracking, landing page optimization, and conversion analysis.
- Without domain URL parameters, advertisers can no longer create custom conversions based on this data.
- Custom conversions are now shifting into custom events, requiring a strategy shift.
Standard events are no longer accepted
If you clicked Meta’s 30-day extension, the transition is now complete. Standard events are permanently unavailable from optimization. Meta will no longer accept standard event data for targeting and optimization. Businesses must switch to custom events and custom conversions to maintain tracking. This is happening automatically inside accounts.
Legacy campaigns stop ingesting event data
While legacy campaigns will not be turned off, they will stop ingesting events. While ads may still run, they will not optimize using conversion data. Our team has been actively monitoring these changes, collaborating with the Ours Privacy team, and we are seeing a consistent shift in data trends.
Meta officially announced the enforcement timeline for the additional data sharing restrictions, set to begin between January 13, 2025 and January 20, 2025. This confirms that the rollout will occur in phases, with different data sources being impacted on different dates within this window.
Meta offered a 30-day extension option for advertisers who needed more time to adapt. This extension could be requested through a “Request more time” button that appeared in Events Manager starting January 6, 2025. The button was visible for seven days, and clicking it added 30 days to the remaining time before enforcement on that specific data source.
Key points to remember
- Each data source (pixel or app) had its own extension request. Advertisers had to request extensions for each impacted data source individually.
- Sales representatives could not see or request the extension. Advertisers had to log into Events Manager themselves to check for the button.
- The extension did not affect data source categorization reviews.
The 30-day extension provided valuable time to refine strategies and ensure compliance before restrictions were fully enforced.
Meta provided additional updates regarding its data restrictions, including a slight adjustment to the enforcement timeline and more clarity on custom events.
- Timeline extended: Advertisers had the option to delay the restrictions by 30 days using a “more time” button available in early January. This pushed enforcement for some campaigns to February 14-21.
- Custom event naming rules: Advertisers can still use custom events, but these must now go through a registration process and adhere strictly to Meta’s terms.
- Fully restricted websites or apps will not be allowed to send custom events at all. This creates additional challenges for healthcare and healthtech advertisers managing campaigns on such platforms.
Meta released updated FAQs regarding custom events following the enforcement of third-party data restrictions.
- Prohibited information: Advertisers must not share any prohibited information with Meta, either directly or indirectly.
- Custom event naming rules: Custom event names must not reflect, imply, or be based on any prohibited information, such as sensitive health conditions or restricted data categories.
Chris Madden, Co-Founder of Matchnode, shared new insights from ongoing discussions with Meta:
- Custom events remain flexible: Advertisers will retain control over how custom events are used, provided they comply with Meta’s updated policies.
- Registration required: All custom events must be registered and cannot share sensitive or restricted data.
- Advertiser responsibility: Meta emphasizes that advertisers are accountable for ensuring compliance with these new rules.
Kevin T. Holland, Director of Product Management at Holmusk attended the roundtable discussion with Brian Davidson, Co-Founder of Matchnode, and reported in his blog that advertisers need to focus on building compliant technical stacks and leveraging tools like CDPs (Customer Data Platforms) and privacy-first workflows. These tools will be critical for maintaining performance under the new restrictions.
Brian Davidson, Co-Founder of Matchnode, joined a roundtable hosted by Adam Putterman, Co-Founder of Ours Privacy, alongside panelists Chris Turitzin, former Chief Growth Officer at Bicycle Health, and Yulia Kachalina, Co-Founder and COO of MedsGo, to tackle the impact of Meta’s upcoming healthcare data restrictions. Key takeaways included:
- Deep funnel events eliminated: Meta confirmed that healthcare organizations will no longer be able to optimize campaigns using deep-funnel conversion events. Without adjustments, most healthcare campaigns on Meta could become ineffective.
- Shift in messaging on custom events: Meta’s language around custom events is changing, with responsibility for restricting sensitive data being placed squarely on advertisers.
- Open questions remain on edge cases not covered in the initial policy guidance.
In this 23-minute video, Matchnode Co-Founder Brian Davidson breaks down Meta’s new data restrictions and their impact on digital health companies.
Bicycle Health navigated the Meta restrictions by moving to server-side Conversions API and removing browser-side pixels from patient-facing pages. After rebuilding their tracking infrastructure, their patient acquisition volume nearly doubled while cost per acquired patient declined by double digits. That performance outcome is a compliance and measurement story as much as a media story.
Read the Bicycle Health case study →Meta Healthcare Advertising: Before and After the Restrictions
Before Restrictions (Pre-Jan 2025)
- Standard events (Lead, Purchase, Schedule) used for campaign optimization
- Browser-side pixel transmits full event data including URL parameters
- Interest-based health condition targeting available
- Lower-funnel conversion retargeting audiences built from event data
- No event registration required
- Attribution relies on third-party cookies and browser fingerprinting
After Restrictions (Post-Jan 2025)
- Registered custom events only (standard events not accepted for optimization)
- Conversions API required, browser pixel creates restriction flags
- Interest-based health targeting restricted or removed
- First-party CRM lookalikes replace retargeting audiences
- All custom events must be registered before firing
- First-party data and offline conversion imports replace cookie attribution
Meta Healthcare Advertiser Readiness Checklist
Use this checklist to assess your current Meta campaign configuration against the January 2025 restrictions. This is an operational tool, not a substitute for legal counsel.
- ☐ You know your restriction tier. Core Setup, Mid-Restricted, or Fully Restricted. If you are unsure, check Events Manager and Ads Manager for restriction notifications.
- ☐ Browser-side pixels have been removed or suppressed on restricted pages. Standard Meta Pixel is not firing on patient-facing pages, intake forms, or any URL that includes health-condition-specific parameters.
- ☐ Meta Conversions API is live and sending server-side events. CAPI is configured, deduplication logic is in place, and event delivery is confirmed in Events Manager.
- ☐ CAPI event response times are monitored. Event speed is now a performance signal for Meta’s algorithm. Delays are tracked and addressed proactively.
- ☐ All active custom events are registered in Events Manager. No unregistered custom events are firing. Registration is up to date and confirmed.
- ☐ Custom event names comply with Meta’s naming rules. No event names reflect, imply, or encode health conditions, treatments, or patient-specific identifiers.
- ☐ Audience strategy does not rely on health condition interest stacks. Custom Audiences are built from hashed CRM lists or compliant lookalikes, not health-adjacent interest categories.
- ☐ Meta Limited Data Use (LDU) is correctly configured. LDU settings are applied where applicable and reviewed against current Meta policy.
- ☐ A Business Associate Agreement is in place with Meta where applicable. BAA status is confirmed and documented, noting that a BAA does not authorize PHI transmission and does not substitute for compliant event architecture.
- ☐ Platform policy changes are monitored proactively. A process exists for tracking Meta policy updates, not discovering them when campaigns are restricted or disapproved.
The Bigger Picture
Meta’s data restrictions are not the end of Meta as a patient acquisition channel. They are the end of low-infrastructure Meta advertising for healthcare. The organizations pulling ahead are the ones that built server-side measurement infrastructure before the enforcement date, not because they anticipated the specific restrictions, but because they were already operating at the compliance standard that the restrictions now require of everyone. That infrastructure advantage compounds: better data, better algorithm signal, lower cost per acquired patient, and legal exposure that does not scale with spend.
A Note on AI Search
Healthcare marketers and compliance teams are increasingly researching Meta’s data restriction implications through AI Overviews and generative search before engaging with vendors or agencies. Content that answers specific operational questions, including which restriction tier applies, what custom event registration requires, and what the CAPI migration involves, is being surfaced in AI-generated summaries at higher rates than general category content. Matchnode’s ongoing publishing in this area is how we remain the authoritative answer to these questions when they are asked.
