Meta’s health data restrictions let it place a telehealth site’s data source in a “Health and wellness” category. That can trigger core setup (no custom parameters, URLs cut to the domain), blocks on some mid and lower funnel standard events, or full restrictions. The rules cover the Meta Pixel and the Conversions API alike.
Policy checked on October 24, 2026. Meta’s help pages show no “last updated” date.
How Meta puts a telehealth site in a restricted data category
Meta’s health data restrictions start with a data source category. Meta’s definition of Health and wellness names telemedicine outright:
“Is associated with medical conditions or specific health statuses, provider/patient relationships, services for accessing personal health information, or health-related products and services (examples include, a patient portal, wellness tracker, telemedicine platform, pharmacy, health insurance marketplace, or condition-specific support group).”
A GLP-1 telehealth site fits that description. For restricted categories, Meta lists three restriction types:
- “Core Setup: Restricts the sharing of custom parameters and parts of URLs following the domain.”
- “Restriction on certain standard events: Restricts the sharing of specific mid and lower funnel events.”
- “Full restrictions: Fully restrict the sharing of all events in specific regions or all regions. In these circumstances, Meta Business Tools cannot be used for ads purposes where restrictions are in place.”
Core setup can start four ways: Meta assigns a restricted category, your team self-categorizes into one, you get “multiple notifications” about prohibited data, or you switch it on. The notification route can put the tool “into a core setup for at least 90 days” (Meta).
Meta core setup, standard event limits and full restrictions compared
Of Meta’s three restriction types, core setup is the lightest and full restrictions end ads use of the tool.
| Core setup | Restriction on certain standard events | Full restrictions | |
|---|---|---|---|
| What stops | Custom parameters and “anything in a URL after the domain” | “specific mid and lower funnel events” (Meta doesn’t list them; check your dataset’s notice) | “all events” in the affected regions |
| Custom events | Blocked until you review and confirm them | Blocked until you review and confirm them | “may not be available to you” |
| Other effects | URL or parameter-based custom audiences “may not work as expected”; automatic advanced matching “may be unavailable” (set it up manually); Pixel catalog updates “may no longer work” | Not stated | Not stated |
| Meta’s suggestion | “most campaigns should continue to run as expected” | “leveraging more upper-funnel events” | Awareness, Engagements or Traffic objectives |
Media buyers and blogs often call these levels “Tier 1/2/3” or “mid-restricted.” Those labels appear on none of the 12 Meta help pages we read. Meta’s official names, from lightest to strictest, are core setup, restriction on certain standard events and full restrictions, so use those terms when you search Meta’s help center or read your dataset’s notice.
Meta’s own core setup example: “the URL https://jaspersmarket.com/clothes/summer/dresses?item=10 would be shortened to https://jaspersmarket.com/.” Custom audiences with rules on paths like /intake or /checkout “may not work as expected”.
GLP-1 tracking data that Meta treats as health information
Meta’s prohibited information list names data a typical GLP-1 funnel collects. Check each data point below against Meta’s wording and keep it out of what your Pixel and Conversions API send.
| GLP-1 funnel data point | Meta’s wording | What to do |
|---|---|---|
| Drug name in the URL path (e.g. /semaglutide/intake) | “Prescription medications” | Keep drug names out of URLs Meta receives. Core setup cuts URLs to the domain |
| BMI, weight or height from an intake quiz, sent as a custom parameter | “Body specifications, bodily activities, and biological cycles” | Don’t send quiz answers to Meta. Core setup stops custom parameters |
| Condition answers (e.g. type 2 diabetes) in a parameter | “Diseases, medical conditions and injuries” | Same as quiz answers |
| UTM values naming a drug or condition | “UTM parameters in a URL string may contain prohibited data” | Audit UTM values in your ads and landing page links |
| Custom event or conversion named after eligibility (e.g. “GLP1_Qualified”) | Names and criteria “must not reflect, imply, or be based on any prohibited information” | Block it in custom event review; the rule covers the criteria, so a new name doesn’t fix it |
| Pixel on logged-in patient portal pages | “You shouldn’t send information about people from web pages where visitors may log in” | Remove the Pixel from those pages |
Does the Conversions API change Meta’s health data rules?
No. Meta’s data use requirements say: “These requirements apply to all Meta Business Tools, including browser-side tools (like the Meta Pixel) and server-side tools (like the Conversions API).”
Meta adds a consent duty for the Conversions API: “Don’t share event data with Meta about people who haven’t given consent.”
How to check and appeal your data source category in Events Manager
Most checks and reviews start in Meta Events Manager: Datasets, your dataset, then the Settings or Diagnostics tab.
| Task | Path | Limit |
|---|---|---|
| Contest a category | Settings, Manage data source categories, Manage, View Details, Request review | Meta-assigned categories can’t be edited, only reviewed. Decision by email |
| Core setup on or off | Settings, Data restrictions, Core setup | “If Meta has turned on data restrictions for your core setup, you won’t be able to turn core setup off.” |
| Review custom events | Settings, Data controls, Manage event blocking, Review | If Meta denies a review of an event it blocked, “You won’t be able to request another review.” |
| Fix blocked parameters | Diagnostics, “Event parameters blocked”, Review | Repeat notices can mean core setup for at least 90 days |
| Contest a flagged custom conversion or audience | Request review in Ads Manager, Events Manager or Audience Manager | Flagged items can’t be used in new campaigns |
Meta allows one review request per blocked custom event, so request it only for events whose name, criteria and data carry no health information.
What Meta’s health data restrictions mean for GLP-1 campaign measurement
Meta says most campaigns keep running under core setup, but GLP-1 measurement has to be rebuilt around what Meta accepts:
- Under core setup, rebuild custom audiences that used URLs or custom parameters, and set up advanced matching manually.
- Confirm only custom events whose names and data carry no health information. Block the rest.
- Under standard event limits, check which events your notice names and test upper-funnel events.
- Under full restrictions, pick objectives that “do not rely on data shared through the Meta Business Tools”.
Our Meta media team plans campaigns and reporting around whichever of these limits applies to your dataset.
Ad content rules sit in Meta’s prescription drug ads policy for GLP-1 and the Meta weight loss ads policy.
Health data and tracking pixels: what US regulators said
US regulators have named the Meta Pixel in telehealth warnings. On July 20, 2023, the FTC and HHS’s Office for Civil Rights wrote to about 130 hospital systems and telehealth providers about technologies “such as the Meta/Facebook pixel and Google Analytics, that can track a user’s online activities.”
The FTC’s Health Breach Notification Rule doesn’t apply to HIPAA-covered businesses. Companies it does cover “could be subject to penalties of up to $51,744 per violation.”
FAQ
Can I turn core setup off?
Yes, if your team turned it on. If Meta turned on the restrictions, Meta says “you won’t be able to turn core setup off”. For a Meta-assigned category, request a review instead.
Is the Meta Pixel HIPAA compliant?
Meta’s pages don’t say. Meta’s terms prohibit sending health information through the Pixel or the Conversions API, and HIPAA status depends on the brand.
Does renaming a custom event help?
No. Meta’s rule covers the criteria behind an event as well as its name, and Meta “may also block new and existing custom events” that may contain prohibited information.
Sources
- Meta Business Help Center, About data source categories in Meta Events Manager · accessed
- Meta Business Help Center, Understand data sharing restrictions based on data source categories · accessed
- Meta Business Help Center, About core setup · accessed
- Meta Business Help Center, How to turn core setup on and off in Meta Events Manager · accessed
- Meta Business Help Center, How to manage data source categories in Meta Events Manager · accessed
- Meta Business Help Center, How to self-categorize your datasets and data sources in Meta Events Manager · accessed
- Meta Business Help Center, How to review custom events in Meta Events Manager · accessed
- Meta Business Help Center, About prohibited information · accessed
- Meta Business Help Center, Privacy and data use requirements for Meta Business Tools · accessed
- Meta Business Help Center, How to review blocked parameters in Meta Events Manager · accessed
- Meta Business Help Center, Understand restrictions on certain custom conversions · accessed
- Meta Business Help Center, Understand restrictions on certain custom audiences · accessed
- FTC, FTC and HHS Warn Hospital Systems and Telehealth Providers about Privacy and Security Risks from Online Tracking Technologies (July 20, 2023) · accessed
- FTC, Health Breach Notification Rule: The Basics for Business · accessed