If your brand touches health in any meaningful way, your paid-media setup has changed substantially over the past 18 months. Google has tightened enforcement around health-sensitive personalized advertising, and Meta’s largest Health and Wellness Advertising Standards rewrite landed July 22, 2026.

Policy pages describe what is restricted, not how to keep running effective campaigns inside those restrictions. This operational guide covers what is off-limits, what remains available, and how to adapt audience strategy, creative, landing pages, and measurement across both platforms.

These restrictions apply broadly: brands can be classified as health-sensitive when pixel data, creative, or site content implies a connection to health status, medical conditions, or provider-patient relationships. Google and Meta do not use the same enforcement model, so a single shared playbook is a mistake.

Google Ads: How Health Restrictions Actually Work

Google’s health rules sit inside its Personalized Advertising Policy. They govern campaigns when ad content, landing pages, or targeting touch health-sensitive subject matter, whether or not personalization was the intent.

What Google Considers Health-Sensitive

The policy covers physical or mental health conditions, products and procedures used to treat chronic conditions, intimate body functions, invasive procedures including cosmetic surgery and injections, and disabilities — including ads directed at caretakers rather than patients.

Advertiser-Curated vs. Predefined Audiences

Google prohibits advertiser-curated audiences in health-sensitive campaigns: Customer Match, first-party segments, remarketing lists, similar segments, lookalikes, and audience expansion. Predefined Google audiences — in-market, affinity, demographics, life events, location targeting, and carefully configured custom segments — remain permitted. Search keyword targeting remains compliant.

What Changed in 2025 and 2026

Google reintroduced a narrow HCP carve-out for licensed healthcare professionals acting in a professional capacity. It does not unlock consumer health audiences. Custom segments using sensitive creative or health-sensitive landing pages are now restricted to contextual or non-sensitive Display use; other campaign types may not serve.

The Three Places Google Looks for Violations

Google evaluates ad content, targeting, and landing pages together. Persistent flags are often a landing-page issue, especially condition-specific language such as “alleviating chronic pain.” Audit destination content alongside ads and audience settings.

Google Remediation Options

Remove advertiser-curated audiences from campaigns, ad groups, and asset groups; revise ad or landing-page content; or appeal when a flag is genuinely incorrect. Appeals are useful for ambiguity, not as a substitute for resolving an underlying issue.

Meta Ads: A Different Framework Entirely

Meta classifies an entire data infrastructure and assigns a restriction tier. The July 2026 rewrite shifted enforcement from category-based rejection toward claim-by-claim review: what an ad says matters more than what category it appears to be in.

Meta’s Three-Tier Data Classification

Core accounts — general wellness without health claims — retain full access. Mid-Restricted accounts, such as supplement brands, fitness trackers, and diet programs, lose lower-funnel optimization for purchases, leads, and appointments. Full-Restricted accounts, including telehealth, pharmacies, mental-health apps, medical-device manufacturers, and pharma, lose conversion signals and are limited to page-view data.

Check the data-source category in Meta Events Manager under Settings and “Manage Data Source Categories.” Reviews generally take three to seven business days; rejected appeals cannot be re-submitted for 30 days.

What the July 2026 Rewrite Changed

Before-and-after imagery for weight-loss and cosmetic products can run only when surrounding copy avoids guarantees, timelines, and body-inadequacy claims. General supplements can advertise without a default 18+ requirement, except where weight-loss or weight-gain claims restore it. Pinched-fat imagery, skin whitening, sexual enhancement, testimonial transformations, and implied image-sequence transformations remain prohibited.

Audience Targeting and Naming Conventions

Sensitive-health custom and lookalike audiences are proactively flagged. Special Ad Audiences are deprecated for health and wellness, so broad targeting guided by creative relevance is the primary mechanism. Meta also scans audience names, conversion-event names, and metadata; use generic operational names such as “lead_form_complete” and “site_visitors_30d,” not condition or appointment-specific labels.

Aligning Objectives to Your Tier

Full-Restricted accounts should use awareness, engagement, and traffic objectives. Mid-Restricted accounts should use upper-funnel proxies such as Landing Page Views, ViewContent, and Search events. Core accounts retain access but should audit data-sharing practices, because reclassification mid-flight is disruptive.

Creative and Landing Page Strategy Across Both Platforms

Both platforms evaluate ads and destinations as a single compliance unit. Avoid second-person health framing, outcome guarantees, fear-based language, and condition-specific targeting language. Use solution-framed descriptions instead: “Support joint mobility” rather than “for people with arthritis,” or “Designed for restful sleep” rather than “for sleep apnea patients.”

Audit every title, H1, H2, testimonial, image sequence, and privacy-policy link. Make provider credentials visible, ensure health-related form data is handled appropriately, and confirm that landing-page claims match ads. Meta requires supplement disclaimers directly in ad copy, not only on product pages.

Measurement, Certifications, and Account-Level Risk

Google requires LegitScript certification for online pharmacies, telemedicine providers, and addiction-treatment services; health insurers need G2 Risk Solutions certification. Meta requires active LegitScript certification for pharmacies and telehealth, while pharmaceutical manufacturers may use Meta authorization. Missing required certification can put the entire account at risk.

For Google search-only health campaigns without advertiser-curated audiences, standard conversion tracking remains available. Mid-Restricted Meta accounts should optimize toward upper-funnel proxy events; Full-Restricted accounts should measure reach, engagement, and traffic while closing attribution offline through CRM and call tracking. HIPAA-compliant form and call tracking is essential.

The Pre-Launch Compliance Checklist

Google: remove Customer Match, remarketing, similar segments, and audience expansion from health-sensitive campaigns; review custom segments; avoid personal-attribute framing, guarantees, and alarmist language; support every claim on the landing page; show credentials, privacy information, and clear expertise signals.

Meta: confirm the data-source tier; align objectives to that tier; use generic names for audiences and conversion events; maintain required certification; include supplement disclaimers in ad copy; avoid personal attributes, transformation imagery, and body-shaming claims; ensure landing-page claims match ads and health-related forms use appropriate tracking.

If rejected, identify the policy category, then inspect all five layers: copy, creative, video audio, landing page, and Special Ad Category selection. Make targeted corrections rather than broad rewrites, then resubmit the specific ad or account element.

The Bottom Line

Health advertising restrictions are becoming more automated, more broadly defined, and more likely to escalate at the account level when left unresolved. They are not a one-time legal task; they are an ongoing operational condition.

Effective brands treat compliance as an operational discipline. On Google, search remains largely intact. On Meta, creative quality and relevance increasingly do the targeting work once handled by data. Across both platforms, landing pages are often the highest-leverage compliance variable.

Treat naming conventions, certification status, Events Manager, audience settings, and destination audits as standing workflow items. The policy environment will keep moving; the internal ability to monitor and adapt is worth more than any single compliance fix.