Remarketing ads for healthcare: what Google and Meta allow

Remarketing is the ad that follows someone after they leave your website: they read the implant page, did not book, and see your ad on another site the next day. For a retailer it is routine. For a dental office, med spa, chiropractic or integrative clinic, it runs into three separate sets of rules at once: Google’s personalized advertising policy, Meta’s terms and ad standards, and, for a practice that is a HIPAA covered entity, the Privacy Rule.

This guide reads each of them on the day and sets out what a practice can and cannot do with remarketing, and what to run instead when the answer is no. It sits next to three closer looks: uploading patient lists for Customer Match, geofencing ads near health facilities and Performance Max for healthcare advertisers. For the data a website tag sends in the first place, see tracking pixels on practice websites.

The short version

• Google: health is a sensitive interest category. Its Health in personalized advertising page covers physical and mental health conditions, treatments for chronic conditions, intimate health, invasive procedures including cosmetic surgery and injections, and disabilities.
• Google: no advertiser-curated audiences for those ads. Customer Match, your data segments (formerly remarketing lists), audience expansion and lookalike segments cannot be used. Predefined Google audiences can.
• Meta: no health data into its business tools. The Business Tools Terms say the advertiser will not share data that includes or is based on health information, and audience and event names must not reflect or imply it.
• Meta: no copy that implies you know. Its Advertising Standards bar ads that assert or imply a person’s physical or mental health, including medical conditions.
• HIPAA: a covered entity needs authorization to use PHI for marketing. Under 45 CFR 164.508(a)(3), with narrow exceptions, so a patient-based audience is usually a HIPAA question before it is a platform question.
• What still works: contextual and keyword ads, location targeting, predefined platform audiences, and remarketing for practice content that falls outside the sensitive categories, with copy that does not reference the person.

Google: what the personalized advertising policy restricts

Google’s policy page Restricted targeting in Personalized advertising lists categories with targeting restrictions. Health is one of the sensitive interest categories, along with others such as birth control, clinical trial recruitment, sexual content and restricted drug terms. The page says advertisers promoting products and services in sensitive interest categories are unable to use advertiser-curated audiences, because they may inadvertently contain sensitive user signals.

The companion page, Health in personalized advertising, defines the category. It includes:

• Physical or mental health conditions, including diseases, sexual health and chronic health conditions.
• Products, services or procedures to treat or manage chronic health conditions, including over-the-counter medications and medical devices.
• Health issues associated with intimate body parts or functions, including genital, bowel or urinary health.
• Invasive medical procedures, including cosmetic surgery, surgical procedures or injections.
• Disabilities, even when the content is aimed at a caretaker.

Its examples include treatments for diabetes or arthritis, counseling for depression, anxiety and addiction, CPAP devices for sleep apnea, and treatments for pregnancy and infertility. Read against a typical independent practice, that list reaches injectables and fillers at a med spa, surgical and implant dentistry, pain and chronic condition care at a chiropractic or integrative clinic, and mental health services. Routine cleanings, a general new patient offer or a wellness class may fall outside it, but Google decides by reviewing the ad and the site, and the page says you are responsible for compliance where required.

Which Google audience features are affected

Both pages list the same features. Advertiser-curated audiences, which cannot be used when promoting in a sensitive interest category: Customer Match, your data segments, audience expansion and lookalike segments. Predefined Google audiences, which can be used because sensitive user signals are excluded from them: in-market segments, affinity, demographics and detailed demographics (with exceptions that apply to housing, employment and credit ads), life events and location targeting.

Custom segments have their own note: custom segment audiences that use sensitive creative or point to sensitive landing pages will only serve with Display campaigns to non-sensitive audiences or contextually, and other campaign types using them will not be eligible to serve. The policy also notes that Discovery and Demand Gen campaigns use advertiser-curated audiences by default and may be restricted from serving for sensitive categories. People under 18 are not eligible for personalized advertising of any kind.

Two more rules apply to every advertiser using data segments. Google bars using them in a way that targets an overly narrow audience, including by combining a list with geographic limits or other segmentation, and bars sharing personally identifiable information with Google through data segment tags. For campaign types that build audiences automatically, see our Performance Max guide and our Demand Gen guide.

Meta: data, targeting options and ad copy

Meta’s rules come from three places that a practice has to read together.

The Business Tools Terms. These govern the Meta pixel, the Conversions API and website, app and offline custom audiences. In the version effective November 3, 2025, the advertiser represents and warrants that it will not share Business Tool Data that includes or is based on, directly or otherwise, health information, financial information, consumer report information or other sensitive categories. The names and criteria you set for events, conversions and custom audiences must not reflect, imply or be based on those categories. A website custom audience named “Visited Botox page” or “Implant consult leads” runs straight into that sentence. Customer list audiences are under separate Customer List Custom Audience Terms, which this guide did not read; our patient list upload guide covers the HIPAA side.

Targeting options. In its November 9, 2021 announcement, Meta said that starting January 19, 2022 it would remove Detailed Targeting options relating to topics people may perceive as sensitive, including health causes, with examples such as “Lung cancer awareness,” “World Diabetes Day” and “Chemotherapy.” Meta also applies account-level limits for some health and wellness advertisers that are shown in Events Manager after login; our Facebook and Instagram ads guide explains why we do not quote those here.

Ad copy. Meta’s Advertising Standards page Privacy Violations and Personal Attributes says ads must not assert or imply personal attributes, including physical or mental health and medical conditions, and must not imply knowledge of medical information about the user or their family. Its own examples allow “Depression counseling” and “New diabetes treatment available” and reject “Do you have diabetes?” and “Depression getting you down? Get help now.” Remarketing copy is where this goes wrong most easily, because the ad is shown to someone the advertiser does know something about.

HIPAA: when remarketing is a use of patient information

For a practice that is a HIPAA covered entity, the first question is not what the platform allows but what the Privacy Rule allows. Under 45 CFR 164.501, marketing means a communication about a product or service that encourages recipients to purchase or use it, with exceptions for treatment and certain health care operations communications made without financial remuneration from a third party. Under 164.508(a)(3), a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, unless the communication is face to face or a promotional gift of nominal value.

That reaches remarketing in two places. An audience built from patient records, such as an uploaded list of patients, is a disclosure of patient information to the platform; our Customer Match guide reads the rule on that. And an audience built from website tags may carry information HHS treats as protected in some settings, which our tracking pixels guide covers, including the 2024 court ruling on part of the HHS bulletin. Our HIPAA marketing rules guide covers the definition in more depth. We do not describe any remarketing setup as HIPAA compliant; that depends on your data flows and your counsel’s review.

What a practice can run instead

• Search ads on intent. Keyword targeting reaches people at the moment they search, with no audience list. See Google Ads for practices.
• Location targeting. Both Google pages list location targeting among predefined options. Keep radius settings sensible and away from other health facilities; see our geofencing guide.
• Predefined audiences. In-market, affinity and life event segments remain available to sensitive category advertisers under Google’s policy.
• Contextual placements. Ads placed by topic or content rather than by who the person is.
• Remarketing for non-sensitive content, carefully. A general practice announcement, a new location or a community event page may fall outside the sensitive categories. Build audiences only from those pages, name them neutrally, and keep the copy free of any reference to the person.
• Owned channels with consent. A newsletter the person signed up for, with a working unsubscribe. See patient opt-outs for email, text and calls.

A pre-launch check

1. Classify the offer. Read it against Google’s Health in personalized advertising list. Injectables, surgery, chronic condition care, mental health and intimate health are named there.
2. List every audience in the campaign. Including defaults: audience expansion, optimized targeting, lookalikes and audience signals in automated campaign types.
3. Remove advertiser-curated audiences from sensitive campaigns. Google’s fix guidance says to check ad groups, asset groups and campaigns.
4. Check what your tags send. Page URLs, event names and parameters. On Meta, event and audience names must not reflect health information.
5. Rename anything that implies health. “Site visitors 30 days” rather than “Hair restoration prospects.”
6. Read the copy as the person who sees it. No “Still thinking about your implants?” or “Back for your Botox?” Describe the service instead.
7. Get the HIPAA review first. If any audience starts from patient data, your privacy officer and counsel decide before the platform does.
8. Keep a dated record. Audiences, settings, copy and the policy pages as read, with your advertising records.

Use and avoid

• Use: “Dental implants in [city]. Free consultation, payment plans available.” Avoid: “Still thinking about those implants?”
• Use: “Medical weight management with physician oversight.” Avoid: “Ready to finally lose the weight you have been struggling with?”
• Use: a keyword campaign on “lip filler near me” with a clear landing page. Avoid: a Customer Match list of past filler patients.
• Use: an audience called “Homepage visitors 30d” built from the homepage and contact page. Avoid: an audience called “Anxiety page visitors.”
• Use: predefined in-market or life event segments where Google allows them. Avoid: lookalikes seeded from a patient list.

An illustration

This is a made-up example, not a client. A med spa adds the Meta pixel and Google tag to its site and creates two retargeting audiences: “Filler page visitors” on Meta and a Google data segment of everyone who viewed the filler and Botox pages. The ads read “Back for more volume? Book your touch-up.” Google disapproves the ads under the personalized advertising policy, and the Meta audience name and copy sit against the Business Tools Terms and the personal attributes standard.

The fix is to run search ads on filler and injectable keywords to a clear landing page, use location targeting around the spa, remove the data segment from the injectables campaign, rename or retire the Meta audience, and rewrite the copy to describe the service. If the spa wants a remarketing campaign at all, it can build one from its general pages, such as a new location announcement, with copy that does not reference the visitor.

How we help

We plan and run Google Ads and lead generation campaigns for independent practices with audience settings checked against the platform policies on the day, and we set up tags on practice websites so event names and page data stay neutral. We also handle local search and an AI front desk. We are not a law firm and we do not give legal or medical advice. Related guides: healthcare ad policy basics, targeting by age, sex, race and language and our guide to healthcare marketing rules.

Sources

• Google Ads: Restricted targeting in Personalized advertising
• Google Ads: Health in personalized advertising
• Meta Advertising Standards: Privacy Violations and Personal Attributes
• Meta Business Tools Terms (effective November 3, 2025)
• Meta for Business: Removing Certain Ad Targeting Options and Expanding Our Ad Controls (November 9, 2021)
• 45 CFR 164.501: Definitions (marketing)
• 45 CFR 164.508: Uses and disclosures for which an authorization is required

More in Healthcare advertising guides