Pop-ups on medical practice websites: the rules

A pop-up looks like a cheap way to collect more appointment requests: a new patient special, a newsletter sign-up, a reminder to book before the holidays. On a practice website it can also cover the phone number on a phone screen, trap a keyboard user, hide the page from Google’s ad reviewers and collect health details through a tool nobody vetted. This guide is for owners and office managers at independent medical, dental, med spa, chiropractic and integrative practices who want to use pop-ups, or are deciding whether to keep the ones they have.

It covers what Google’s search and ads documentation says about interstitials and dialogs, the WCAG 2.2 success criteria a pop-up has to meet, where a pop-up offer turns into what FTC staff call a dark pattern, and what a pop-up form may and may not ask for. Cookie notices have their own guide, cookie consent banners on a medical practice website, and the wider legal picture for accessibility is in website accessibility for medical practices.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: Google Search Central, Avoid intrusive interstitials and dialogs (last updated December 10, 2025) and Understanding page experience in Google Search results (last updated September 22, 2026); the Google Search Central blog post Helping users easily access content on mobile (August 23, 2016, with its January 10, 2017 update); Google Ads policy, Circumventing systems; WCAG 2.2 (W3C Recommendation, version of December 12, 2024); the W3C ARIA Authoring Practices Guide, Dialog (Modal) Pattern; the FTC staff report Bringing Dark Patterns to Light (September 2022); 16 CFR 251.1 and 15 U.S.C. 7704 (current text); and the HHS Office for Civil Rights bulletin on online tracking technologies. State rules on advertising, privacy and accessibility differ from state to state, so check yours, and have a health care attorney review offers and data collection before you launch them.

The short version

Do not cover the page. Google’s guidance says not to obscure the entire page with interstitials, and to use a small banner instead.
Ad landing pages need extra care. Google Ads names a pop-up that blocks access to the majority of a site’s content as an example of circumventing its systems.
A pop-up is a dialog, and WCAG applies. It must work with a keyboard, release focus, close cleanly and announce itself to screen readers.
Make the offer honest. No fake countdowns, no shaming “No thanks” links, no repeated nagging, and each condition of a free offer stated next to it.
Ask only for an email address. A pop-up that asks why someone wants an appointment collects health information, and that belongs in a vetted form, not a marketing tool.

What Google says about pop-ups and interstitials

Google Search Central has a page titled Avoid intrusive interstitials and dialogs, last updated December 10, 2025. It defines interstitials as overlays on the whole page and dialogs as overlays on part of the page, and it says intrusive ones make it hard for Google and other search engines to understand your content, which may lead to poor search performance. It recommends banners that take up a small fraction of the screen, and it lists two mistakes to avoid unless an interstitial is legally mandatory: obscuring the entire page, and redirecting the visitor to a separate page for their consent or input.

The page also covers mandatory interstitials, such as an age gate. Google says these are exempt from the guidance, but recommends overlaying the content rather than redirecting all URLs to a single page, because Googlebot can then fetch only that one page.

This is not new. In an August 23, 2016 blog post, Google announced that from January 10, 2017, pages where content is not easily accessible on the transition from mobile search results may not rank as highly. It gave examples: a popup that covers the main content right after the visitor arrives from search or while they read, a standalone interstitial the visitor has to dismiss first, and a layout where the top of the page looks like an interstitial with the real content pushed below. It listed examples that would not be affected when used responsibly: interstitials that respond to a legal obligation, such as cookie usage or age verification, login dialogs for private content, and banners that use a reasonable amount of screen space and are easy to dismiss. Google now marks that post as possibly outdated and points readers to the current documentation above.

Google’s page experience guide, last updated September 22, 2026, includes “Do your pages avoid using intrusive interstitials?” among its self-assessment questions. The same guide says that beyond Core Web Vitals, other page experience aspects do not directly help a site rank higher, but they make it more satisfying to use, which aligns with what Google’s ranking systems seek to reward. So the honest summary is this: a covering pop-up is a usability problem first, and Google has said for years it does not want to send searchers to one.

Ad landing pages: a pop-up can block your ads

Google Ads treats this more strictly. Its Circumventing systems policy lists, among its examples, a pop-up, also known as an intrusive interstitial, that blocks access to the majority of your website’s content, meaning Google cannot access your landing page or ad’s destination to determine whether it is prohibited. For a practice running ads for a treatment, that is a reason to keep pop-ups off ad landing pages entirely. Our guides to landing pages for healthcare ads and disapproved healthcare ads cover the rest of what reviewers check.

A pop-up is a dialog: the accessibility rules

To a screen reader or a keyboard user, a pop-up is a dialog window. The W3C’s ARIA Authoring Practices Guide describes how a modal dialog should behave: when it opens, focus moves inside it; Tab and Shift plus Tab stay within it; Escape closes it; and when it closes, focus returns to the element that opened it, or to a logical next place if that element is gone. The container has the dialog role, aria-modal set to true and a label that points to a visible title. The guide is a set of practices, not a rule, but it is the W3C’s own description of a dialog that works.

The rules that apply are the WCAG success criteria. The HHS Section 504 rule names WCAG 2.1 Level AA for recipients of HHS financial assistance, as our accessibility guide explains, and WCAG 2.2 builds on it. These are the criteria a pop-up runs into, numbered as in WCAG 2.2:

2.1.1 Keyboard (Level A). All of the pop-up, including the close button and the form, works from a keyboard.
2.1.2 No Keyboard Trap (Level A). If focus can move into the pop-up, it can move out again with the keyboard, and if that takes anything beyond standard keys, the visitor is told how.
2.4.3 Focus Order (Level A). Focus moves through the pop-up in an order that keeps its meaning, and does not wander behind it onto the page.
2.4.7 Focus Visible (Level AA). The visitor can see which button or field has focus.
2.4.11 Focus Not Obscured (Minimum) (Level AA, new in 2.2). When a control on the page receives focus, it is not entirely hidden by content the site added. A sticky sign-up bar that covers the focused link fails this.
1.4.13 Content on Hover or Focus (Level AA). Content that appears on hover or focus can be dismissed without moving the pointer or focus, unless it does not cover other content.
1.4.10 Reflow (Level AA). At a width equal to 320 CSS pixels, the pop-up and its close button can be used without scrolling in two directions. A fixed-size box that runs off a zoomed or narrow screen fails this.
2.5.8 Target Size (Minimum) (Level AA, new in 2.2). The close button is at least 24 by 24 CSS pixels, or has enough space around it, subject to the exceptions in the criterion.
2.2.1 Timing Adjustable (Level A). If the offer or the form has a time limit, visitors can turn it off, adjust it or extend it, as the criterion sets out.
3.2.1 On Focus (Level A). Moving focus to a control does not by itself open a pop-up or send the visitor somewhere else.
3.3.2 Labels or Instructions (Level A). Each field in the pop-up form has a label, not only placeholder text.
4.1.2 Name, Role, Value (Level A). The pop-up and its controls expose their name and role to assistive technology, so the close button is announced as a button with a name such as “Close”.

A quick test any office manager can run: open the site on a laptop, wait for the pop-up, and use only the Tab, Shift, Enter and Escape keys. If you cannot reach the close button, cannot close it with Escape, or find yourself tabbing through the page hidden behind it, it fails. Then open the same page on a phone and check that the close button is easy to tap and the call button is still visible.

Pop-up offers and dark patterns

In September 2022 FTC staff published Bringing Dark Patterns to Light, a report on design practices that trick or manipulate people into choices they would not otherwise make. It is a staff report, not a regulation, but its Appendix A reads like a list of pop-up habits. Four of them matter for practice sites: Our guide to dark patterns on healthcare websites covers the rest of the report as it applies to practice sites.

Nagging. Asking repeatedly and disruptively, or making a request the visitor cannot permanently decline and then asking again. The report’s example is a choice offered as “Yes” or “Not Now” instead of “Yes” or “No”. A pop-up that returns on each new page after it was closed fits this.
Confirm shaming. Using shame to steer people away from a choice. The report’s example is “No, I don’t want to save money”. A “No thanks, I don’t care about my smile” link is the same pattern.
Baseless countdown timer and false limited time message. A countdown that disappears or resets when it hits zero, or a deadline that is not real.
Bait and switch. The report’s example is a visitor who clicks the X on a pop-up and gets something other than a closed box.

The legal backstop is Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices. If a pop-up says an offer ends tonight, it should end tonight. If it says “free”, the FTC’s guide on the word free, 16 CFR 251.1(c), says all terms, conditions and obligations of the offer should appear clearly and conspicuously at the outset and in close conjunction with the offer, not in a footnote reached through an asterisk. A free consultation that requires booking a paid treatment, or that applies to new patients only, says so in the pop-up itself. Free offers can also raise patient inducement questions; our guide to free rides and patient support perks covers those rules.

Email capture pop-ups and tracking

A newsletter pop-up builds a list for commercial email, and CAN-SPAM, 15 U.S.C. 7704, sets the rules for what you send to it: a working opt-out, honored within 10 business days, and a valid physical postal address in each commercial message. The FTC does not list prior consent among CAN-SPAM’s main requirements, but a sign-up that says what people will receive, and at what pace in plain terms such as “one email a month”, gives you a list of people who want the email. Our guide to healthcare email marketing covers the HIPAA side for patient lists.

Pop-up tools load their own scripts and can carry tracking, such as a pixel that reports a sign-up as a conversion. On pages a patient reaches after logging in, or on a form where they describe a condition, the HHS Office for Civil Rights bulletin on online tracking technologies treats the data those tools collect as protected health information in the situations it describes. Part of that bulletin was vacated in 2024, as our tracking pixels guide explains, but the parts about appointment and symptom forms remain on the HHS website. If the site has a cookie banner, the pop-up’s tags belong under it, and the banner itself should not be the thing that covers the page.

No health questions in a pop-up form

HIPAA defines protected health information in 45 CFR 160.103, and individually identifiable health information includes information that relates to a person’s past, present or future health condition or the provision of care to them. HHS’s tracking bulletin gives a close example: a public appointment page where someone enters their email address and the reason they are seeking care. A pop-up that asks “What brings you in?” next to a name and email address is that example.

Keep pop-up forms to an email address, or a name and an email address, for general news. Send anyone who wants care to your appointment page or your phone number, where the form has been set up for health information with a vendor that signs a business associate agreement. Our guide to HIPAA and website contact forms covers what that form needs.

Questions to ask before you add a pop-up

Does it cover more than a small part of the screen on a phone, or hide the call button?
Does it appear on a Google Ads landing page?
Can a keyboard user reach the close button, close it with Escape and get back to where they were?
Does it come back after a visitor closes it, and if so, when?
Is the offer real, with a real end date and each condition stated next to it?
Does the form ask for anything beyond a name and an email address?
Which scripts does the pop-up tool load, and does any of them send data to a third party?

Use and avoid

Close link. Use: “No thanks” or “Close”. Avoid: “No, I’d rather stay in pain”.
Deadline. Use: “Offer ends [date]” with a real date. Avoid: a timer that restarts when the page reloads.
Free offers. Use: “Free 15-minute phone consultation for new patients, no purchase required” if that is the offer. Avoid: “Free consultation*” with the conditions on another page.
Sign-up. Use: “Get our monthly practice news by email. Unsubscribe anytime.” Avoid: “Tell us your symptoms and we’ll send you tips.”
Size and timing. Use: a slim banner at the bottom of the screen that leaves the page readable. Avoid: a full-screen overlay the moment a visitor arrives from search.

An illustration

This example is invented. [Practice name], a dental office in [Town], installs a pop-up plugin that opens a full-screen box three seconds after each page loads. It says “New patient special ends in 10:00” with a timer, asks for name, email and “What would you like to fix?”, and has a small grey X in the corner. Its ad landing page shows the same box.

The office manager tests it. On a phone, the box hides the call button. With a keyboard, Tab moves behind the box onto the page, and Escape does nothing. The timer restarts on each page. The form sends answers to the plugin vendor, which has no business associate agreement with the practice.

The fix: the ad landing page gets no pop-up. Other pages get a slim bottom banner, shown once per visit, that reads “New patients: book online or call us” with links to the appointment page and the phone number. The newsletter sign-up moves into the footer and asks for an email address only. The special gets a real end date and its conditions in the banner text. The appointment page keeps its own form, run through a tool the practice has a BAA for.

Checklist

No full-page overlay on arrival, and nothing that hides the call button on a phone.
No pop-ups on Google Ads landing pages.
Focus moves into the pop-up when it opens, stays there, and returns when it closes.
Escape and a labeled close button both close it; the close button is at least 24 by 24 CSS pixels.
It works at 320 CSS pixels wide and at 400 percent zoom.
It does not come back on each page once closed.
Offers are true, deadlines are real, and each condition sits next to the offer.
The form asks for an email address, or a name and an email address, and nothing about health.
Commercial emails to the list carry an opt-out and a postal address, and opt-outs are honored within 10 business days.
The pop-up tool’s scripts are listed, under the cookie banner where one is used, and kept off logged-in and appointment pages.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. On the sites we build, we use small banners in place of full-screen pop-ups, test them with a keyboard and a phone, keep them off ad landing pages and keep health questions on vetted appointment forms. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Does Google penalize pop-ups on a practice website?

Google says intrusive interstitials and dialogs make it hard for search engines to understand your content, which may lead to poor search performance, and its page experience guide asks whether pages avoid them. It recommends small banners instead and says not to obscure the entire page. Notices required by law, such as an age gate, are treated differently.

Can we use a pop-up on a Google Ads landing page?

It is a poor idea. Google’s Circumventing systems policy names a pop-up that blocks access to the majority of a site’s content, so Google cannot review the destination, as an example of a violation. Keep ad landing pages free of pop-ups.

Which WCAG criteria apply to a pop-up?

The main ones are 2.1.1 Keyboard, 2.1.2 No Keyboard Trap, 2.4.3 Focus Order, 2.4.7 Focus Visible, 4.1.2 Name, Role, Value and 1.4.10 Reflow, plus 2.4.11 Focus Not Obscured (Minimum) and 2.5.8 Target Size (Minimum), which are new in WCAG 2.2.

Is a countdown timer on a new patient offer allowed?

Only if the deadline is real. FTC staff list a countdown that disappears or resets when it times out as a dark pattern, and the FTC Act prohibits deceptive practices. Show the actual end date instead.

Can a pop-up ask why someone wants an appointment?

Avoid it. HHS’s tracking bulletin gives an appointment page that collects an email address and the reason for seeking care as an example of individually identifiable health information. Send people to your appointment form, set up for health information with a vendor that signs a BAA.

Sources

More in Practice websites, privacy and tracking

Pop-ups on a medical practice website: search, accessibility and privacy rules