Skip to content
Possibly, but only if names, contact details, and health information never reach Meta. Beacon’s standard for Meta ads without sharing PHI is strict: no pixel on booking, intake, or portal pages, only a generic conversion event and a hashed IP address sent to Meta, and no custom audiences built around a condition.
What should Meta never receive from a practice website?
Meta should never receive a person’s contact details or anything that reveals why they contacted the practice. Under Beacon’s standard, that means no names, email addresses, phone numbers, or device identifiers, plain or hashed, no condition or service names in URLs or event names, and no form content. The one identifier Beacon’s setup sends is the visitor’s IP address, hashed.
Pixel defaults often send them anyway. A 2026 study of health-related websites, prepared for the ACM Internet Measurement Conference, found that “as of 2024, 47.8% of health websites continue to still use” automatic advanced matching, which shares hashed contact details from forms. Hashing does not make that data anonymous: FTC Office of Technology staff wrote in July 2024 that “hashes aren’t ‘anonymous’ and can still be used to identify users.”
Regulators have acted. Announcing an April 2024 order against telehealth company Cerebral, FTC Chair Lina Khan said: “As the Commission’s complaint lays out, Cerebral violated its customers’ privacy by revealing their most sensitive mental health conditions across the Internet and in the mail.”
What has Meta restricted for health and wellness advertisers?
Meta has limited what health-related websites can send and use. Its developer documentation says that beginning September 2, 2025, “any custom conversion suggesting specific health conditions” will be flagged and prevented from being used to run ad campaigns. A practice that built a conversion around an anxiety or ADHD page can find it unusable.
Meta also applies a restricted mode, called Core Setup, to websites in sensitive categories. The same 2026 study describes Core Setup as limiting URL information to the domain level and blocking custom parameters, and found it configured on up to 34.3% of health websites. The researchers concluded these restriction features “provide limited protection and can be circumvented in practice,” so a practice should not treat them as its only safeguard.
How does a server-side relay limit what Meta receives?
A server-side relay limits what Meta receives by processing each event on a server before anything is forwarded. When a prospective client books, Beacon’s relay removes names and contact details, along with condition, service, and form detail and any page address that names a condition, and hashes the IP address. Only a generic conversion, such as “appointment request,” goes on to Meta.
The booking page itself carries no pixel in this setup. The HHS online tracking bulletin gives an example in which a tracking tool collects a person’s email address when they book an appointment, and says the regulated entity is disclosing PHI to the tracking vendor. Beacon runs the removal step through server-side conversion tracking under a signed BAA with the tracking provider. The wider mechanics are covered in What Is Server-Side Conversion Tracking and Why Does Healthcare Need It?
What does this answer not cover?
This answer covers the data flow between a practice website and Meta. It does not cover Google Ads, other ad platforms, or ad copy rules, and it does not decide whether any specific setup meets HIPAA, FTC rules, state privacy laws, or 42 CFR Part 2 for substance use disorder programs.
This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.
Meta has tightened its health-related restrictions more than once since 2023, and the details above reflect Meta’s documentation as of September 2026. A signed agreement with a tracking provider covers that provider only. The practice remains responsible for its own obligations, whatever tools or vendors it uses.
Frequently asked questions
Will Meta campaigns still optimize without the pixel?
Campaigns can still be measured and optimized on stripped-down conversion counts, which is Beacon’s approach. Meta’s documentation says server events may be used in measurement, reporting, or optimization in a similar way as pixel events. Each event carries far less detail than a pixel would send, so results vary.
Does a BAA with the relay provider cover Meta?
No. A business associate agreement covers the relay provider’s handling of data for the practice, and Meta sits outside it. A practice should not plan on Meta signing one for advertising. That is why Beacon’s relay sends Meta only a generic event and a hashed IP address, with no contact details, condition, service, or form content.
Can a practice retarget people who visited condition pages?
Beacon does not recommend it. Meta’s developer documentation says custom conversions suggesting specific health conditions will be flagged and prevented from running ad campaigns, and an audience built from visits to an anxiety or depression page carries the same kind of health signal. Beacon’s standard is no condition-based custom audiences on any platform.