İlkan Digital.

Blog · Restricted tracking

Meta core setup explained: what it changes in your events

By İlkan Geldigitti ·

Meta core setup is a set of data sharing restrictions on a Meta Business Tool (your Pixel or dataset). In Meta's words, it "restricts the transmission of custom parameters and anything in a URL following the domain". Your events still arrive, and so do Meta's standard parameters such as value and currency. What disappears is everything you added yourself and every page path or query string: https://clinic.com/knee-pain/booking?utm_source=meta reaches Meta as https://clinic.com/.

That sounds small, but it changes a lot downstream. Custom conversions and custom audiences built on URLs or custom parameters stop working or shrink. Automatic advanced matching may switch off. Custom events have to be reviewed before they can be used. This guide shows exactly what changes, who can turn core setup on or off, and what to rebuild so your campaigns keep a usable signal.

Checked against Meta's Business Help Center on 26 October 2026. Sources are linked in each section and listed at the end.

What core setup removes, and what it keeps

Meta lists two kinds of restricted data (About core setup):

  • Custom parameters. Standard parameters are the fields Meta predefines, such as value and currency on a purchase or content_ids on a view content event. "If your parameter is not on the list of standard parameters, it's considered a custom parameter."
  • Anything in a URL after the domain. Meta's example: https://jaspersmarket.com/clothes/summer/dresses?item=10 becomes https://jaspersmarket.com/.

Here is what a typical lead event looks like before and after:

What your site sends What Meta keeps under core setup
Standard event Lead Kept
value: 150, currency: "EUR" (standard) Kept
form_type: "callback" (custom parameter) Removed
treatment: "knee" (custom parameter) Removed, and it shouldn't be sent at all
Page URL https://clinic.com/knee-pain/booking?utm_source=meta https://clinic.com/
Custom event BookKneeConsult Must be reviewed first, and may be blocked

Two things to note in that table. First, a parameter like treatment: "knee" is not just removed by core setup: sending health information is against Meta's terms in the first place, whatever your dataset's settings. Second, the UTM parameters in the URL also disappear from what Meta sees. Your own analytics still has them, so campaign reporting from your site and CRM keeps working.

What changes for your campaigns

Meta lists the effects of core setup:

  • Custom audiences that rely on custom parameters or URL rules "can't be prefilled and may take longer to populate or not be available". Audiences that combine device rules or aggregation values with those rules can't be created and won't update.
  • Ad sets that use those audiences may lose reach.
  • Events Manager stops showing custom parameters and full URLs, including in sampled activity and the test events tool. So you can't use Test Events to look at a page path any more.
  • Automatic advanced matching may be unavailable. Meta suggests setting up advanced matching manually instead.
  • Catalog items added through the Pixel may no longer be added.
  • Custom events need to be reviewed before they can be used (next section).

Custom conversions follow from the same rules. A custom conversion with a URL rule such as "URL contains /thank-you" can't match once Meta only sees the domain, and a rule on a custom parameter has nothing to read. The guide to custom conversions after a health restriction covers rebuilding them.

Custom events: review, confirm or block

Under data restrictions, a new custom event has to be reviewed before ad features can use it. During the review you confirm that the event "is from your business and follows the Meta Business Tools Terms", or you block it. Meta may also block custom events itself "if we detect they may contain potentially prohibited information (e.g., health, financial)" (How to review custom events).

To review them: Events Manager → Datasets → your dataset → Settings → Data controls → Manage event blocking → Review, then confirm or block each event on the Action required tab. Only confirmed custom events can be used in campaigns, custom conversions and custom audiences.

If Meta blocked a custom event and you think it's a mistake, the Blocked tab lets you request a review. Note the limit: if the review isn't approved, the event stays blocked and "you won't be able to request another review". So fix the event (name and parameters) before you ask.

Who turns core setup on, and can you turn it off?

Meta gives four reasons core setup can be on:

  1. Meta placed your data source in a category that requires it, such as health and wellness.
  2. Someone on your account assigned a restricted category to the dataset or data source.
  3. You received multiple notifications that data you're sharing may go against the Meta Business Tools Terms.
  4. You turned it on in Events Manager.

To check, open the dataset's Settings and scroll to Data restrictions → Core setup. You can turn it on or off there, with one exception: "If Meta has turned on data restrictions for your core setup, you won't be able to turn core setup off" (How to turn core setup on and off). If it came with a category you assigned yourself, removing that category may turn core setup off again, unless someone opted in on purpose or Meta placed the dataset in core setup.

The notification route deserves attention, because it is the one you can cause yourself. If you receive prohibited-information notifications repeatedly, Meta may place your Business Tool in core setup "for at least 90 days" (How to review blocked parameters). When a notification arrives, the Diagnostics tab shows which parameters and pages were affected. Meta asks you to fix the source and "must not attempt to send data that has previously been detected and removed" (Troubleshoot prohibited information notifications).

What to change in your setup

A setup that works well under core setup is one that never needed URLs or custom parameters in the first place:

  1. Fire standard events on the real action. Lead when your form endpoint confirms a submission, Schedule when a booking is confirmed. Don't rely on page URLs to tell Meta what happened.
  2. Move meaning from custom parameters to event choice. If you separated form types with a custom parameter, decide whether they need separate standard events, or whether one event is enough for optimisation.
  3. Rebuild URL-based custom conversions and audiences on standard events and standard parameters.
  4. Set up advanced matching manually if automatic advanced matching switched off, with properly hashed customer information and only the fields your dataset accepts (advanced matching on Meta for Developers).
  5. Apply the same rules to the Conversions API. Meta's pages describe core setup per Business Tool, not per sending method, so give server events the same standard names and standard parameters as browser events, with one event_id for deduplication.
  6. Keep campaign reporting in your own systems. UTMs, landing pages and outcomes per campaign still live in your analytics and CRM.

The Meta health and wellness restrictions guide explains the other two levels that can sit on top of core setup: restrictions on certain standard events, and full restrictions in some regions.

Should you turn core setup on yourself?

Meta suggests you "may want to turn on core setup" to help prevent sharing prohibited information. For a site that is genuinely about health, it acts as a safety net: page paths and custom fields that might describe a condition can't reach Meta even if someone adds them to a tag later. The trade-off is everything listed above, so rebuild your conversions and audiences on standard events first. Either way, Meta is clear that core setup is "not a substitute for your own compliance mechanisms": you remain responsible for what your integration sends.

FAQ

Does core setup stop my ads? No. Your events still arrive with standard parameters, and campaigns can still optimise on standard events. What stops working is anything that depends on URLs or custom parameters.

Will my UTM data disappear? From what Meta sees, yes: the query string is part of the URL after the domain. Your own analytics and CRM still record UTMs from the landing page.

Can I send the missing details through the Conversions API instead? No. Core setup is a restriction on the Business Tool, and sending health details is against Meta's terms through any channel. Use standard events and standard parameters on the server too.

How long does core setup last? If you turned it on, until you turn it off. If it follows repeated prohibited-information notifications, Meta says at least 90 days. If it comes from a Meta-assigned category, it stays while the category applies.

If you'd like your events, parameters and audiences checked against core setup before you change anything, the restricted health tracking service starts with that audit.

Sources

Free tracking check

Stuck on this in your own account?

Free, within 2 business days. We look at your site from the outside, no account access needed. Fixes are quoted separately.