İlkan Digital.

Blog · Restricted tracking

Meta health and wellness restrictions in 2026: what is blocked and what still works

By İlkan Geldigitti ·

Meta health and wellness restrictions are data-sharing limits that Meta puts on websites and apps it places in its health and wellness data source category. Depending on the category and region, Meta applies one or more of three levels: core setup (custom parameters and everything in a URL after the domain are stripped), restrictions on certain standard events (specific mid- and lower-funnel events are blocked), or full restrictions (no events can be shared for ads in the affected regions). On top of that, custom conversions and custom audiences that suggest a health condition are flagged and can't be used in new campaigns.

What still works depends on the level. Under core setup, standard events with standard parameters keep flowing and, in Meta's words, "most campaigns should continue to run as expected". Under event restrictions, Meta suggests moving optimisation to events further up the funnel. Under full restrictions, only objectives that don't rely on Business Tools data, such as Awareness, Engagement and Traffic, remain. The rest of this guide explains each level, how to check which one applies to you, and how to keep measuring without breaking Meta's terms.

Checked against Meta's Business Help Center on 18 October 2026. Meta notes that its category list "is not exhaustive and may evolve over time", so re-check the linked pages before acting.

What Meta counts as "health and wellness"

Meta assigns categories to data sources (websites, apps, offline sets) "based on the topics related to the data source and the products and/or services provided". Its own description of the health and wellness category covers sources associated with "medical conditions or specific health statuses, provider/patient relationships, services for accessing personal health information, or health-related products and services". The examples Meta gives include a patient portal, a wellness tracker, a telemedicine platform, a pharmacy, a health insurance marketplace and a condition-specific support group (About data source categories).

Two things follow from that definition. First, the category is about the site, not about any single event you send: a clinic can be categorised even if its tracking is spotless. Second, it sits next to other restricted categories, including financial services and personal hardship, which work the same way.

Separately, Meta's terms prohibit sending certain information at all, whatever your category. Its list includes diseases and medical conditions, mental health, sexual and reproductive health, medical procedures and treatments, prescription medications, and "physical locations that identify a health condition, or places of treatment and counseling". That rule applies to URL parameters, custom audiences, custom conversions, custom event names and custom data (About prohibited information).

The three levels of restriction

Meta describes three restrictions that a category can carry. They "may vary across data source categories and can be specific to certain countries or regions, or could be applied globally" (Understand data sharing restrictions based on data source categories).

Level What Meta restricts What Meta suggests
Core setup Custom parameters and parts of URLs following the domain Most campaigns should run as expected; adjust where custom audiences or custom data were used
Restriction on certain standard events Specific mid- and lower-funnel standard events Review which events are restricted and use upper-funnel events for targeting and optimisation
Full restrictions All events, in specific regions or all regions Use objectives that don't rely on Business Tools data: Awareness, Engagement, Traffic

A dataset can have more than one of these at the same time, and the region matters: the same site can be fully restricted in one region and only in core setup in another.

Core setup in detail

Core setup "restricts the transmission of custom parameters and anything in a URL following the domain" (About core setup). In practice:

  • Custom parameters stop. Only Meta's predefined standard parameters, such as value and currency on a Purchase or content_ids on a ViewContent, are kept. Anything you added yourself is dropped.
  • URLs are cut to the domain. Meta's own example: https://jaspersmarket.com/clothes/summer/dresses?item=10 becomes https://jaspersmarket.com/. Page paths and query strings, including UTM values, no longer reach Meta.

Meta lists what that changes for advertisers:

  • Custom audiences built on URL or custom-parameter rules "may take longer to populate or not be available", and audiences that combine device rules or aggregation values with those rules can't be created or updated. Ad sets using them can shrink.
  • Events Manager stops showing custom parameters and full URLs, including in sampled activity and the test events tool.
  • Automatic advanced matching may be unavailable; Meta points to manual advanced matching instead.
  • Adding catalog items through the Pixel may stop working.
  • Custom events must be reviewed and confirmed before they are shared. Under any data restriction, custom events are "automatically blocked until you review and confirm them".

Core setup can be switched on by Meta (because of the category or repeated notifications), by someone on your account who assigned a restricted category, or by you in Events Manager. Meta also notes that if you receive prohibited-information notifications multiple times, it "may restrict you from sharing certain data … by placing your Meta Business Tool into a core setup for at least 90 days" (How to review blocked parameters).

Restrictions on standard events

At this level Meta blocks "specific mid and lower funnel events". The help article does not publish one fixed list, because the restriction depends on the category and region; the events that apply to your dataset are shown in Events Manager.

Meta's advice is to "evaluate which events are restricted and explore alternative events" and to consider "more upper-funnel events to maintain effective audience targeting and campaign optimization". For a clinic or a health brand, that usually means deciding which of the still-allowed events is the closest honest proxy for a valuable visitor, and building campaigns around it, rather than trying to recreate the blocked event under another name (see the last section).

Full restrictions

Here Meta fully restricts "the sharing of all events in specific regions or all regions", and Business Tools "cannot be used for ads purposes where restrictions are in place". Meta's suggestion is to use objectives that do not depend on Business Tools data: Awareness (reach, impressions), Engagement (likes, comments, shares) and Traffic (link clicks).

Measurement then moves to your own systems: your CRM, booking tool or analytics, reporting on outcomes per campaign without sending the data back to Meta.

Custom conversions and custom audiences

Independently of the three levels, Meta checks custom conversions and audiences. Custom conversions "must not suggest information not allowed under our terms", with "references to specific health conditions, such as arthritis" given as an example (Understand restrictions on certain custom conversions).

When one is flagged:

  • You can't use it when creating new campaigns.
  • Running campaigns that use it should be duplicated with a non-flagged custom conversion; once published, the custom conversion of a campaign can't be swapped.
  • If you believe it was flagged in error, you can request a review in Ads Manager or Events Manager.

The safe pattern is a neutral name and a rule that doesn't describe a condition, for example a booking confirmation event rather than a URL rule that contains a treatment name. The companion guide on the "Some website data blocked" notice covers what typically stops working first.

How to check where you stand

Everything below is in Meta Events Manager and needs full control of the business portfolio or an admin role on the ad account that owns the dataset (How to manage data source categories).

  1. Category: Events Manager → Datasets → your dataset → Settings → Manage data source categories → Manage. If the section is missing, your sources aren't in a restricted category.
  2. Who assigned it: if you assigned the category yourself, you can edit it. If Meta assigned it and you think it's wrong, open View details and Request review; the decision arrives by email. You can't modify a Meta-assigned category yourself.
  3. Blocked parameters: Datasets → your dataset → Diagnostics → Event parameters blocked → Review. Fix the source of each parameter, then choose to unblock it or keep blocking it.
  4. Custom events: review and confirm only those that follow the terms and that you intend to share.
  5. Custom conversions and audiences: check for flags in Events Manager and Ads Manager before launching new campaigns.

What still works, in practice

Within the rules, these are the parts of a setup that usually survive and are worth getting right:

  • Standard events with standard parameters. Neutral event names, value and currency where allowed, nothing in custom fields.
  • Pixel plus Conversions API with deduplication. Browser and server events for the same action share one event_id, so Meta counts them once. Server events follow the same rules as browser events: standard names, standard parameters, nothing that describes a condition.
  • Outcomes from your CRM, where your level allows them. Reporting which leads became booked or qualified customers can give campaigns a deeper signal than form fills. The lead quality guide shows how, without sending health details.
  • Your own reporting. Whatever Meta can no longer see, your CRM can still report per campaign, so budget decisions are based on customers rather than on whatever event remains.

This is the approach used in a pain-medicine practice in Istanbul, where every campaign was judged on treated patients across 7 physicians under Meta's health restrictions, measured at 5–9× ROAS on treatments done.

What not to do

Meta's terms make these off-limits, and they tend to make restrictions worse rather than better:

  • Domain masking, or routing events through a different domain to escape the site's category.
  • Disguised or renamed events, such as sending a booking as a generic custom event to get around a blocked standard event.
  • New accounts or datasets created to escape a restriction.
  • Condition or treatment names in URLs, parameters, event names, custom conversions or audience rules.

Meta also states that its filters are "not a substitute for your own compliance mechanisms": you remain responsible for what your integration sends.

FAQ

Can I get out of the health and wellness category? If you assigned it yourself, you can edit it in Events Manager. If Meta assigned it and you believe it's inaccurate, you can request a review; you can't change a Meta-assigned category yourself.

Will core setup stop my ads? Meta says most campaigns should continue to run as expected under core setup. The usual losses are custom audiences, custom parameters and URL detail, and automatic advanced matching.

Do the restrictions apply in every country? Not necessarily. Meta says restrictions "can be specific to certain countries or regions, or they could be applied globally", and notifies you by email and in Events Manager.

Can I just rename the blocked event? No. Renaming or disguising events to get around a restriction goes against Meta's terms. Use the events your level still allows, and measure the rest in your own systems.

If you want this checked on your own dataset, the restricted health tracking service starts with an audit of your category, events and parameters before anything is changed.

Sources

Free first look

Stuck on this in your own account?

Send a short note with what you see. A reply arrives within 1 business day. No payment is requested before a written proposal.