Meta ads for telehealth brands in 2026: Conversions API, health data limits and split tests

To run Meta ads for a hormone, GLP-1 or other telehealth brand in 2026, send conversions from your server through Meta's Conversions API and keep health details out of every event. Give the browser pixel and the server event one shared event ID so each sale counts once. Then test on a site and checkout you control. TikTok, Snapchat, Reddit and Google work the same way.

thimblehub sets up the server events, shared event IDs and per-platform data controls with the brand site and checkout we run for you, on your own ad accounts.

What Meta restricts for health advertisers

• Data you send. Under Meta's Business Tools Terms (effective November 3, 2025), advertisers agree not to share health information through the pixel, the Conversions API or Meta's other business tools.
• Custom conversions. Since September 2, 2025, Meta has been flagging custom conversions that suggest a specific health condition (its examples are "arthritis" and "diabetes"), and a flagged conversion can't be used in new campaigns. Name conversions after the action, such as Purchase or Order placed.
• Restricted data sources. Since early 2025, health advertisers have reported that Meta limits lower-funnel events such as Purchase and AddToCart on data sources it classes as health and wellness, and that Events Manager shows a dataset's category. Check yours before you plan campaigns.
• Prescription drug ads. Meta requires telehealth providers advertising prescription drugs to be actively certified with LegitScript, then to request Meta's authorization, and to target only people 18 or older.

On October 12, 2026, we read the public code and settings Meta serves for one health brand's pixel, which has Meta's ProtectedDataMode switched on. With it on, Meta drops content names and categories and cuts every page address down to the bare domain. That pixel's settings also discard order IDs. Content IDs, content type, value and currency stay on its allowed list. So identify pages and products with content IDs, and keep anything descriptive out of event names and page addresses.

The US rules behind the limits

Which rule applies depends on how your company and your clinicians are set up. Have a healthcare attorney confirm it for your brand before the first campaign.

• HIPAA. HHS's tracking guidance (last reviewed June 26, 2024) applies if your clinicians or your company are a HIPAA covered entity or business associate. It says tracking tools on logged-in pages, such as a patient portal or telehealth platform, generally have access to protected health information. Sharing it with a tracking vendor must be permitted by HIPAA's Privacy Rule and covered by a business associate agreement. On June 20, 2024, a federal court vacated the part of that guidance saying an IP address plus a visit to a public page about a health condition or provider triggers HIPAA (American Hospital Association v. Becerra). The rest of the guidance remains on HHS's site.
• The FTC's Health Breach Notification Rule. Health apps and similar services outside HIPAA can fall under this FTC rule. Its 2024 update (89 FR 47028, in effect since July 29, 2024) counts an unauthorized disclosure of identifiable health data as a breach.
• FTC cases. GoodRx paid a $1.5 million civil penalty in 2023 for sharing users' medications and health conditions with Facebook, Google and others, the first action under that rule. BetterHelp paid $7.8 million and is barred from sharing health data for advertising, under an order finalized July 14, 2023.
• State health-data laws. Washington's My Health My Data Act (RCW 19.373) requires consent before collecting consumer health data for a stated purpose, unless the data is needed to provide what the consumer asked for, and a separate consent before sharing it. The consent request must name the categories of data, the purpose, who receives it and how to withdraw. Protected health information under HIPAA is exempt, and violations are enforced under the state's Consumer Protection Act.

Hashing doesn't take an email outside these rules. Treat a hashed email from a patient's checkout as patient data, as our telehealth analytics guide explains.

Get cleared to advertise first

Paid ads for prescription care need clearance before tracking matters. LegitScript certification comes first, since Meta and Google both require it of telehealth providers. Then request Meta's authorization for prescription drug ads, and apply for Google's healthcare certification. The certification is yours. Sites we set up are built to LegitScript's requirements, and we support your application with site changes and answers about how checkout and patient data work. Our LegitScript guide covers the steps.

Browser pixel vs server events

Run both. Meta recommends a redundant setup, with the Conversions API alongside the pixel, and the server copy still arrives when a browser blocks the pixel.

Then make sure each sale counts once. Meta treats a pixel event and a server event as the same when the pixel's eventID matches the server's event_id and the event names match, within 48 hours of the first. It generally keeps the first one it receives. TikTok matches on the same event name and event_id and keeps the first event it receives. Create the ID once, at the moment the visitor acts, and pass that value to both the pixel and your server.

Meta's documentation sets two more rules. Email, phone, name and birthdate must be hashed before they're sent (Meta's examples use SHA-256), and IP address, user agent and the fbp and fbc cookies must never be hashed. A lean server event can still carry an IP address unless you leave it out, so decide with counsel which fields each platform gets.

One common break: firing Meta from your own Tag Manager tag and from a built-in pixel at the same time. Pick one source for the browser event.

What to send, and what to keep out

Google doesn't offer a business associate agreement for Google Analytics, and it tells HIPAA-regulated sites to keep Analytics tags off logged-in pages and off pages related to providing care.

Consent before the pixel fires

Where a law like Washington's applies, ask for consent before analytics and ad pixels load, in plain words that say what's collected, why, who gets it and how to withdraw. Store the answer and honor a withdrawal. Ask your attorney which of your visitors' states require it.

Capture UTM tags and click IDs on every order

Save the first-touch UTM tags (source, medium, campaign, content) and each platform's click ID with the order: fbclid from Meta, gclid from Google, ttclid from TikTok, ScCid from Snapchat, rdt_cid from Reddit and msclkid from Microsoft. Then you can count sales by campaign from your own records, even where Meta limits purchase events.

Copy only the keys you need, never a whole query string. And think twice about keeping utm_term on health pages, since a search term can name a condition.

Split tests that don't flicker

Test on the checkout, where buyers decide: the headline, trust messages and the order summary. Assign each visitor to a variant on the server before the page renders, keep them on it when they return, and judge each variant by completed orders.

Testing tools that run in the browser swap content after the page loads, so visitors can see the original flash first. Server assignment avoids that flicker and keeps the variant stable across visits.

Own your front end without building it

Search answers and agency playbooks tell hormone and GLP-1 brands to build their own front end, because a site and checkout whose code you control let you run server events, headline tests and split tests. With thimblehub you get that control without building it. We set up and run your site and checkout on your domain, connected to your ad accounts and your own payment processor (such as Stripe), and change them when you ask.

What thimblehub sets up

Tracking setup comes with thimblesites, our brand sites, and reaches your thimblecart checkout too. Once it's done:

• Server events to four platforms. Checkout sends events from product view through purchase, with order value and currency on purchases, from our server to Meta through the Conversions API, to TikTok through its Events API, and to Snapchat and Reddit. Purchases can also reach Google Analytics from our server.
• One event ID per action. The browser pixel and the server event share it, so Meta and TikTok count each sale once.
• A fixed allowlist on browser pixels. Every pixel payload is checked before it leaves the page, and one that carries a name, email, phone number or birthdate is dropped whole.
• Controls for each platform. We set with you which events each platform receives and which fields go with them. For Meta, that can be the event name and time only, those plus a hashed email, or the full set of match details.
• Hashed customer details. Emails, phone numbers and customer IDs sent from our server are SHA-256 hashed, or left out. Raw emails and phone numbers never go to Meta, TikTok, Snapchat or Reddit.
• Test orders kept out. Server events from test orders aren't forwarded to your ad accounts unless you ask us to send them for a test.
• Retries and alerts. A failed send retries on its own. A destination that keeps failing pauses itself and alerts our team.
• Your Tag Manager and GA4. Checkout pushes GA4 ecommerce events (add_to_cart, begin_checkout, add_shipping_info, add_payment_info, purchase) into your Google Tag Manager container, which can load from your own domain.
• First touch on every order. UTM tags and click IDs from Meta, Google, TikTok, Reddit, Snapchat, LinkedIn and Microsoft are captured at checkout and saved with each order.
• Checkout split tests on Scale. Test headlines and trust messages without a code release. Visitors are assigned on our server, keep their variant and see no flicker.
• Brand sites ready for Meta's limits. On the brand sites we set up, analytics and ad pixels can wait for the visitor's consent, and ad events identify pages and products by content ID, which stays on Meta's allowed list when ProtectedDataMode is on.

Running or managing campaigns is an added engagement outside the base setup, and we're happy to take it on. For anything we don't do in house, such as legal review, we point you to people we trust.

Tracking setup, step by step

YYouthimblehubYour networkYour pharmacy

1. 1

   Your ad accounts, shared

   You own your Meta, TikTok, Snapchat, Reddit and Google accounts and give us access to the pixels, datasets and Tag Manager container.

2. 2

   Your attorney's answers

   You confirm with your healthcare attorney what each platform may receive, whether a hashed email can go, and where consent is needed.

3. 3

   Events and controls set up

   thimblehub connects server events from checkout, sets each platform's controls and loads your Tag Manager container.

4. 4

   Neutral names chosen

   You name conversions after actions, such as Purchase, and products with codes, never a condition or drug.

5. 5

   A test order, together

   You and our team run a test order through every step and check the events it produced.

Test orderYour admin portalPaymentWaitingPaidClinical reviewWaitingIn reviewApprovedPharmacyWaitingDispatched

Replay

What to have ready

What one call to thimblehub gets you

One call gets your site, checkout, patient and admin portals and ad tracking set up and run for you, on your own ad accounts, domain and payment processor, with a signed BAA. We connect any clinician network and pharmacy, or introduce you to ones we work with (see our clinician networks compared), and point you to people we trust for anything we don't do in house. As fast as 3 days after you sign. It takes longer if you still need a pharmacy or clinicians, are waiting on LegitScript certification, want website design revisions, are planning marketing with us, or need custom builds. Here's what setup looks like.