Meta Keeps Restricting Health & Wellness Advertisers. Here's the Playbook We Run.

Every few weeks a health or wellness brand lands in our inbox with the same story: performance fell off a cliff, nobody changed anything, and somewhere in Events Manager there's a notice about "data source restrictions" that nobody on the team remembers seeing. The account isn't broken. It's been quietly reclassified.

I wrote a full technical breakdown of Meta's restriction system — the three tiers, how the categorization engine works, and the appeal process — for the team at Ours Privacy: Meta Platform Restrictions Explained: What Core Setup Actually Means. This post is the companion piece from the agency side of the table: the operating playbook we run at Coast Studio across health & wellness accounts so restrictions become a manageable constraint instead of an extinction event.

What's actually happening when Meta restricts a health account?

Since Meta rolled out data source categorization for health and wellness, its automated systems have been scanning the signals advertisers send — pixel events, Conversions API payloads, URLs, even landing page copy — and sorting domains into risk categories. The trigger was regulatory: FTC enforcement against companies that leaked sensitive health data through ad pixels made "let advertisers send whatever" untenable for Meta.

The result is a system with three broad tiers of restriction. At the baseline (Meta calls it Core Setup), custom parameters get blocked and URLs are stripped after the domain. The middle tier blocks purchase-stage standard events. The severe tier cuts off all event data entirely. The critical detail: your campaigns keep running at every tier. Meta doesn't pause anything — the optimization signal just quietly disappears while budget keeps spending.

If you want the full mechanics of each tier and the appeal process, read the deep dive on Ours Privacy. Here I want to focus on what to do about it.

The five moves that keep health & wellness accounts alive

1. Audit what you're sending before Meta audits it for you

Most restricted accounts earned their category honestly — they were sending things like condition=anxiety in a URL parameter or firing a custom event named after a treatment. Pull every event, parameter, content ID, and URL your pixel and CAPI setup transmits, and apply one test: combined with a user identifier, could this reveal something about a person's health? If yes, it goes. This single audit, done properly, is the difference between a defensible appeal and a permanent restriction.

2. Make your URLs boring

Descriptive URLs are an SEO habit that becomes a liability the moment they carry condition language into an ad payload. /treatments/depression-medication-online tells Meta's classifier exactly what your visitor is doing. You don't have to flatten your whole site architecture — route your ad traffic through clean paths, or put a server-side layer between your site and Meta that sanitizes URLs before they transmit.

3. Rebuild your event taxonomy around what's still allowed

When standard purchase events get blocked, most teams give up on optimization. The better move is understanding the difference between custom conversions and custom events, and rebuilding signal with neutral, compliant naming through a server-side connection. An event called signup_complete carrying no sensitive parameters is a very different object, in Meta's eyes, than a pixel firing Purchase from a URL full of condition keywords.

4. Put a compliant server-side layer between you and Meta

This is the highest-leverage investment on the list. Routing your Conversions API traffic through an intermediary you control — one that strips PHI and sensitive parameters before anything reaches Meta — turns data flow from something that happens to you into something you decide. It's also the only architecture that holds up as Meta keeps changing the rules, because the control point sits on your side of the wall. This is exactly the problem tools like Ours Privacy exist to solve for HIPAA-adjacent brands.

5. Fix your creative and landing pages, not just your pixels

Meta's classifier reads your landing pages, and warnings often trace back to ad copy that names conditions directly. Outcome-focused creative — how people want to feel, not what they're diagnosed with — performs better anyway in our testing, and it stops feeding the categorization engine evidence. The same principle extends to your offer pages: sell the outcome, not the diagnosis.

What to do at each restriction tier

The playbook shifts depending on where you already are:

• Core Setup only: You have room to operate. Clean up parameters, move to server-side custom events, and don't give Meta a reason to escalate. Treat every warning notification as a same-week priority.
• Standard events blocked: Shift campaign objectives up-funnel (traffic, engagement) to keep learning active while you rebuild compliant conversion signal server-side. Expect a rebuild, not a tweak.
• Fully restricted: Appeal — but only after a genuine cleanup, because appeals without remediation fail. In parallel, evaluate whether a compliant microsite architecture makes sense, and rebalance spend toward Google, TikTok, and channels where your compliance posture is stronger.

Why we treat restrictions as a moat, not a tax

Here's the reframe that changes how brands invest: everyone in health and wellness is subject to the same rules, and most of your competitors are handling them badly. Every quarter, accounts in your category get suspended for tracking violations their teams didn't know existed. A brand that builds compliant infrastructure — server-side tracking, clean taxonomy, disciplined creative — doesn't just survive the restrictions. It keeps compounding while competitors restart from zero with new ad accounts and burned pixels.

That's the thesis behind our Regulated Markets practice: compliance-first growth isn't slower growth. It's growth that doesn't get repossessed.

FAQ

Why did Meta restrict my health and wellness ad account?

Meta's automated system categorized your domain as a health and wellness data source — based on your URLs, event payloads, landing page content, or brand positioning — and applied restrictions to limit its own regulatory exposure. It happens without human review and often without a clear notification.

What is Core Setup in Meta Events Manager?

Core Setup is the baseline restriction tier for health and wellness data sources: custom parameters are blocked, URLs are stripped after the domain, and custom audience and catalog features are limited. Once applied automatically it can't be disabled without a successful appeal.

Can I appeal Meta's categorization?

Yes, through Events Manager's data source settings. Plan for three to seven business days minimum, and clean up your tracking before appealing — in our experience, appeals without genuine remediation rarely succeed.

Should we just leave Meta?

Usually not. Meta still has unmatched scale for consumer health and wellness. The right answer is usually rebuilding compliant signal on Meta while diversifying enough that no single platform decision can break your growth model.

Where should I start?

Check your current status in Events Manager (Data Source → Settings → Data Source Categories), then run the audit in step one above. If you'd rather have us look at it, book a consultation — restriction triage is something we do weekly.