Meta Health and Wellness Restrictions: The 2026 Guide to Getting Your Signal Back

Last updated: November 12, 2026 · By Jason Garrett, Founder, Coast Studio. Not legal advice — review claims with counsel.

Short answer: Meta places websites and apps that touch health topics in its health and wellness category, then limits the data their pixel, Conversions API, and SDK may share. The limit comes in three levels: Core Setup, a restriction on certain standard events, and full restrictions. Read yours in Events Manager first. Then send Meta only data that carries no health information, through a server-side layer that signs a BAA when HIPAA applies, and rebuild optimization on the events Meta still accepts. Renaming blocked events and opening new accounts tend to make things worse.

The three restrictions

Meta names three data-sharing restrictions. Practitioners call them Tier 1, Tier 2, and Tier 3.

Restriction	Meta stops accepting	What still works
Core Setup (Tier 1)	Custom parameters and everything in a URL after the domain	Standard events, including Purchase; less detail for optimization
Restriction on certain standard events (Tier 2)	Specific mid- and lower-funnel standard events	Unrestricted standard events and confirmed custom events, subject to eligibility
Full restrictions (Tier 3)	All events, in specific regions or everywhere	Objectives that need no Business Tools data: Awareness, Engagement, Traffic

Core Setup alone does not block Purchase. Meta can also switch Core Setup on and hold it for 90 days after an account receives repeated notices about blocked parameters. Our guide to the three tiers covers each level in detail.

Read your restriction in five minutes

Open Events Manager and click Datasets.
Select the dataset and open Settings.
Scroll to Manage data source categories and click Manage.
Note the category and restriction on each data source, then click View details.
Read the blocking reason: which restriction, which events, and which regions.

Meta also sends an email and an Events Manager notice. If the Manage data source categories section is missing, your data source may sit outside the restricted categories, and the problem lies elsewhere.

Match the symptom to the cause

Each symptom below is a clue. Confirm the cause in Events Manager before you act.

What you see	Likely cause	Read next
Purchase or Lead shows as restricted	Restriction on certain standard events	Purchase event blocked
Campaigns lose detail, URLs show only the domain	Core Setup	The three tiers
Custom audiences shrink or stop updating	Core Setup, a standard-event restriction, or custom events awaiting review	Custom audiences stopped working
An audience is flagged and cannot be added to a campaign	The audience references a health condition	Custom audiences stopped working
App events disappear after an update	SDK data source restriction	Restrictions for apps
The category looks wrong for your business	Meta categorized from your site's topics	Category removal

Fixes that backfire

Common fix	Why it fails
Rename Purchase to a neutral custom event	Meta reviews every new custom event and can block those carrying prohibited information. The same health data under a new name is still health data.
Open a new pixel or ad account	The new asset points at the same site, with the same topics Meta used to categorize the first one.
Move everything to the Conversions API	The restriction applies to the data source, server events included. Server-side delivery helps because it lets you clean data first.
Chase a higher Event Match Quality score	EMQ measures how well customer details match. A high score on a restricted event leaves the restriction in place.
Request review without changing anything	Meta reviews what your site and events show today. Clean the pages, events, and ad copy before you file.

What works: the restore plan

1. Decide whether the category fits. If your business sells nothing health-related, clean your site and events, then request review from View details. Meta answers by email on its own timeline. If the category fits, plan around the restriction. Our category-removal guide covers the review.

2. Put a server-side data layer between your site and Meta. Collect events on your own domain and send them server-side, so every event passes through filters before it leaves. If HIPAA applies to you, the vendor that handles those events must sign a BAA. Ours Privacy and Curve both sign one.

3. Strip health information everywhere it hides. Remove conditions, treatments, and dosages from URLs, query strings, custom parameters, event names, and content fields. Hash email and phone before sharing, and only with consent where the law requires it.

4. Rebuild optimization on events Meta accepts. Optimize on unrestricted standard events or on custom events that pass review. Confirm a custom event only if it is yours, you mean to share it, its data follows the Meta Business Tools Terms, and it is formatted correctly.

5. Rebuild audiences from clean seeds. Name audiences by funnel stage or event. Remove every condition reference from audience names and rules, then rebuild lookalikes from the repaired seeds.

6. Keep the ads inside policy. Ad rejections follow Meta's Advertising Standards and run separately from the data restriction. Clean ads keep the account healthy while signal returns.

Do you need a BAA?

A HIPAA covered entity, or its business associate, needs a BAA with every vendor that handles PHI, tracking vendors included. Meta does not sign BAAs, so PHI must be removed before data reaches Meta. A wellness brand outside HIPAA needs no BAA under HIPAA, but the FTC Health Breach Notification Rule, Washington's My Health My Data Act, and Meta's own terms still apply. See do I need a BAA for analytics tools and is my wellness brand subject to HIPAA.

A tracking tool or a team

Need	Signal tool alone	Coast with a BAA-backed data layer
Server-side delivery and data scrubbing	Yes	Yes, through Ours Privacy or Curve
Signed BAA	Varies by vendor	Yes, from the data-layer vendor
Event design for Meta's restriction rules	Left to you	Coast designs and maintains it
Category review and Meta escalation	Left to you	Coast files and follows it
Creative and media buying	No	Coast runs both
Ad policy review	No	Coast reviews every creative

A tool cleans the data. A restricted account also needs someone to design the events, handle Meta, and keep the ads running while signal returns.

FAQ

Is Tier 2 an official Meta term?
Meta's help pages call it a restriction on certain standard events. Tier 1, 2, and 3 are shorthand for Meta's three restrictions.

Can I rename my Purchase event to get around Tier 2?
Renaming carries risk. Meta reviews new custom events and can block those it detects carrying prohibited information. Build custom events that carry no health information, and confirm them in Events Manager.

Does the Conversions API bypass the restriction?
No. The restriction applies to the data source, including server events. Server-side delivery helps because you control and clean what leaves your site.

Will a new ad account or pixel fix it?
Rarely. The new asset tracks the same site, and Meta categorizes from the site's topics and offerings.

How long does Meta's review take?
Meta sets the timeline and answers by email. Clean your site and events before you file so the review sees the current state.

Does a high Event Match Quality score mean my signal is back?
No. EMQ measures how well customer details match Meta's records. Check whether the event is accepted for optimization and arriving in Events Manager.

Does Meta sign a BAA?
No. Remove PHI before data reaches Meta, through a server-side layer whose vendor signs a BAA with you.

What does Coast do for a restricted account?
Coast reads the restriction, installs a BAA-backed server-side data layer, rebuilds events and audiences to Meta's rules, handles the category review, and runs compliant creative and media.

Sources

Not legal advice. Review claims with counsel.