Paid ads: platform healthcare policies, LegitScript, and targeting limits

Why some healthcare ads need certification before they'll even run

Major ad platforms treat healthcare, and especially behavioral health and prescription-adjacent care, as a sensitive advertiser category with its own approval process — often requiring verification through a third-party healthcare-advertiser certification service before certain campaign types are allowed to run at all. This isn't a law; it's a platform's own risk-management policy, and it varies by platform and by what you're advertising (a general practice listing typically clears review faster than an ad naming a specific controlled-substance treatment).

Budget time for this before a launch date matters: certification review can take days to weeks, and a rejected ad account can delay a campaign far longer than the certification process itself would have.

Why targeting by health condition is restricted

Most major platforms restrict or outright prohibit ad targeting built around inferred health conditions or interests — no targeting people who've shown interest in "depression" or "addiction recovery" as a category, even when the intent is supportive rather than exploitative. This is a platform policy responding to a well-documented pattern of sensitive-category targeting being used in exploitative ways, not a HIPAA rule, but it functions the same way in practice: build campaigns around geography, general demographics, and search intent (someone searching "therapist near me") rather than inferred health status, and the campaign will clear review faster and carry less platform risk.

A workable substitute: build campaigns around ZIP codes or a radius around your office — or your licensed states, for telehealth — broad age bands, and keyword-based search campaigns that respond to what someone actively typed, rather than a platform's inference about their health status. Search-intent targeting captures much of the same audience without tripping the sensitive-category restriction at all, and it tends to convert better besides, since the person typing the search is already further along than someone the platform merely guessed might be interested.

Uploading your patient list for ad targeting is a HIPAA marketing question

Custom-audience targeting — uploading a list of emails or phone numbers so a platform can match them to accounts and either advertise directly to that list or build a lookalike audience from it — is a common tactic, and it is also squarely a use of protected health information for marketing if the list is your patient list. HIPAA requires authorization before PHI is used this way, and "they're already patients, they'd expect this" is not a substitute for that authorization 1Ref 1HHS Office for Civil Rights (2026).Marketing.That HIPAA requires authorization before PHI is used to market a product or service, applying to uploading a patient list for ad-platform custom-audience targeting..

The safer default: don't upload your patient list to any ad platform's audience tool, full stop. If you want a lookalike audience, build it from a general newsletter list that patients opted into for marketing specifically, kept separate from your clinical patient roster.

Testimonials and reviews inside ad creative follow the same rules as your website

A testimonial quote or star-rating badge inside a paid ad is still subject to the FTC's 2024 rule against fake, purchased, or suppressed reviews 2Ref 2Federal Trade Commission (2024).Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials.That the FTC bans fake, purchased, or suppressed reviews with civil penalties, applying to review content used inside paid ad creative., and the endorsement guidance requiring that any endorsement reflect honest experience with material connections disclosed 3Ref 3Federal Trade Commission (2023).FTC's Endorsement Guides: What People Are Asking.That endorsements must reflect honest experience with material connections disclosed, applying to testimonials featured in paid advertising.. Featuring a hand-picked positive review in an ad is fine; paying for that review, writing it yourself, or implying a typical result that isn't representative is not — the ad format doesn't create an exception the same claim wouldn't get on your own website.

The landing page has to be accessible, not just the ad

Every dollar spent driving traffic to a landing page that a screen-reader user or keyboard-only user can't navigate is a dollar spent on an experience Title III of the ADA's public-accommodation standard treats as a real access barrier 4Ref 4U.S. Department of Justice (2026).The Americans with Disabilities Act.That Title III public-accommodation obligations extend to website accessibility, applying to landing pages that receive paid ad traffic.. Paid traffic makes this more urgent than organic traffic, not less — you're actively paying to route people to that specific page, which raises the stakes on making sure it actually works for everyone who lands on it. Test the landing page's forms, buttons, and booking widget with a keyboard alone before a campaign goes live, not after complaints arrive.

Text-based retargeting and follow-up need consent, not just an ad click

If a paid campaign funnels into a text-based follow-up sequence — "reply YES to book" or an automated confirmation text — the TCPA's prior-express-consent requirement for automated or templated messages still applies, and clicking an ad is not itself consent to receive texts 5Ref 5Federal Communications Commission (2026).Telemarketing and robocalls.That prior express consent is required for automated texts, applying to text-based follow-up sequences fed by a paid ad campaign.. Build the consent step into the landing page or intake form explicitly, with its own checkbox, rather than assuming an ad click implies permission for what happens after it.

Building the compliant ad checklist

Before launching: confirm the platform's certification requirement for your ad category and budget time for review; build targeting around geography and search intent rather than inferred health conditions; keep your patient list out of any custom-audience tool; vet testimonial content against the same review-gating rules that apply to being referrable through organic reviews; and test the landing page for accessibility before spending on traffic to it. Paid ads work best as one channel alongside organic content marketing and a well-built site — not a substitute for either, since a certified, well-targeted ad still lands on the same five-page website doing the actual persuading.

What belongs — and what doesn't — in the ad copy itself

Ad copy for a healthcare practice carries a different bar than ad copy for a retail product: a specific outcome claim, such as promising how quickly a reader will feel better, reads as a clinical promise you can't actually make for every reader, and a platform's own ad-review process increasingly flags exactly this kind of language in healthcare categories. Keep claims to what's verifiably true about the practice itself — accepted insurance, appointment availability, credentials, specialty — rather than promised results.

Manufactured urgency, like a countdown timer on a booking page or copy claiming only a couple of slots remain this week, reads as a sales tactic in a category where the reader may already be anxious about seeking care, and it invites exactly the scrutiny a healthcare-advertiser certification review is built to catch. A steady, factual ad stating what you offer and how to book it typically outperforms an urgency-driven one in this category anyway, since the decision to start therapy or see a new prescriber is rarely one a countdown timer accelerates.