Yes, a federal court partially vacated OCR's tracking-technology guidance in June 2024. That changed what OCR can enforce about IP addresses on unauthenticated pages. It did not change HIPAA's disclosure rules, it did not touch state attorneys general, and it did not stop the class-action bar. If your med spa handles protected health information and a Meta Pixel ships it to Facebook, you have the same problem URMC had.

Here's how to run Facebook ads for a med spa in 2026 without becoming the case study.

The med spa gray zone: "we're mostly cosmetic" is not a defense

Med spas love to self-exempt. The reasoning goes: Botox and filler are elective cosmetic services, more retail than medicine, so HIPAA doesn't really apply to us.

That logic collapses on contact with an actual med spa service menu:

• Botox and filler are prescription drugs administered under a medical director. Arguably retail-adjacent in how they're sold — still a medical treatment record when someone books one.
• GLP-1 weight-loss programs (semaglutide, tirzepatide) are unambiguously health information. A person's interest in medical weight loss, transmitted to Meta with their identity, is exactly the kind of disclosure regulators and plaintiffs' attorneys are hunting.
• Hormone replacement therapy, IV therapy, laser treatment of medical conditions (rosacea, acne, vascular lesions) — clearly clinical.

The gray zone cuts one way in practice. If your med spa is a covered entity — and most are, the moment they bill insurance for anything or operate under a medical practice — then everything routes through HIPAA, including the lead form for a "cosmetic" lip filler special. And even if you've structured yourself as pure cash-pay cosmetic, state consumer-privacy laws (Washington's My Health My Data, California, Connecticut) define "consumer health data" far more broadly than HIPAA and carry private rights of action. The pixel doesn't know which of your pages is "cosmetic." Neither does the plaintiff's expert who crawls your site.

The safe operating assumption for 2026: treat every visitor interaction on your med spa's website as potentially regulated health data, and architect your ads tracking so it never matters.

The membership remarketing trap

Med spas monetize through memberships and loyalty programs — which means marketers instinctively want to sync client lists to Meta as Custom Audiences and retarget site visitors who viewed the GLP-1 page. Both are direct disclosures of identifiable health information to an ad platform without authorization. Uploading your active membership list to Facebook is not "just email matching"; it's telling Meta these specific people are patients of a medical business. Don't do it from raw client data. (There's a compliant way to feed Meta signal — covered below. For the retargeting question in depth, see the healthcare retargeting playbook.)

Why the Meta Pixel is the specific problem

The standard Facebook ads setup — Pixel on every page, automatic Advanced Matching on — sends Meta the visitor's identity signals (hashed email, phone, name from form fields), the URL they're on (/glp1-weight-loss/), the button they clicked, and the form they submitted. That combination is an identifiable person plus a health context. That's the disclosure. Full analysis: Is the Meta Pixel HIPAA compliant? Short version: Meta won't sign a BAA, so the answer is no for any page touching health information.

Ripping out the pixel and flying blind isn't the answer either — Facebook ads without conversion signal decay fast. The answer is replacing the pixel's job with infrastructure you control.

The compliant architecture: first-party tracking + server-side conversions

Here's how PilotPractice runs it for med spa clients:

1. No Meta Pixel on any page that handles health information. For most med spas that means no pixel, period — simpler than litigating page-by-page which services are "cosmetic enough."
2. One first-party tracking script on the site, served from the practice's own infrastructure, with a strict allowlist: UTM parameters and ad click IDs (including Meta's fbclid) and nothing else. No page-content scraping, no form-field capture, no third-party beacons.
3. A first-party visitor ID stitches the ad click to the eventual lead — inside the practice's CRM, not Meta's servers.
4. Server-side conversion uploads via the Conversions API. When a lead books a consult, Meta receives a conversion event tied to the click ID. Meta never receives form contents, service interest, page paths, or PHI. It learns "this ad click converted" — enough to optimize campaigns, nothing more.
5. Retraction jobs. If a conversion event ever needs to be pulled — a test lead, a data-subject request — it can be retracted, not just regretted.

You keep the optimization signal that makes Facebook ads work. Meta stops receiving the data that makes them a liability. Same architecture, different platform, for Google Ads.

What med spa Facebook ads actually look like in 2026

Compliance is the floor. Here's what performs.

Offers and creative that convert

• Intro offers on gateway services. "$X off your first Botox visit" or a new-client facial-plus-consult bundle. Gateway services feed the membership funnel where the real LTV lives — a $200 CPL is cheap against a $3,000+/year member.
• Before/after creative — with two rulebooks. Meta's ad policies restrict before/afters that imply unrealistic results or target based on personal attributes ("struggling with your weight?" gets ads rejected). HIPAA and state law require written, marketing-specific patient consent before a patient photo appears in an ad — a treatment consent form doesn't cover advertising use. Get standalone media releases or use licensed/model imagery.
• Event and open-house ads. Injector meet-and-greets, laser demo days, membership launch parties. Events convert cold audiences well because the ask is low-commitment — and the RSVP form should route through compliant intake capture, not a Facebook lead form dumping into a spreadsheet.
• Know the GLP-1 rules. Meta restricts weight-loss ads (18+ targeting minimum, no idealized body imagery, no before/after weight photos) and has tightened enforcement on compounded GLP-1 promotion. Advertise the program and consultation, not the drug and the pounds.

Targeting: broad + strong offer wins

Meta removed detailed health and sensitive-interest targeting in January 2024, so the old med spa playbook — stacking "Botox," "medical spa," and competitor interests — is gone regardless of compliance. What works now is broad or lightly-constrained targeting (geo radius, age, gender where appropriate) with a strong offer and creative that self-selects the audience, fed by clean server-side conversion signal so Meta's delivery system finds your buyers. In practice, med spas running this way see CPLs competitive with the interest-targeting era — aesthetics is a crowded auction, but high-LTV memberships mean you can sustain CPLs that would sink a one-and-done service business. Judge campaigns on cost per booked consult and 12-month member value, not cost per lead.

The med spa Facebook ads compliance checklist

Run this against your current setup — no email required:

1. Is the Meta Pixel (or any Meta tag) present on any page of your site? Check with your browser's network tab for facebook.com/tr.
2. Is Advanced Matching capturing form fields (email, phone) and sending them to Meta?
3. Are you uploading client or membership lists to Meta as Custom Audiences from raw patient data?
4. Are you running website retargeting audiences built from health-service page visits?
5. Do Facebook Lead Ads dump into a spreadsheet or a non-BAA tool?
6. Does every ad using a patient photo have a standalone, marketing-specific media release on file?
7. Do your GLP-1/weight-loss ads comply with Meta's restricted-category rules?
8. Can you produce a data map of exactly what your tracking sends to Meta — and retract an event if needed?
9. Do you have signed BAAs with every vendor that touches lead data (CRM, forms, booking, agency)?
10. Has your agency ever mentioned any of the above unprompted?

If questions 1–5 turned up a "yes," you're running the URMC setup.

How to actually run this (or have us run it)

The do-it-yourself path: strip the pixel, deploy a first-party click-ID capture, wire the Conversions API to fire server-side conversion events only, rebuild campaigns around broad targeting plus gateway offers, and put a media-release process behind every patient photo. It's all doable — it's just infrastructure work most med spas and most agencies haven't built.

PilotPractice has. We run Facebook ads for med spas on exactly the architecture described here — first-party tracking script, allowlisted click IDs, server-side conversion uploads that never carry form contents or PHI — plus the landing pages, booking, and CRM behind them, under a signed BAA. Your campaigns keep full optimization signal; your compliance officer keeps their weekends.

Book a demo and we'll show you the tracking data flow live — including exactly what Meta does and doesn't receive.

Related: Is the Meta Pixel HIPAA compliant? · HIPAA-compliant Google Ads · Facebook ads for dental practices · Facebook ads for therapy practices · The full HIPAA-compliant marketing guide

Security and compliance documentation, including our SOC 2 and HIPAA posture: trust.pilotpractice.com