Medical advertising regulations don't live in one place. A single Facebook ad for a dental practice can answer to Meta's health policies, the FTC's rules on claims and reviews, a state dental board, the ADA Code and HIPAA, all at once. This hub is the map: who sets each rule, which kind of ad it touches, where the official text lives and what to re-check before every campaign. We checked every source linked here on October 22–23, 2026, and each page in this section carries its own date.
Not legal advice — confirm with counsel or your licensing board. Platform policies in particular change often, sometimes several times a year, so treat any summary, including ours, as a starting point and read the current official text before you launch.
Who regulates a practice's advertising
Five kinds of rulemaker shape what a practice can say and how it can target:
| Rulemaker | What it controls | What happens when you break it |
|---|---|---|
| Ad platforms (Google, Meta) | What ads may promote, say and target; who needs certification | Disapproved ads; account suspension, sometimes without warning for egregious violations (Google (opens in a new tab)) |
| Federal Trade Commission | Truthful, substantiated claims; endorsements; reviews | Enforcement; civil penalties for knowing violations of FTC rules, up to $53,088 per violation at the 2025 adjustment (16 CFR 1.98 (opens in a new tab)) |
| FDA | Drug marketing, including compounded drugs | Warning letters (FDA (opens in a new tab)) |
| State boards, provincial colleges and professional codes | Professional advertising: credentials, testimonials, fees | Discipline of the licensee; for associations, member discipline |
| HHS Office for Civil Rights (HIPAA) | Use of patient information in marketing and tracking | Investigations and corrective action (AHA v. Becerra (opens in a new tab)) |
A sixth player, LegitScript, is a private company, not a regulator, but Google and Meta use its certification as a gate for certain services.
The practical point: approval by a platform doesn't mean an ad is lawful, and a lawful ad can still be rejected by a platform. You need to clear every layer. Strategy across channels is in the healthcare advertising guide; this section is about the rules.
Platform policies: Google Ads and Meta
Google Ads. Two policies matter most. Healthcare and medicines (opens in a new tab) controls prescription drug terms, online prescribing, addiction services and other restricted topics, and labels many approved healthcare ads "Eligible (limited)." Personalized advertising (opens in a new tab) blocks advertiser-curated audiences, such as remarketing lists and Customer Match, for health-related ads. Walkthrough: Google Ads healthcare policy.
Meta (Facebook and Instagram). The Advertising Standards (opens in a new tab) apply to every ad, and Meta reviews creative, targeting and landing pages. Three rules cause most practice rejections:
- the personal attributes (opens in a new tab) rule, which allows "Depression counseling" but not "Depression getting you down? Get help now.";
- the Health and Wellness (opens in a new tab) rules: 18+ targeting for cosmetic and weight-loss ads, no negative statements about bodies, no deadline promises without qualifiers;
- prescription drug rules that require certification and Meta's authorization.
Walkthrough: Facebook ads health policy.
Both of Medfy's ad add-ons are built around these rules: the Google Ads add-on suggests ad copy that is checked against healthcare policy, and the Meta ads + AI creatives add-on writes copy for healthcare ad policies. Each is $199/month on top of the base plan, with ad spend paid directly to Google and Meta; details are on Medfy pricing.
Certification gates: LegitScript and restricted services
Some services can't be advertised at all until a third party vouches for the business:
- Addiction treatment: LegitScript certification on Google (US and Canada) and Meta (US-targeted ads).
- Telehealth that prescribes and online pharmacies: LegitScript (or NABP for pharmacies on Google), then each platform's own certification or authorization.
- Prescription drug keywords on Google: certification required to keyword-target drug names.
LegitScript's own FAQ says in-person clinics are generally not eligible for its healthcare program unless they offer telemedicine that may result in a prescription or take online payments for prescription medications (LegitScript (opens in a new tab)). In other words, most practices neither need nor can get it. Fees, standards and timelines are in LegitScript certification, and the most common gated case for med spas and wellness clinics is covered in GLP-1 advertising rules.
Medfy doesn't provide LegitScript certification, and its ad add-ons can only run campaigns your accounts are eligible to run.
FTC rules: claims, endorsements and reviews
The FTC covers three areas a practice touches every time it advertises.
Claims. The FTC's Health Products Compliance Guidance (opens in a new tab) (December 2022) expects health claims to rest on "competent and reliable scientific evidence" and judges an ad by its overall net impression, images included. See FTC health claims guidance.
Endorsements and testimonials. The Endorsement Guides (16 CFR Part 255 (opens in a new tab), revised July 2023) say endorsements "must reflect the honest opinions, findings, beliefs, or experience of the endorser," require clear disclosure of material connections such as free treatment, and expect ads with atypical results to state what people generally achieve. The FTC's FAQ (opens in a new tab) applies this to influencers and employees. See FTC Endorsement Guides.
Reviews. The Consumer Reviews and Testimonials rule (16 CFR Part 465 (opens in a new tab)), in effect since October 21, 2024 (FTC Q&A (opens in a new tab)), bans fake reviews, incentives conditioned on positive or negative sentiment, undisclosed insider reviews and certain review suppression. See FTC fake reviews rule, and for the related practice of asking only happy patients, review gating rules.
State licensing boards and professional codes
Your license brings a second set of advertising rules, and they vary by state, province and profession. Common themes include specialty and "board certified" claims, testimonials, guarantees and how fees and free services are advertised.
Three verified examples show the range:
- Dentists (ADA Code): dentists may advertise, but not "in a manner that is false or misleading in any material respect," including via social media; only dentists who meet the Code's requirements may announce as specialists (ADA Principles of Ethics and Code of Professional Conduct (opens in a new tab), advisory opinions revised to October 2025).
- Florida: ads for free or discounted services by many licensed practitioners must carry a capitalized 72-hour refund statement (Fla. Stat. 456.062 (opens in a new tab)).
- Ontario: the physician regulator's policy prohibits testimonials and comparative claims (CPSO (opens in a new tab)), and the dental regulator bars testimonials and giveaways (RCDSO (opens in a new tab)).
How to find and read your own board's rules: state board advertising rules.
Where HIPAA fits in advertising
HIPAA doesn't regulate what your ad says. It regulates what your ad uses. Under the Privacy Rule, marketing means a communication "about a product or service that encourages recipients of the communication to purchase or use the product or service" (45 CFR 164.501 (opens in a new tab)), and a covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing," with narrow exceptions (45 CFR 164.508 (opens in a new tab)).
In advertising, that bites in three places:
- Testimonials and photos. A patient's story, face or before-and-after result needs their signed authorization.
- Patient lists. Uploading patient emails or phones to build a Custom Audience or Customer Match list discloses who your patients are.
- Tracking. Pixels on pages that reveal health information can send it to ad platforms. Meta's Business Tools Terms (opens in a new tab) separately bar businesses from sending health information. In June 2024 a federal court vacated one part of HHS's online-tracking bulletin, the "Proscribed Combination" of an IP address with a visit to a public page about specific health conditions, and said the ruling doesn't limit the rest of that guidance (AHA v. Becerra (opens in a new tab)).
The full picture is in HIPAA marketing rules.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
A pre-launch compliance checklist for any ad
Copy this one-page checklist into your launch notes and run it for every new ad, landing page and offer.
Claims
- Every health claim is something you can support with competent and reliable scientific evidence.
- No cure claims, no deadline promises ("in 30 days") without qualifiers, no promised outcomes.
- Comparative or "best" claims are substantiated, and allowed by your board.
- Credentials ("board-certified", "specialist") are accurate for every clinician named or pictured.
Testimonials and reviews
- Every testimonial is real, current and from a real patient.
- The patient signed a HIPAA marketing authorization.
- Atypical results carry a clear statement of typical results.
- Free treatment, payment or family and staff relationships are disclosed.
- Your board or college allows testimonials at all.
Imagery
- Photos show your real team, rooms and patients (with authorization), not stock "patients."
- No AI-generated or edited "results."
- Weight and cosmetic images avoid negative framing and pinched-fat close-ups.
Targeting
- Copy describes the service, not the viewer's condition.
- Cosmetic, weight-loss and prescription-drug ads target people 18 or older.
- No remarketing or uploaded patient lists for health-related ads.
Tracking
- No ad pixels or conversion events on condition pages, patient forms or portals.
- Lead forms ask for contact details only, never symptoms or conditions.
Certifications and offers
- No prescription drug names in keywords unless certified.
- Addiction, telehealth-prescribing and pharmacy ads have LegitScript and platform approval.
- Discounts or free services on insured care cleared with counsel; state disclosure wording included where required.
A free marketing audit checks the public side of several of these for you, including ad pixels on patient forms.
Guides in this section
- Google Ads healthcare policy: restricted drug terms, certification, remarketing limits and how to appeal.
- Facebook ads health policy: the personal attributes rule, age limits and rewrites that pass.
- LegitScript certification: who needs it, what it reviews, published fees and timelines.
- GLP-1 advertising rules: semaglutide and tirzepatide ads on Google and Meta, plus FDA and FTC limits.
- FTC Endorsement Guides: patient testimonials, influencers and staff reviews.
- FTC health claims guidance: what counts as evidence and how to rewrite risky claims.
- FTC fake reviews rule: what's banned, incentives, insiders and review suppression.
- State board advertising rules: specialty claims, testimonials, fees, and how to find your board's rules.
Frequently asked questions
What are the rules for advertising a medical practice?
There isn't one rulebook. Ad platforms such as Google and Meta set their own health policies, the FTC requires truthful, substantiated claims and honest endorsements and reviews, your state board or provincial college sets professional rules, and HIPAA governs any use of patient information. Check each layer before a campaign launches, because platform policies in particular change often.
Can doctors use patient testimonials in ads?
Often yes, with conditions, but check your board first. The FTC requires testimonials to reflect real experiences and, when results aren't typical, a clear statement of what patients generally achieve. HIPAA requires the patient's signed authorization before you use their information in marketing. Some boards and codes go further: Ontario's physician and dental regulators bar testimonials in advertising altogether.
Do I need LegitScript certification to advertise?
Most practices don't. Google and Meta tie LegitScript requirements to addiction treatment, online pharmacies and telehealth providers that prescribe. A dental, dermatology, physical therapy or family practice advertising in-person visits, without bidding on prescription drug names or prescribing online, generally falls outside those categories. LegitScript itself says in-person clinics are generally not eligible.
Can a practice advertise prescription drugs like Botox or semaglutide?
Only within tight limits. Google requires certification to keyword-target prescription drug names and to promote online prescribing. Meta requires LegitScript certification and its own authorization for telehealth providers and pharmacies promoting prescription drugs. Canada limits public drug ads to name, price and quantity. Most practices advertise the treatment or program and leave the drug to the visit.
Who enforces healthcare advertising rules?
Several bodies, each with its own tools. Google and Meta disapprove ads and suspend accounts. The FTC can seek civil penalties for knowing violations of its rules, such as the consumer reviews rule. FDA issues warning letters about drug marketing. State boards and provincial colleges discipline licensees, and HHS's Office for Civil Rights enforces HIPAA.
Does HIPAA apply to advertising?
Yes, whenever patient information is involved. Using protected health information for marketing generally requires the patient's written authorization, which covers testimonials, photos and patient lists uploaded for ad targeting. Tracking pixels on pages that reveal health information raise the same question. An ad that never touches patient data, such as a search ad for new patient visits, doesn't trigger HIPAA.