Healthcare and Telehealth Paid Media in 2026: Three Regulators, None of Them Reading the Same Rulebook

Mental health paid search broke in 2025. Across 3,542 US search campaigns, cost per click rose 42%, conversion rate fell 61%, and cost per lead climbed 146% — the worst deterioration of any of 16 healthcare specialties (LocaliQ, 2025). In the same year, Meta began restricting conversion data for exactly those advertisers.

Healthcare is the restricted category where the platform rules, the privacy rules and the claims rules are enforced by different bodies, move in different directions, and rarely appear in the same document. Here is what each one actually says in 2026.

Which healthcare categories need certification on Google?

More than most teams expect, and each with its own country list (Google Ads Policy Help). Prescription drug services — online pharmacies and telemedicine — require Google Ads certification with LegitScript, NABP Digital Pharmacy Accreditation or a .Pharmacy domain accepted in the US and Canada, and promotion is allowed in 32 locations. Pharmaceutical manufacturers advertising prescription drugs can be certified in only three: Canada, New Zealand and the United States.

Addiction services need LegitScript in the US and Canada, but in Australia, France, Ireland and New Zealand only government entities may advertise. Health insurance uses G2RS certification rather than LegitScript, plus a separate certificate for ACA keywords. Cell and gene therapies are US-only and require the relevant FDA licence.

Two operational rules cause most rejected applications, and Google states both explicitly. Applications must be made at the child account level, not the manager account level. And separate applications are required per location or location group. Agencies must additionally submit proof of their relationship with the advertiser, and pharmaceutical manufacturers need a specific authorization letter in the one format Google accepts.

What LegitScript costs, and how long it takes

Healthcare Merchant Certification is $975 per website as a one-time application fee plus $2,150 annually per website, rising to $3,995 annually for merchants placed on enhanced monitoring (LegitScript). Addiction Treatment Certification runs $1,595 application and $3,095 annual for one to nine facilities, falling to $1,395 and $2,550 at 25 or more, with an individual practitioner tier at $535 and $1,070 (LegitScript). Expedited processing adds $2,500 and starts review within two business days.

On timing, LegitScript publishes no SLA and states it cannot give estimates, citing submission order, application complexity and applicant responsiveness. Every week-count in circulation is an agency guess. Budget a three-month runway and treat anything faster as upside — and note that LegitScript notifying Google, Meta and Microsoft is not approval, since each platform then runs its own queue behind it.

One 2025 change ran against the general direction of travel. From 29 October 2025, Google moved from a blanket restriction to a context-aware approach on prescription drug terms, permitting them in ad text and landing pages for non-promotional contexts such as public health announcements, academic publications and legal actions (Search Engine Land, 2025). Keyword targeting rules did not change and still require certification.

Why do Meta campaigns break for health advertisers?

Not because of a special ad category — health is not one. Meta's Special Ad Categories are credit and financial products, employment, housing, and social issues, elections or politics. They exist because of the Fair Housing Act and a 2019 Meta–HUD settlement, not health regulation. Any advice to "select the health special ad category" describes an option that does not exist.

What actually restricts health advertisers is Meta's data-source category system, rolled out from January 2025 after advance notice to advertisers in November 2024 (Digiday, 2025). The trigger is a business being "associated with medical conditions, specific health statuses or provider/patient relationship" — and classification happens at the domain level, not the ad level. Ads keep running while conversion data goes dark, which is exactly the failure mode that is hardest to diagnose from campaign metrics.

The restriction tiers escalate from losing custom parameters and advanced matching, through losing mid- and lower-funnel optimisation events such as Purchase, Lead and Booked Appointment, to full restriction of all events in some or all regions (Search Engine Land, 2025). US and Canadian advertisers generally land in the middle band, keeping awareness and traffic objectives; EU advertisers face complete restrictions on web activity tracking. Check status in Events Manager under Data Sources, then Settings, then Manage data source categories.

Meta's creative rules are separate and specific. Prohibited: statements of inferiority about physical appearance, close-ups pinching body fat, claims that results come solely from wearable products, claims to cure or eliminate named incurable conditions, clickbait framing in a health or weight context, and products promising permanent skin colour change (Meta Transparency Center). Claims about treating or managing symptoms are carved out.

Are tracking pixels actually illegal in healthcare?

Less settled than the coverage suggests. In June 2024, a federal court in AHA v. Becerragranted summary judgment in part against HHS OCR's online tracking bulletin, finding it improperly created substantive legal obligations, and ordered nationwide vacatur. OCR filed a Fifth Circuit appeal in August 2024 and moved to dismiss its own appeal roughly ten days later, without stating why.

What was vacated is narrow and specific: the position that HIPAA obligations trigger when a technology connects an IP address with a visit to an unauthenticated public page about a health condition or provider. What survived is the part that matters most — tracking on authenticated pages such as patient portals remains squarely in scope. Content declaring that "pixels are illegal now" and content declaring the guidance dead are both wrong, in opposite directions.

The more useful fact for budgeting risk: as of mid-2026 OCR has never announced a settlement or civil monetary penalty specifically for tracking-technology use. Every large payout came from elsewhere. The New York attorney general secured $300,000 from NewYork-Presbyterian over tracking tools live from June 2016 to June 2022 (New York Attorney General, 2023). Advocate Aurora Health settled pixel litigation for $12.225m covering more than 2.5 million people; Novant Health settled for $6.66m over a pixel the health system said was misconfigured during a 2020 MyChart promotional campaign.

The FTC has been the more active federal actor. Its case against Hims & Hers, filed with California and Utah in July 2026, alleges data sharing with Meta, Snap, Google, Microsoft, Pinterest, Reddit and TikTok via the Meta Pixel, Conversions API and uploaded customer lists (Federal Trade Commission, 2026). The deception theory rests on the marketing claim of a "100% online, private, and secure process" — which makes it a copy problem as much as a data problem.

Washington's My Health My Data Act, effective March 2024, is the state law with a private right of action, routed through the state consumer protection act so that a plaintiff need only prove injury and causation. It produced no filings for nearly a full year before the first class action in February 2025. Connecticut, Nevada and New York passed similar laws and all three declined to include a private right of action.

What evidence do health claims need?

Randomized controlled human clinical testing, as the default. The FTC's Health Products Compliance Guidance, issued December 2022 as the first revision in nearly 25 years, sets that standard regardless of whether the ad makes an express claim about the level of support (Federal Trade Commission). Animal studies, in vitro work, observational research, anecdotal evidence and public health advisories do not suffice on their own, and "numerous flawed and inadequate studies are unlikely to add up to competent and reliable scientific evidence."

Scope widened well beyond supplements: foods, OTC medicines, homeopathic products, health apps, health equipment and diagnostic tests. In April 2023 the FTC sent Notices of Penalty Offenses on substantiation to roughly 670 companies, exposing recipients to civil penalties currently set at $53,088 per violation — a figure that did not rise in 2026 because the government shutdown prevented publication of the CPI data the adjustment depends on.

The cautionary case is FTC v. Evoke Wellness. Between 2021 and 2023 the addiction treatment provider used deceptive dynamic keyword insertion to generate 68,510 Google search ads displaying the names of unaffiliated competing clinics, driving at least 3,500 calls to telemarketers who posed as a centralized admissions office — continuing to do so even when callers asked directly whether they had reached the clinic in the ad. The judgment was $7.5m, suspended to $1.9m on inability to pay (Federal Trade Commission, 2025). Dynamic keyword insertion is a routine account setting. In this vertical it is a liability surface.

What changed for pharma and telehealth advertising?

FDA enforcement of direct-to-consumer rules had collapsed before it reversed. More than 130 DTC enforcement letters went out annually in the late 1990s. By 2023 the number was three. Following a presidential memorandum signed 9 September 2025, HHS and FDA announced roughly 100 cease-and-desist letters and around 40 untitled letters in a single month, most targeting television ads, with exaggerated efficacy claims the most common basis.

FDA has also signalled it is using AI-assisted surveillance to review drug ads and anticipates ramping to hundreds of letters a year. The counterweight is capacity — the Office of Prescription Drug Promotion has been substantially reduced, which is why several law firms doubt the volume is sustainable. Separately, the proposal to eliminate the "adequate provision" standard for broadcast DTC ads sits in the 2026 Unified Agenda with a notice of proposed rulemaking expected December 2026, putting any final rule in 2027 at the earliest and facing a near-certain First Amendment challenge.

For compounded GLP-1 telehealth, the shortage-based business model ended on published dates. Enforcement discretion for compounded semaglutide ended 22 April 2025 for 503A facilities and 22 May 2025 for 503B; for tirzepatide, 18 February and 19 March 2025. Preliminary injunctions were denied in both challenges. FDA then ran three enforcement waves: more than 55 warning letters published September 2025, 30 letters to telehealth companies in March 2026 (FDA, 2026), and 25 more issued June 2026.

The cited violations are advertising violations, not manufacturing ones: sameness claims implying equivalence with approved products, "generic" language where no approved generic exists, and branding compounded drugs with the telehealth firm's own name without qualification. FDA publishes specific guidance for this (FDA).

Worth noting that the regulatory direction is not uniform. California, Texas and Florida removed the in-person visit requirement for telehealth GLP-1 prescribing between February and March 2026, covering more than 90 million residents, with further states reviewing. Product legality tightened while access rules loosened.

Where should the budget go?

Toward the specialties where the economics still work, and toward fixing measurement in the ones where they do not. Dermatology converts at 25.33% for an $18.54 cost per lead; addiction recovery converts at 0.50% with a $120.30 CPL. Both sit inside "healthcare" in a media plan and neither benchmark tells you anything useful about the other.

Prescription drug TV spend reached $5.96bn in 2025, up 16%, with weight loss and blood disorders up 67% and depression, bipolar and insomnia up 56%, while men's and women's health fell 40% (EMARKETER, 2026). 2025 was also the first year social media outpaced linear TV in healthcare and pharma ad spending.

Treat published telehealth CAC figures as unsourced. No Tier 1 or Tier 2 benchmark exists, and the ranges in circulation are agency self-reports that blend consultations with conversions and organic with paid. LocaliQ's cost-per-lead data has a stated methodology and sample size, which makes it the honest substitute — a cost per lead you can verify beats a cost per patient you cannot.

Our performance marketing team runs paid media for regulated healthcare advertisers where certification, data-source classification and claims substantiation are scoped before launch, and our funnel attribution work rebuilds measurement for accounts where platform conversion data has been restricted.