HIPAA-safe retargeting: building ad audiences without PHI
Why pixel retargeting of intake visitors is a risk, what Meta and Google allow for health audiences, and how to build consented, hashed segments without PHI.
Written for growth and paid media leads at telehealth brands, clinics and DTC health programs who want to re-engage visitors without sending PHI to ad platforms
No ad platform makes retargeting HIPAA compliant for you. Meta’s terms forbid sending it health information at all, and Google restricts advertisers’ own audience lists for health ads, whether or not HIPAA applies to you. What you control is what goes into an audience: who is in it, how they got there, what identifiers you send, and what the audience implies about them.
A safe audience is built on your side, from people who consented, with hashed identifiers only, and with a name and a rule that say nothing about a condition. Often the most useful audience in health is not a retargeting list at all but an exclusion list, plus server-side conversions so the platform can find new patients on its own.
What is retargeting, and why is it different in health?
Retargeting means showing ads to people who already interacted with you: visited a page, started a form, added something to a cart. The classic way to do it is a browser pixel. The pixel drops a cookie, reports the visit to the ad platform, and the platform builds a list of everyone who loaded a given page.
On a shoe store that is harmless. On a telehealth site the page itself is the problem. A list called “Visited GLP-1 eligibility quiz” or “Started anxiety intake” tells the ad platform that a specific person is looking into a specific treatment. The pixel also sends the page URL, the event name and, with automatic matching turned on, form fields such as email and phone. We cover what a pixel sends in detail in are Meta and Google pixels HIPAA compliant?.
Regulators have looked at exactly this pattern:
- The FTC and HHS joint letter (July 20, 2023). The FTC and the HHS Office for Civil Rights wrote to approximately 130 hospital systems and telehealth providers, naming the Meta/Facebook pixel and Google Analytics, and warning that they “may be impermissibly disclosing consumers’ sensitive personal health data to third parties.”
- BetterHelp (March 2, 2023). The FTC said BetterHelp used consumers’ email addresses and “the fact that they had previously been in therapy” to have Facebook find and target similar people. BetterHelp agreed to pay $7.8 million for partial refunds. That is an audience built from health information, which is the thing this guide is about avoiding.
HHS’s tracking technologies guidance was also challenged in court, in American Hospital Association v. Becerra (Northern District of Texas, June 2024). The court ruled on June 20, 2024. Our pixel article covers what it changed; ask your counsel how it applies to your own pages.
What Meta and Google allow for health audiences
Before HIPAA even comes up, the ad platforms’ own terms decide what you can build. We read both on October 30, 2026.
| Platform | What its own terms say | What it means for retargeting |
|---|---|---|
| Meta (Custom Audiences, Pixel, Conversions API) | Meta’s Business Tools Terms say you must not share data that “includes or is based on, directly or otherwise, health information”. The names and criteria for “your events, conversions, and any custom audiences” must not “reflect, imply or be based on” that information. | An audience defined by a condition, a treatment or an answer is against the terms, whatever channel the data came through. |
| Meta (Customer list audiences) | The Custom Audience terms say contact information is hashed before upload, and Meta “will delete the Customer List Data after the match process is complete subject to your choice of optional features”. The same terms bar audience names and criteria based on health information. | A hashed customer list is allowed in principle. Who is on it, and why, still cannot be health-based. |
| Google Ads | Google’s personalized advertising policy lists Health as a sensitive interest category. Advertisers in those categories “are unable to use advertiser-curated audiences”: Customer Match and “Your data segments” (previously called remarketing) are marked as not supported. Google’s predefined audiences remain available, with sensitive signals excluded automatically. | If your ads promote a health product, Google does not let you retarget with your own lists. Plan on broad and predefined targeting plus strong conversion signals. |
Two things follow. First, “HIPAA-compliant retargeting” is partly the wrong question: even a cash-pay brand that is not a covered entity is bound by Meta’s ban on health information and Google’s health restrictions. Second, the lists you can use have to be defined by something other than health.
What a compliant audience looks like
A compliant audience has five properties. Miss any one and it stops being safe.
1. It is built on your side, not by a pixel. The membership rule runs in a system you control, covered by a BAA if you are a covered entity and it sees intake answers. The ad platform receives a finished list, not a stream of page views it turns into a list.
2. It contains hashed identifiers only. Email and phone, normalized and SHA-256 hashed before they leave. Google says advertisers can hash customer data themselves “using the SHA256 algorithm”, and Meta’s terms require contact information to be hashed before transmission. No date of birth, no answers, no URLs, no free text.
3. Everyone in it consented. Only visitors who agreed to ad tracking go in. Store the consent with a timestamp so you can show who was sent and why. Meta’s Custom Audience terms also require that you have “all necessary rights and permissions and a lawful basis” to use the audience.
4. The rule and the name imply nothing about health. “Completed checkout”, “Existing customers” and “Newsletter subscribers” are neutral. “Qualified for GLP-1”, “PHQ-9 above 10” or “Ineligible, BMI under 27” are not, and Meta’s terms apply to the names and criteria themselves.
5. It matches the platform’s own rules. On Google, if you advertise a health product, an advertiser-curated list may not be allowed at all. On Meta, a list can be fine where a condition-based one is not. Check the current policy for each platform before you sync.
| Audience | Built from | Health implied? | Typical use |
|---|---|---|---|
| Existing customers (exclusion) | Completed checkout, consented, hashed email | No, if the brand sells more than one thing | Stop paying to reach people who already bought |
| Drop-offs from a single-treatment funnel | Started but did not finish the GLP-1 quiz | Yes: the funnel names the treatment | Avoid on ad platforms; re-engage by email or SMS with consent instead |
| General site visitors | Pixel on every page | Often yes, through URLs | Avoid on any page that asks a health question |
| Newsletter subscribers | Consented sign-up, hashed email | No | Suppression or a broad lookalike seed, if the platform allows it |
| Ineligible patients (exclusion) | Routed to “not eligible” | Yes: eligibility is a health judgment | Keep it in your own system; suppress them in your own email tool |
For a brand with a single treatment, almost any behavior inside the funnel implies the condition, because the funnel itself does. That is why many health brands use ad audiences mainly for exclusions and lean on their own channels to bring drop-offs back.
Exclusion audiences: the safest place to start
An exclusion audience tells the platform who not to show an ad to. The most common one is existing customers. It saves money and avoids showing a patient an ad for something they are already being treated with.
Build it from completed checkouts, send hashed emails and phones only, refresh it on a schedule, and give it a plain name such as “Customers, exclude”. If your brand sells only one treatment, ask counsel whether even a customer list implies the condition, and keep it to platforms whose terms allow it.
Google’s help pages say a Customer Match list needs at least 100 members added or updated in its window to stay eligible, and that memberships expire after 540 days, so a list you upload once and forget will decay. Refresh it from your system rather than by hand.
Re-engaging drop-offs without an ad audience
The visitor who started intake and left is the one most teams want to retarget, and the one that is hardest to do safely on an ad platform. A few alternatives that keep the health context in your own systems:
- Email or SMS, with consent. If the person gave an email early in the flow and agreed to be contacted, a reminder from your own email tool keeps the context out of ad platforms. Your email vendor may need a BAA if you are a covered entity; see which marketing tools sign a BAA.
- Better first-visit conversion. Fewer drop-offs means less to retarget. Step-level drop-off data shows which screen loses people.
- Server-side conversions for optimization. Instead of a list of who left, send the platform a hashed, consented, neutrally named conversion for who finished. The platform’s own bidding then looks for more people like your converters, without you handing it a health-based list. Our guide to server-side conversion tracking for healthcare covers the setup.
How to do it in PathwAI
PathwAI is an AI-native patient acquisition platform: an agent builds the intake flow, eligibility quiz and checkout from a plain-English description, and the team reviews and approves it before anything publishes. Its built-in Data Platform handles conversions and audiences.
- Audiences from behavior, built on your side. Segments are built from behavior such as completions, drop-offs, product interest and consent status, and synced to Meta, Google and TikTok. You choose which segments go to which platform, and the platforms’ own policies above still apply.
- Hashed and stripped before anything leaves. Email and phone are SHA-256 hashed, and PHI such as date of birth and condition is stripped before any event leaves. Ad platforms receive only hashed identifiers, and only for visitors who consented.
- Consent as a step. Consent is a first-class step in the flow, timestamped and stored with the intake data. Your clinical or legal team reviews the wording.
- No third-party pixels. The Data Platform uses first-party cookies only, and its script loads from your own domain, so no ad platform builds lists from your intake pages.
- Server-side conversions. Events go to Meta through the Conversions API, to Google Ads through Enhanced Conversions and Customer Match, to TikTok through the Events API and to Microsoft Ads as offline conversions. See the Meta and Google Ads integration pages.
- A BAA on Enterprise. PathwAI signs a BAA on the Enterprise plan, and does not sell PHI or use it for advertising. More on the HIPAA page.
A practical setup: one segment for completed checkouts, named “Customers, exclude”, synced as an exclusion; neutral conversion events (“Lead”, “Purchase”) sent server-side; and drop-off reminders handled in your own email tool rather than as an ad audience.
Checklist
- Remove ad pixels from quiz, intake, booking, checkout and logged-in pages.
- List every audience you sync today and the rule behind each.
- Rename or delete any audience whose name or rule implies a condition, treatment or answer.
- Send hashed email and phone only, for consented visitors only.
- Check Google’s personalized advertising policy before using your own lists for a health product.
- Start with an existing-customer exclusion audience and refresh it automatically.
- Re-engage drop-offs through your own consented email or SMS.
- Get a BAA from every vendor that sees intake answers, if you are a covered entity, and have counsel review state health privacy laws.
Frequently asked questions
Which ad platforms let you retarget patients and stay HIPAA compliant?
None does it for you: Meta’s terms forbid health information outright. Compliance depends on what you send: consented, hashed identifiers in an audience that implies nothing about health. Google also bars advertiser-curated audiences for ads in its Health category.
Can I use Google Customer Match for a telehealth brand?
Google’s personalized advertising policy says advertisers promoting in sensitive interest categories, which include Health, cannot use advertiser-curated audiences such as Customer Match. Check how your ads are classified, and plan on predefined audiences plus server-side conversions.
Can I upload a customer list to Meta?
Meta’s Custom Audience terms allow hashed customer lists, but the audience’s name and criteria must not be based on health information. A list of all customers of a brand with several products is different from a list of people who qualified for one treatment.
Is hashing the email enough?
No. Hashing protects the identifier, not the meaning of the list. If the list is “people who took our anxiety screening”, the platform still learns that fact about every match.
We are not a covered entity. Does any of this apply?
HIPAA may not, but Meta’s and Google’s own health rules do, and the FTC has acted against non-HIPAA brands, as the BetterHelp case shows.