Data use restrictions are limits Meta places on what it will accept and use from a business’s website or app data when that business, or the data it sends, falls into a sensitive category such as health. In practice they can stop certain events or details reaching Meta and prevent you optimising ads for some conversions.
How data use restrictions work
Meta’s business tools terms already forbid sending sensitive information, such as someone’s medical condition, through the pixel or the Conversions API. On top of that, Meta reviews data sources and can classify a dataset, domain or app as belonging to a restricted category. Health and wellness is the best-known example, and some financial services have seen similar treatment.
Once a dataset is flagged, several things can happen. Meta may filter out URL paths and custom parameters, because an address such as /treatments/hair-loss/ reveals something about the visitor. It may stop accepting some events, or block lower-funnel events such as Purchase or Lead from being chosen as the optimisation event in a campaign. Reporting may still show some activity while optimisation is limited. The status and any warnings for each dataset appear in Events Manager.
The detail has changed several times and differs by country and category. Treat what your own account shows at the time of writing (October 2026) as the authority, rather than any general description, including this one.
Why it matters
For UK private clinics, pharmacies, therapists, fertility services and wellness brands, these restrictions change how a Meta campaign has to be built. Information about someone’s health is special category data under UK GDPR, and the ICO expects extra care with it. A pixel that tells Meta “this person viewed the hair loss treatment page” is sharing exactly that kind of information, whether or not anyone meant it to.
So the restrictions protect you as well as your patients. They also mean a clinic may not be able to optimise for bookings the way a furniture shop optimises for sales, and that retargeting people by the condition they read about is off the table. Planning around that from the start avoids an expensive surprise after launch.
Common mistakes
- Treating it as a tracking fault. Events disappearing from a health site is often the restriction working as designed, not broken code.
- Sending health detail in URLs or parameters. Page paths, form values and custom parameters that name conditions or treatments should never reach an ad platform.
- Trying to work around the flag. Renaming events or moving data into a fresh dataset to escape a restriction risks breaching Meta’s terms and does nothing for your UK GDPR position.
- Building audiences from condition pages. Retargeting people because they read about a specific condition is the kind of use both Meta and regulators object to.
- Forgetting the copy rules. Data restrictions sit alongside Meta’s personal attributes policy, which bars ads that imply you know someone’s health status.
How to act on it
If you run a health or wellness business, open Events Manager and check each dataset for restriction notices. Then audit what your site actually sends: page URLs, event names and parameters. Strip anything that names a condition or treatment, and use neutral event names such as “Booking request” rather than “Anti-wrinkle consultation”.
Build campaigns that do not depend on deep conversion optimisation: broader audiences, upper-funnel objectives where needed, and measurement of bookings in your own system rather than only in Ads Manager. Make sure your privacy notice and cookie banner describe Meta tracking honestly. This review is a regular part of the work described on Facebook and Instagram ads for clinics and healthcare.