There is a sentence in Meta’s help centre that a workers’ compensation firm should read twice. Listing the kinds of information an advertiser may not send through the Meta Business Tools, under the heading of physical and mental health, it says: diseases, medical conditions and injuries.
Not “medical records.” Not “diagnoses.” Injuries. The noun that your ad copy is built around, that your landing page headline contains, that your intake form asks about in its second field, and that your campaign is probably named after.
This article makes a specific claim: the platforms have already classified your firm, the classification has already removed capability from your accounts, and the first place it shows up is not a compliance report but a performance report. That inversion is the whole problem. A policy consequence that arrives disguised as a media result gets fixed with media tactics, and media tactics cannot fix it.
Nobody sent you the memo, because the memo is a category field
The decision was made by a classifier reading your landing pages, and it is recorded in a settings tab nobody at the firm opens.
Firms expect regulation to arrive the way regulation has always arrived: as a letter, a rule change, a bar opinion, something with a date on it that somebody circulates. Platform classification does not work like that. Meta categorises data sources — the domains and apps that send it events — and if a domain lands in a restricted category, what Meta will accept and use from that domain changes. The record of that decision is a category on your dataset. It is visible to whoever opens Events Manager and goes looking. It is invisible to everybody else, including the person who signs the media invoice.
Google’s version is even quieter, because it is not a flag on your account at all — it is a property of what you promote. If the products and services you advertise fall inside a sensitive interest category, the targeting restrictions apply, and Health is one of twenty-one entries on that list, sitting alongside abuse and trauma, negative financial status and relationship hardships. There is no toggle to find. The restriction is a consequence of being what you are.
What makes this worth a managing partner’s attention rather than a marketing coordinator’s is that the classification is reasonable. An injured worker typing their shoulder injury into a stranger’s website is exactly the person these rules were written for. The problem is not that the rules exist. It is that a whole practice area has been built on top of them without anyone noticing they were there.
Meta’s prohibited list names your product
The terms are specific about the information, specific about the five channels, and specific about who is responsible.
Meta’s guidance on prohibited information is unusually plain for a platform document. It says Meta does not want or permit advertisers to use the Business Tools to share information that is not allowed under the Business Tools Terms, that prohibited information includes health information, and that — this is the operative clause — “the names you choose and criteria you establish for your events, conversions, and Custom Audiences must not reflect, imply, or be based on any prohibited information.”
Read that against how a comp campaign is actually built. The custom conversion is called Back Injury Lead. The custom audience is called Shoulder — viewed, no form. The thank-you page URL carries ?injury=knee&denied=yes because somebody wanted the source visible in analytics. Each of those is a name or a criterion based on the prohibited information, and none of them was created by a person acting in bad faith. They were created by a competent marketer doing what competent marketers do everywhere else on the internet.
| What a comp account typically contains | What the terms say about it |
|---|---|
| Thank-you URL carrying injury type, body part or denial status as a parameter | Prohibited information should not be shared in Business Tools data such as URL parameters |
| Custom conversion named for the injury or the claim status | Event and conversion names must not reflect, imply or be based on prohibited information |
| Custom audience segmented by which injury page was viewed | Custom Audience criteria must not be based on prohibited information |
| Custom event parameters passing the form’s clinical answers | Named explicitly as custom data, and covered by the same prohibition |
| “Meta filters it out anyway, so it does not matter” | Meta states its systems are not a substitute for your own compliance mechanisms, and that you are ultimately responsible for the data you share |
Meta offers a blunt instrument for firms that would rather not think about it, and it is worth knowing the name: a core setup restricts transmission of certain data, including custom parameters and anything in a URL after the domain. It is a deliberate narrowing of what your site is allowed to tell the platform. For most comp firms it is closer to the correct posture than the wide-open default they are running now — and the platform can place a Business Tool into a core setup itself, without waiting for you to agree.
What the Google classification takes off your shelf
This is the part with a price tag: four named audience capabilities, unavailable, by category.
Google’s restricted targeting policy for personalized advertising divides audiences into two kinds. Predefined Google audiences — in-market segments, affinity, demographics, life events, location — are, in Google’s words, “expressly configured without sensitive user signals,” so any advertiser may use them. Advertiser-curated audiences are the ones you build from your own data, and they “cannot be used if promoting in sensitive interest categories, because they may inadvertently contain sensitive user signals.”
Four things sit in that second bucket, and every one of them is a tool a growing law firm reaches for.
| Capability | What a comp firm uses it for | Status in a sensitive interest category |
|---|---|---|
| Customer Match | Uploading signed clients to suppress them, or past enquirers to re-engage | Advertiser-curated — not available |
| Your data segments (remarketing) | Returning to people who read a claim-denial page and did not call | Advertiser-curated — not available |
| Audience expansion | Widening a converting audience to find more like it | Advertiser-curated — not available |
| Lookalike segments | Modelling new prospects from your signed-case list | Advertiser-curated — not available |
| In-market, affinity, life events, location | Reaching injured workers by context rather than by history | Predefined — available to everyone |
Two further details in the same policy matter more than they look. Custom Segment audiences built with sensitive creative assets, or pointing at sensitive landing pages, “will only serve with Display campaigns to non-sensitive audiences or contextually” — and in all other campaign types, they “will not be eligible to serve” at all. And Demand Gen campaigns use advertiser-curated audiences by default, so a comp firm launching one may find it restricted from serving for reasons that never appear in the campaign’s own diagnostics.
Every other advertiser has to be careful not to send the injury. A workers’ compensation firm has to be careful not to send the only thing it sells.
Spencer Moeller, WorkersComp MarketingWhy this reads as an ad problem and gets treated as one
A filtered event and a fatigued creative produce the same chart.
Here is the sequence as a firm experiences it. Cost per lead drifts upward over six or eight weeks. Volume softens. The agency proposes new creative, which is what a reasonable agency proposes when performance decays, and the new creative helps for a fortnight. Then the drift resumes. Somebody suggests the market is saturated, or that a competitor has raised bids, or that the summer is always slow. Nobody suggests that the optimisation signal has been thinned by a filter, because the filter does not appear anywhere in the reporting they are all looking at.
It cannot appear there. A bidding system optimises against the conversions it receives. If a portion of those conversions is dropped before ingestion, the system is not told that it is working with less; it simply works with less. The dashboard reports the events that arrived. It has no column for the ones that did not. The diagnosis therefore has to come from a different place entirely — the diagnostics tab of the dataset, the blocked-parameters list, the data source category — and none of those is on the weekly report.
The figure below sets the two halves of this side by side: what the page sends, what the platform does with it, and what the account loses as a result.
There is a second-order effect that compounds it. Because the restrictions bite hardest on retargeting and list-based audiences, the channels a firm loses are the cheap ones. What remains is prospecting to cold audiences, which is the most expensive way to buy an injured worker’s attention. A firm can therefore experience the classification as a shift in its media mix toward the costly end, without anything in the account having been deliberately changed. Our piece on retargeting for comp firms flagged that the platforms’ own policy pages were the authority here; this is what that authority actually says.
The form is where the injury enters the system
The fields that make a lead valuable are the fields that make the event prohibited. That is not a coincidence — it is the same fact seen twice.
Trace a single enquiry. An injured worker lands on a page about denied claims, reads for two minutes, and fills in a form. Name. Phone. What part of your body was injured? When did it happen? Has your claim been denied? They press submit. The page they land on carries those answers in the query string so the intake team can see them at a glance. The pixel fires on that page. The conversion is recorded with a name somebody chose to be legible in a report.
Every one of those design decisions was made for a good reason. Together they take a clinical fact about a named individual and hand it to two advertising companies. The firm did not decide to do that. It decided to build a useful form and a legible report, and the transmission was the by-product.
That last point deserves a sentence of its own, because it is where the defensive move turns into an offensive one. The useful thing to tell a platform is not what was wrong with this person. It is which of the leads you sold us turned out to be worth having. That second signal comes from your intake team, arrives days later, contains no clinical content at all, and is the one both platforms have actually built machinery to receive. We wrote up that loop in detail in the piece on declined enquiries: the qualification answer is the input worth sending, and it is the one almost every firm leaves empty while diligently sending the one it should not.
HIPAA is not the law that reaches you
Every firm’s first instinct is that it is not a covered entity. That is true, and it is not the answer to the question.
This section is not legal advice, and we are a marketing agency rather than a law firm. It is here because the exposure shapes a marketing decision, and because the instruments involved are public documents a managing partner can read in an afternoon. Your own counsel should size any of this for your jurisdiction.
The Federal Trade Commission has brought health-privacy actions against companies that were not HIPAA covered entities, using the FTC Act and the Health Breach Notification Rule. In February 2023 it announced its first enforcement action under that rule, against GoodRx: a $1.5 million civil penalty, a permanent prohibition on disclosing user health information to third parties for advertising, a requirement to direct those third parties to delete what had been shared, and a mandated data retention schedule. The FTC also treated a HIPAA compliance seal displayed on the site as a misrepresentation in its own right. Five months later the Commission finalised an order against BetterHelp requiring $7.8 million in consumer refunds, banning the sharing of personal information for re-targeting, and requiring affirmative express consent before disclosure to certain third parties.
Both companies had promised privacy and then run ordinary marketing tags. That is the pattern worth noticing, because it is the pattern a law firm is most likely to reproduce: a sincere privacy policy on the website and a tag manager nobody has opened in two years.
State law has moved faster than federal law here. Washington’s My Health My Data Act, in the Attorney General’s own description, is the first privacy-focused law in the country to protect personal health data falling outside HIPAA’s ambit. Four features of it are relevant to a firm that has never thought about it:
| Feature of the Washington Act | Why it reaches a firm outside Washington |
|---|---|
| Applies to entities that conduct business in Washington or provide products or services targeted to Washington consumers | Geo-targeting is a setting, not a jurisdictional boundary; a national campaign can reach Washington without anyone deciding to |
| A violation is a per se violation of the state Consumer Protection Act, enforceable by the AG and through private action | Enforcement does not depend on a regulator having the appetite for it |
| Consumer health data includes information derived or extrapolated from non-health data | “We only track page views” is not automatically a defence when the page is about a specific injury |
| A separate, distinct link to a consumer health data privacy policy must be published on the homepage | It is the single most checkable item in this article, and almost no law firm homepage has one |
The third front is private litigation under wiretapping statutes, and here the honest account cuts both ways. Plaintiffs have argued that pixels, session replay and chat widgets amount to unlawful interception of website communications, most prominently under the California Invasion of Privacy Act. In August 2025, in Frasco v. Flo Health, a California federal jury found that Meta had violated CIPA by eavesdropping on confidential communications inside a health app without consent — a verdict against the platform, not merely the advertiser. At the same time, federal courts have grown stricter about standing, dismissing claims where plaintiffs cannot show concrete individualised harm, and a California bill that would have excluded routine commercial tracking from CIPA’s scope stalled in 2025 rather than passing. The landscape is genuinely unsettled. What is not unsettled is that the cost of being a test case is asymmetric, and that the defensive posture — send less, name things neutrally, get consent that is real — costs a comp firm almost nothing in performance.
You are holding a health record on people who never became clients
The professional obligation to keep the record and the absence of any policy for it are both true at once.
Follow the enquiry past the form. It lands in a CRM. It is duplicated into an email inbox. If the caller phoned, there is a recording, and increasingly a machine transcript of that recording held by a vendor. If they used the chat widget, there is a transcript of that too. If the site runs session replay, there may be a reconstruction of them typing into the injury field, including what they typed and deleted. Most firms cannot produce a list of those locations, which means most firms cannot answer the first question any of the instruments above would ask.
Now add the part specific to a law firm. As we argued in the piece on declined enquiries, a person who consults a lawyer about forming a relationship is a prospective client under the professional rules even when no relationship follows — which means confidentiality attaches, conflicts can attach, and a firm that keeps no record of the enquiries it declined cannot run a competent conflicts check. So a comp firm has a professional reason to retain information about people who never became clients, and that information is, by every definition surveyed above, health information.
The marketing-side version of the same discipline is simpler than it sounds. The CRM is the right place for the clinical detail, because it is the system with access control, a retention policy and a professional obligation attached. The advertising stack is the wrong place for it, because it has none of those things and was never designed to. Most of the work here is not deletion. It is deciding which system is the system of record and stopping everything else from keeping a copy.
The ninety-minute audit, in the order that pays
Seven checks. None needs a developer to start, and the first three will tell you whether you have a problem.
Run these in order. The sequence matters: the early checks are diagnostic and free, and they determine whether the later ones are urgent or merely tidy.
| # | Check | Where | What a bad answer looks like |
|---|---|---|---|
| 1 | Data source category and diagnostics | Meta Events Manager → your dataset → Settings, then the diagnostics tab | A restricted category you did not know about, or a list of blocked parameters |
| 2 | Your own URLs, on a real submission | Fill in your own form and read the address bar on the thank-you page | Anything after the domain that describes the injury, the employer or the claim |
| 3 | Event, conversion and audience names | Events Manager and Google Ads audience manager | A body part, a diagnosis or a claim status in any name |
| 4 | Which Google audiences you can actually apply | Try to attach a Customer Match list to a live campaign | Unavailable — which tells you the classification is already in force |
| 5 | Clinical fields on the form | The form itself | More than one; every one of them is a transmission risk and a conversion-rate cost |
| 6 | Consumer health data privacy policy link | Your homepage | Absent, or merged into the general privacy policy rather than separate and distinct |
| 7 | Third-party tags on the intake path | Tag manager, plus a look at the page source | Session replay, chat, call transcription or heat-mapping you did not know was live |
Two things are worth saying about what to do with a bad answer. First, fix the transmission before you fix the policy documents: a clean tag setup with a thin privacy policy is a better position than an elegant policy sitting on top of a URL that carries a diagnosis. Second, do not let the fix become a project. Stripping parameters, renaming events and shortening a form are hours of work, not quarters, and a firm that schedules this for next year will spend the year paying for a signal it is not receiving. For the broader question of what the intake path should look like end to end, our piece on the comp firm website covers the conversion side of the same page.
Key takeaways
-
You have been classified as a health advertiser, and nobody sent the memo. It is a category field inside the ad platforms, not a letter.
-
Meta’s prohibited list names your product. “Injuries” is called out, and Google files Health as a sensitive interest that withdraws targeting tools from your account.
-
The form is where the injury enters your system. The moment a worker describes an injury on your form, you are holding health data on people who never became clients.
-
HIPAA is not the law that reaches you, others are. The FTC (GoodRx, BetterHelp), Washington’s My Health My Data Act, and wiretapping suits are.
-
A ninety-minute audit finds it. Run the stack in the order that pays: forms, pixels, and CRM sharing first.
Frequently asked questions
Does this mean we cannot advertise workers’ comp on Meta and Google at all?
No, and nothing here suggests it. Workers’ comp firms advertise successfully on both platforms every day — we have managed roughly $16.5M of Meta spend in this practice area. What the classification changes is which tools are available and what data you may send, not whether you may be there. The firms that struggle are usually the ones running a setup designed for e-commerce, where every parameter is passed through and every audience is built from behaviour. The setup that works here is deliberately plainer, and plainer is not weaker.
We have never had a notification from Meta. Does that mean we are fine?
It means nobody has read the notification, which is not the same thing. Meta says it may notify by email or by in-product alert in Events Manager or Ads Manager, and that more detail sits in the diagnostics tab for the dataset. Those alerts go to whoever administers the account — frequently an agency inbox, occasionally a former employee’s. Go and look at the diagnostics tab yourself before concluding there is nothing in it. Meta also states plainly that its filtering is not a substitute for your own compliance mechanisms, so an absence of alerts is not a clean bill of health either.
Isn’t HIPAA the only health-privacy law, and we are not a covered entity?
You are almost certainly not a HIPAA covered entity, and that is precisely why the other instruments matter. The FTC has brought health-privacy actions under the FTC Act and the Health Breach Notification Rule against companies that were not covered entities. Washington’s My Health My Data Act was written specifically to reach health data outside HIPAA’s ambit, and a violation of it is a per se violation of the state Consumer Protection Act, enforceable by the Attorney General and through private action. In the GoodRx matter the FTC treated a HIPAA seal on the website as its own misrepresentation. None of this is legal advice and your own counsel should size the exposure — but “we are not covered by HIPAA” is the beginning of the analysis, not the end of it.
Our agency runs the ad accounts. Isn’t this their problem?
It is their job and your exposure, which is an uncomfortable combination. Meta’s terms put the obligation on the advertiser: you are in the best position to ensure your integration does not share prohibited information, and you are ultimately responsible for the data you share. The tags sit on your domain, the form is yours, and the enquiry belongs to your firm. Ask your agency for three things in writing — the data source category on the dataset, a current screenshot of the diagnostics tab, and the list of event and audience names — and read them yourself. A good agency will already have them.
If we strip the injury out of the tracking, don’t we lose the ability to optimise?
You lose the ability to optimise toward the injury, which was never a reliable target anyway, and you keep the ability to optimise toward the outcome, which is the one that pays. The neutral conversion event plus a qualification signal returned from your CRM is a better input than a body-part parameter: it is based on what your intake team actually concluded rather than on what a form field guessed. We have written that loop up separately in the piece on declined enquiries. The channel that survives this change is the more valuable one.
How much is this costing us in lost performance?
We do not know, and we are not going to print a figure. Blocked parameters and category restrictions do not appear as a line item in any report, no platform publishes an aggregate effect, and no credible independent study of the cost to law firms exists. What can be said is directional and still useful: filtered events reduce the signal a bidding system has to work with, and a bidding system with less signal performs worse. The honest measurement is your own before-and-after on cost per lead and cost per signed case once the setup is clean, held over a long enough window to be worth reading.
Sources & further reading
-
01
The platform classifications
Meta’s prohibited-information policy and Google’s restricted targeting policy for sensitive categories.
-
02
FTC enforcement on health-ad data
The GoodRx and BetterHelp actions over sharing sensitive health data for advertising.
-
03
State health-privacy & tracking law
Washington’s My Health My Data Act and the wave of website-tracking (CIPA) litigation.
-
04
Further reading
Where the health record enters and leaks.
Statutes, caps and rules vary by state and change over time — confirm the current rule in your state with counsel. General marketing information, not legal advice.