Med spa marketing compliance: what you can say, show and send

Med spa marketing stays compliant when every claim is supported, drug names are truthful, patient photos and stories have written authorization, patient data stays out of ad tools, and someone with authority signs off before anything goes out. Most problems aren't exotic. They're a sentence on a treatment page, a borrowed brand name or a tracking tag nobody remembers adding.

This guide is general information, not legal advice. Rules differ by state and change quickly, so check your campaigns with your medical director and a healthcare attorney licensed in your state. It's also about marketing only: it says nothing about whether any treatment is safe or suitable. We sell marketing to med spas, so we have an interest in you seeing this as hard. It is, but it's manageable with a routine.

Regulators are looking closely. Holland & Knight's August 2026 review reports that New York's Department of State inspected more than 200 med spas and cited 87 for possible violations, and that the FDA issued its first Drug Supply Chain Security Act warning letter to a med spa, in Texas. Indiana will require med spas to register from January 2027, and its law also ties them to health care advertising rules (Holland & Knight).

None of that means your clinic is in trouble. But your website, your ads and your Instagram are the easiest things for a regulator, or a competitor, to read.

The FTC's Health Products Compliance Guidance says health-related claims need competent and reliable scientific evidence, and that the same legal principles apply to the marketing of any health-related product. Implied claims count too, so a before-and-after image can make a claim without a word of copy. The guidance is written around products, but it's the sensible test for a treatment page.

The habit that keeps you safe: your marketing describes what a treatment is, who performs it and how to book. Anything about results, safety or recovery comes from your medical director, who confirms that it's supported.

The clearest recent examples involve weight-loss drugs. In a September 2025 warning letter, the FDA cited a med spa's website for listing compounded semaglutide as "Ozempic (semaglutide) injection", saying the claim "implies that your products are the same as an FDA-approved product when they are not" (FDA). Holland & Knight reports later letters to telehealth companies over similar "sameness" claims, and over ads that obscured who compounded the product (Holland & Knight).

So a few plain rules:

• Never use a brand name for a product that isn't that brand. That covers page titles, ad copy, social captions, price lists and alt text.
• Don't imply FDA approval for something compounded. Say plainly what it is, with your attorney's wording.
• Don't compare compounded products with branded ones as though they were the same.
• Check manufacturers' rules before using their product names and logos. They often set their own conditions for this.
• Go through your old pages. The risky line is often on a page from last year that nobody has looked at since.

Ad platforms add their own layer. Google's healthcare and medicines policy restricts prescription drug terms in ads, landing pages and keywords. Some injectables are prescription drugs, so check the rules for your location before you write the ad.

These raise three separate questions, and passing one doesn't answer the others:

Keep the authorization on file with the photo, note where it's been used, and take the photo down if the patient withdraws. Stock before-and-after photos are not a shortcut: passing off someone else's result as your own is plainly misleading.

The FTC's rule treats incentives for positive reviews as a violation. Insiders must disclose their relationship, and even then their reviews can be a problem if they materially lift your rating (FTC). Google is stricter still, and prohibits offering anything for a review or asking only happy clients. Our marketing guide covers how to ask.

Replies carry their own risk. If you're covered by HIPAA, don't confirm in a reply that someone is a patient, or mention what they had done. Reply in general terms, and take the conversation offline.

First, find out whether HIPAA applies to you. HHS says a provider is a covered entity only if it sends health information electronically in a standard transaction, such as an insurance claim. A cash-only clinic may not be covered, though state privacy law may still apply. Your attorney should make that call and write it down.

If it does apply, look at your website's tracking. HHS's bulletin on online tracking raises tracking on pages behind a login and on pages where people book appointments, and notes that a court vacated part of the bulletin in 2024. Whatever the outcome, keep ad tags off booking and intake forms unless your attorney has cleared them. Treatment names in a URL or a form field can say more than you'd think.

Text messages are stricter than email. The FCC has confirmed that a text counts as a call under the Telephone Consumer Protection Act, and automated marketing texts need prior written consent. Collect that separately from treatment consent, keep a record of when and how each client agreed, and make it easy to stop.

State law is where med spas differ most. Holland & Knight's examples: Illinois restricts med spa ownership to physicians or full-practice-authority APRNs, Georgia's board limits physicians acting as employees of APRN-owned companies when they must supervise, and it warns against "matchmaker" medical director arrangements, where a physician signs without real clinical involvement (Holland & Knight).

Marketing touches this more than you might expect. Your site says who performs treatments and who supervises. If it names a medical director who's rarely there, or implies a credential someone doesn't hold, the website has become evidence. Say truthfully who does what, with their real titles, and update it when staff change.

Nobody should be reading rules every time they post. Set a simple routine, then keep to it:

Keep a folder with each approved piece, the date and who signed off. If anyone ever asks, that record shows you took it seriously. If you use an agency, it should follow this routine too: you're still responsible for what's published in your name.

Search your own site for brand names of any drug or device you offer, and check each one against what you actually supply. Open your before-and-after gallery and find the authorization for every photo. Ask whoever manages your site which tags run on your booking page. Then book an hour with your medical director to agree the routine above, and take anything you're unsure of to your attorney. For how all of this fits with the rest of your marketing, read our med spa marketing guide.