Before and After Photos in Med Spa Ads: What the Rules Say

You can use before and after photos in med spa ads, but not the way most practices do it. If your practice is a HIPAA covered entity, a patient's before and after image is protected health information, and 45 CFR 164.508(a)(3) requires a signed marketing authorization before you may use it to promote the practice. On top of that, the FTC reads a results photo as a claim about what patients generally achieve, not as one person's story. Platform policy is a third layer, and it is the one that has changed most recently.

That is three separate rulebooks governing one photo, which is why so many practices get this wrong while acting in good faith. Below is what each one actually requires, in the order it will bite you.

Does a med spa need patient permission to post before and after photos?

Yes, and the permission you probably have is the wrong document. A treatment consent form authorizes care. It does not authorize advertising. Those are different agreements with different scopes, and a patient who agreed to be treated has not agreed to appear in your Instagram ads.

The rule itself is short. 45 CFR 164.508(a)(1) states that a covered entity "may not use or disclose protected health information without an authorization that is valid under this section." Paragraph (a)(3) then closes the door specifically for marketing: a covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing," and the only exceptions are a face to face communication with the individual and a promotional gift of nominal value. An ad on a paid platform is neither of those.

What counts as marketing is defined broadly. Under 45 CFR 164.501 it means making "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service." A results carousel promoting your injectables is squarely inside that definition, whether it runs as an ad or as an organic post.

A workable authorization names what will be used, where it will appear, for how long, and how the patient can revoke it. One signature covering "marketing" in the abstract is weak, because patients routinely agree to a website gallery and refuse paid social, or agree to a photo and refuse video. Ask separately and record the answers separately.

Is my med spa actually a HIPAA covered entity?

This is the question worth answering before you build any policy, and the honest answer is that it depends on how you bill. A health care provider becomes a covered entity when it transmits health information electronically in connection with a covered transaction, which in practice usually means submitting claims to insurance electronically. A practice that is entirely cash pay and never touches an electronic claim may sit outside that definition.

Do not read that as permission. State medical privacy statutes frequently reach further than HIPAA, state medical boards regulate practice advertising directly, and the FTC applies to every advertiser in the country regardless of billing model. What changes is which rulebook is doing the work, not whether one exists. Several states also have specific rules on how aesthetic providers may describe credentials and specialties, and those apply to a cash pay practice exactly as they do to a covered one.

What does the FTC require for before and after photos?

This is the layer practices consistently underestimate, because it survives even after you have a perfect signature on file. Consent solves privacy. It does nothing about the claim.

16 CFR 255.2 says an advertisement "containing an endorsement relating the experience of one or more consumers on a central or key attribute of the product will likely be interpreted as representing that the endorser's experience is representative of what consumers will generally achieve." In plain terms: if you show your best result, you are telling the market that this is the normal result. Where the depicted outcome is not typical, the rule asks the advertiser to "clearly and conspicuously disclose the generally expected performance in the depicted circumstances."

The common workaround does not work. A small "results not typical" line under a dramatic photo is specifically identified as inadequate, based on research finding that such disclaimers did not meaningfully change what consumers took away from the ad. What the rule contemplates is a concrete statement of what to expect: how many sessions a typical patient needs, or what a typical degree of improvement looks like. That is harder to write and much harder to make look good in a feed, which is precisely the point.

There is a related line for anyone considering synthetic footage as a shortcut. A generated presenter may deliver claims your practice can substantiate. It may not pose as a patient. Under 16 CFR 465.2 it is unlawful to create a testimonial that materially misrepresents that the person exists or that they used the service. Generating a face is fine. Inventing a patient experience is not.

Can you run before and after ads on Facebook and Instagram?

Meta has long held that ads may not use before and after imagery to depict idealized results, and may not draw attention to a body part or condition in a way likely to produce negative self perception. Zoomed in images of a skin condition are the classic example of what gets rejected.

That corner of the policy has been moving. Ad policy trackers reported that in July 2026 Meta reworked its health and wellness advertising standards toward claims based review, so that side by side imagery in cosmetic and weight loss categories is no longer rejected purely for being side by side, with enforcement turning instead on the claims attached to it. We were not able to retrieve Meta's own policy pages to quote them directly, so treat that as reported rather than verified, and read the current health and wellness section of Meta's advertising standards yourself before you build a campaign on it.

The strategic reading matters more than the current state of the rule. If your patient acquisition depends on a category of imagery whose permissibility has shifted twice in a year, on a platform that can disapprove it overnight without explanation, you have built your growth on the least stable asset in your library.

What to use instead, and where results still belong

The practices that grow steadily are not the ones with the best results gallery. They are the ones producing enough ad creative to keep a small local audience from going numb. A med spa's addressable market inside one metro is genuinely small, so the same asset fatigues in weeks rather than months, and the only durable answer is volume.

Volume is easy in the category of creative that carries none of the duties above. A provider explaining what the next 48 hours after a treatment really look like. A script that disqualifies the wrong patient out loud. A straight answer on price and what changes it. A correction of one widely believed myth about a modality. None of these requires a patient, an authorization, a model release, or a typical results disclosure, because none of them claims an outcome.

That does not mean results imagery is worthless. It is the strongest asset you have at the moment someone is deciding whether to book, which means retargeting and the consultation page, not cold traffic. Collect it properly, with a real marketing authorization that names the placements, and spend it where trust is actually decided rather than burning it on prospecting.

It is also worth remembering that the ad's only job is to produce a booked consultation, and a surprising share of aesthetics ad spend dies after the click rather than before it. If the intake flow is slow to respond or hard to complete, better creative just buys more people who never get on the calendar, so it pays to fix how consultations get booked and qualified before raising the budget.

The practical policy

Write down which of the three rulebooks applies to you, and put the answer somewhere your marketing person can see it. Get a separate marketing authorization, not a treatment consent, and make it specific about placements. Keep results creative for retargeting. Build your cold traffic on treatment explainers and objection handling, and produce enough of them that fatigue stops being the thing capping your growth.

None of this is legal advice, and med spa advertising is regulated at the state level as well as the federal level, so two practices running the same ad in different states can be in different positions. If you are running results led creative at any real scale, have counsel review it.

For the full picture on building an ad system around this constraint, including the creative angles that need no patient footage, see our guide to med spa advertising and medical spa ads. If you want the equivalent breakdown on the product side of the same claims problem, the rules on UGC for skincare brands cover it, and the line between a generated presenter and a real endorsement is set out on our AI testimonial video generator page.