Med spa marketing compliance: which rule governs every ad, post, photo, review and text, in one map

By Benjamin Chua·Published October 19, 2026·22 min read

Every marketing asset is an astronaut trying to leave the ship. The compliance workflow is the airlock. Pressure check, suit check, final clearance, then the door opens. Skip a step and someone gets hurt. Follow them and everyone walks out into the spotlight in one piece. Most med spas run no airlock at all. The injector posts a before-and-after from her camera roll, the agency launches an ad that says "guaranteed", the front desk replies to a Google review with the patient's treatment, and nobody checked anything because nobody owned checking.

This is the pillar guide. It gives you the map (which rule governs which asset), the airlock (a review workflow with roles, a risk score and a 25-point checklist), the paste-ready pieces (consent script, disclaimers, review reply), and a link to the deep-dive guide for each asset so you can go as far as you need. Nothing here is legal advice. Every rule below was read on an official page on 18 October 2026, and the exact page is listed at the end. Laws and platform policies change. Confirm with your counsel and your state board before you rely on anything.

Which rules actually govern med spa marketing?

Five rule-sets cover nearly everything a med spa publishes. The first three are federal and the same in every state. The fourth varies by state. The fifth belongs to the platforms you publish on.

The med spa marketing compliance map

Copy this table into your marketing SOP. The working rule from Acquisition.com's answer, which we agree with: if an asset touches a named patient, a medical claim or paid promotion, treat it as high-risk until proven otherwise. Each row links to the guide that goes deep on that asset.

What counts as a claim, and what counts as proof?

Owners get this wrong more than anything else, and it is where the FTC's health guidance is blunt. You need "adequate substantiation for all objective product claims conveyed, expressly or by implication", and "a marketer is equally responsible for the accuracy of claims suggested or reasonably implied in advertising". A before-and-after is an implied claim. "Our patients love their results" next to a photo is an implied claim. A five-star testimonial that says "ten years younger" is a claim you now own, because "Advertisers are liable for the misleading use of endorsements".

Hormozi's proof checklist frames proof as "data that supports your advertising claims" ($100M Playbook, Proof Checklist, p. 10). That is exactly the compliance test. If the claim has no data behind it, it is hype, and hype is what gets flagged. The practical move from the Acquisition.com answer is a claims list in every brief, one line per claim, with its proof source and the rule-sets it touches:

“Claim C1: "Many patients notice visible smoothing within a few days." Proof: product prescribing information, plus our own patient survey summary. Rule-sets: FTC, state board, platform medical ad rules.”

Then tag every sentence of the draft. Objective claims need proof. Subjective opinion gets framed as one patient's or one practitioner's experience. Risk disclosure is the no-guarantee language. The call to action books a consultation, never promises a treatment. Four tags, and the writer knows which sentences will be challenged.

Both blocks come from the Acquisition.com answer and need a once-over from your attorney before they go on your site. They are a floor, not a shield. A disclaimer does not rescue a claim you cannot support.

How do you get patient consent for photos and quotes?

HIPAA's authorization rule is the short version: a covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing". The exceptions in 164.508(a)(3) are narrow, a face-to-face communication and a promotional gift of nominal value, and neither covers an Instagram post. If a third party pays for the marketing, "the authorization must state that such remuneration is involved". Whether your clinic is a HIPAA covered entity turns on how you bill, so confirm that with counsel. Treat the authorization as required either way. A patient who sees her face in an ad she never agreed to does not care about your billing structure.

The ask happens at the mirror, when the patient is happiest. Here is the front-desk script from the Acquisition.com answer, lightly edited:

“We're so glad you're happy with your result. Sometimes we share photos or quotes on our website and social media so other patients know what to expect. This is completely optional and won't affect your care in any way. If you're open to it, I'll walk you through a short consent form that explains exactly where and how we might use it.”

The full consent form, the identifier checklist and the platform-by-platform photo rules are in the before-and-after photo rules guide.

The review workflow before anything goes live

A factory lockout system will not let anyone service a high-voltage line until the right technician has put a lock and a tag on the switch. No tag, no power. Your version: no asset goes live until the right people have put their tag on it. Five roles, even if two people wear all five hats. The Medical Director (MD), the HIPAA Privacy Officer (PO), the Marketing Manager or agency lead (MM), a Compliance Owner (CO, which can be the PO or a trained MM), and the front office (FO) for consent and reviews.

1. 1

   Step 1: the MM briefs the asset on one page

   Asset type (Meta ad, email sequence, web page). Audience, written as adults in an age range and a treatment history, never a gender. Purpose (book consults, get reviews, educate). The claims list with a proof source per claim. The rule-sets to check, pulled from the map above.

2. 2

   Step 2: the writer drafts with the four tags

   Objective claim, subjective opinion, risk disclosure, call to action. The ad footer or website footer disclaimer is pasted in, not bolted on later.

3. 3

   Step 3: the FO captures consent

   For any photo, video or quote, the signed authorization is on file before the asset is briefed, not after it is designed. If consent is missing, the asset waits.

4. 4

   Step 4: checklist pass, MM then CO

   The MM runs the 25-point checklist below. Anything flagged goes in a change log. The CO runs it a second time. Two pairs of eyes catch what one misses.

5. 5

   Step 5: medical and privacy sign-off by risk score

   Score the asset 1 to 9 (table below). Low scores need the MM and CO. Middle scores add the PO. High scores need the MD, PO and CO, and legal review if the MD asks for it.

6. 6

   Step 6: log it

   One spreadsheet: asset ID, type, channel, date approved, approvers, file location, next review date, notes. High-risk assets get re-read every 6 months, evergreen pages once a year. Those intervals are working rules.

The risk score that decides who signs

Add three numbers, each from 1 to 3. Clinical risk (how medical is the subject), claim intensity (how strong is the promise), and reach (how many people will see it). A blog about sunscreen scores 1 + 1 + 2 = 4. A launch campaign for a new wrinkle relaxer with paid reach scores 2 + 3 + 3 = 8. The thresholds are working rules from the Acquisition.com answer, not a legal standard, and you should tighten them if your board is strict.

The 25-point med spa marketing compliance checklist

Yes or no on each line. Any no blocks publication until it is fixed. Print it, keep it next to whoever posts, and have the agency sign that they run it too. The state-board block is deliberately cautious. Your state's answer is in your state guide and with your board.

Five violations we see most, and the fix for each

What do the product rules allow you to say?

Three FDA points cover most med spa copy. First, Botox Cosmetic is a brand name with three approved cosmetic uses on its label: moderate to severe glabellar lines, lateral canthal lines and forehead lines, in adults. We read the 10/2017 label PDF, which carries the header "This label may not be the latest approved by FDA", so check the current label before you quote it. Anything beyond those three (jaw slimming, a lip flip, sweating) is off-label, and you should not advertise it by brand name. Generic language, wrinkle relaxer or neuromodulator, keeps the copy safer and your Google Ads out of the restricted prescription-drug-term filter.

Second, dermal fillers. FDA's device page lists approved areas: "Augmentation (increased volume) of lips, cheeks, chin, and back of the hand", plus nasolabial folds and facial wrinkles, with permanent fillers approved for fewer areas. The page says FDA has approved fillers for adults 22 and older (our fetch tool also showed the wording "over the age of 21", so verify the exact line on the page before quoting it externally). It also says "Injectable silicone is not approved for any aesthetic procedure". Promote filler for listed areas, and say a licensed provider does it.

Third, compounded drugs. FDA's compounding Q&A says plainly that "Compounded drugs are not FDA-approved". If you offer compounded semaglutide or any compounded product, never describe it as approved, and keep the promotion "truthful, non-misleading and accurate". Google's unapproved substances policy separately bans products "that imply they are as effective as prescription drugs", so the ad gets disapproved before anyone else sees it.

How do state board rules fit in?

This is where a national guide has to stop. Who may own a med spa, who may inject, what a nurse injector may call herself, whether you may discount, whether a referral reward is fee-splitting, and how supervision must be described all vary by state. We state none of those as fact here because the answer in Texas is not the answer in California. Each state guide quotes the official board pages we could read and flags the ones we could not. Start with yours: Texas, California, Florida, New York or Arizona. Then confirm with the board itself.

One federal law sits behind referral rewards everywhere. The HHS Office of Inspector General's fraud and abuse page says "Remuneration includes anything of value and can take many forms besides cash" and "The kickback prohibition applies to all sources of referrals, even patients". That statute attaches to items or services payable by federal health care programs, so a cash-pay cosmetic clinic is usually outside it. State laws can reach further. Florida's kickback statute, for one, says violations "shall be considered patient brokering" and is not limited to federal-program patients. The safe default: no cash or service credit per referred patient until your counsel clears it for your state. The referral program guide shows what you can reward instead.

Turn the airlock into a selling point

Hormozi's value equation says perceived likelihood of success goes up and perceived risk goes down when the buyer sees honest proof and clear guardrails ($100M Offers, p. 65). Compliance, done visibly, is that. His risk-reversal chapters say to reverse the buyer's biggest fear ($100M Offers, p. 124 and p. 135). You cannot guarantee a cosmetic outcome, and your board will not let you try. You can promise process: a callback inside a set time, a thorough consultation, transparent pricing, a provider who will tell you when a treatment is wrong for you. The Acquisition.com answer suggests a short Safety and Honesty Standard page, and this is its sample copy:

“We follow a strict review process for every photo, quote and ad. A licensed medical professional and a privacy officer review all patient-related content before it goes live. We never guarantee results, and we will always tell you when a treatment is not right for you.”

Then have the desk say it on the phone: "You'll notice our website doesn't overpromise. That's intentional. We'd rather be honest up front and have you for years." The proof checklist's rules, raw over processed, show over tell, newer over older ($100M Playbook, Proof Checklist, p. 31), all survive compliance. Recent, consented, lightly edited patient stories with context are both the most persuasive proof and the safest. And the marketing-machine habit of capturing reviews and reaction videos every week ($100M Playbook, Marketing Machine, p. 26) just gets the consent form bolted onto the front of it.

Five expensive mistakes, and the owner-level fix

1. 1Letting creative skip the airlock when the clinic is busy. Cost: board complaints, takedowns, emergency rewrites. Fix: every asset gets an ID and a log entry, no exceptions, and the marketing manager's scorecard includes unlogged publishes, target zero.
2. 2Handing everything to an agency with no med-spa-specific rules. Cost: ads that look great and break local rules. Fix: the agency is trained on your map, signs an addendum that nothing publishes without your approval, and one campaign a month is audited with outside counsel.
3. 3Using testimonials as guarantees in disguise. Cost: misleading-claim exposure and patients who arrive expecting the testimonial. Fix: re-edit as individual stories with results-vary language, paired with neutral education rather than standalone brag posts.
4. 4Sloppy consent and photo storage. Cost: HIPAA exposure, and content you cannot prove you may use. Fix: one digital consent workflow, one file-naming rule, no raw before-and-afters on shared team drives. Quarterly, pull 10 images at random and find the consent for each.
5. 5No owner visibility until something breaks. Fix: a monthly compliance scorecard with five numbers. New assets published, percentage that passed first review, violations found, takedowns, audits due.

The quickest win is usually the agency addendum. If you are choosing one, the compliance map above is the test: ask them to walk through it row by row, and listen for which rows they have never heard of. The agency versus in-house guide covers the rest of that decision. If you want the content side planned around these rules from day one, the free 12-month content plan is built with the consent and claims workflow already in it.

Where this comes from

• FTC Endorsement Guides, 16 CFR Part 255, read on eCFR (API text, current as of 2026-10-01) on 18 October 2026, plus the FTC Disclosures 101 for Social Media Influencers page (last updated November 2019) and the FTC Health Products Compliance Guidance (first 100,000 characters read). The substantiation, implied-claim, liability and disclosure quotes are from these pages.
• FTC Consumer Reviews and Testimonials Rule, 16 CFR Part 465, read on eCFR on 18 October 2026. We did not read the penalty section, so this guide states no dollar figure.
• HIPAA Privacy Rule, 45 CFR 164.501 and 164.508, read on eCFR on 18 October 2026. The HHS marketing guidance page returned 403 on two attempts, so the regulation text stands in for it. Whether a given med spa is a covered entity is not something we can read from these pages.
• FDA: Botox Cosmetic label (10/2017 PDF on accessdata.fda.gov, flagged as possibly not the latest), Dermal Fillers device page (content current 07/06/2023), Compounding Q&A (last updated 09/16/2025), all read 18 October 2026. FDA prescription-drug advertising pages returned 404.
• Google: Healthcare and medicines policy, Health in personalized advertising policy, Unapproved substances policy, Business Profile guidelines and prohibited content policy, all read 18 October 2026.
• Meta: Health and Wellness ad standard (page change log dated Jul 22, 2026), read 18 October 2026. Meta's branded-content and data-restriction help pages returned title only, so nothing is quoted from them.
• TCPA: 47 CFR 64.1200, read on the Cornell LII copy on 18 October 2026 (the official eCFR copy was not loaded). The FCC one-to-one consent and revocation rule changes are known to us from law-firm summaries only, so they are status to confirm.
• Referrals: HHS OIG Fraud and Abuse Laws page and Florida Statutes 456.054, read 18 October 2026. Memberships: California B&P 17602 read on a public.law mirror because the official site returned 403; the FTC Negative Option Rule page read directly, with the court status from law-firm summaries only.
• Hormozi and Acquisition.com references via the ACQ AI answer: $100M Offers p. 65, p. 124, p. 135; $100M Playbook Proof Checklist p. 10 and p. 31; $100M Playbook Marketing Machine p. 26. The compliance map, workflow, 25-point checklist, disclaimers, consent script and risk score are the Acquisition.com answer adapted for our compliance rules.
• Working rules, not published standards: the 1 to 9 risk score and its thresholds, the 6-month and annual review intervals, the quarterly 10-image consent audit, the monthly scorecard, and the three-template review reply. State board rules are not stated here at all; see the state guides.
• This is our reading of the pages above for med spa owners. It is not legal advice. Confirm with your counsel and your state board.

Questions owners ask

Written by Benjamin Chua

Founder of Trueframe and Med Spa Launch. Nine years building video systems for founders and clinics, including a Melbourne plastic surgeon whose account went from 12,043 to 36,236 followers in ten weeks.