Plenty of therapists avoid Google Ads for one reason: they are worried about privacy. They have heard that health is a “restricted” category, that pixels can leak client data, and that a wrong move could turn a marketing effort into a compliance problem. Those concerns are reasonable, and they are also solvable.
The rules that govern advertising a mental health practice are learnable, and once you understand them, Google Ads becomes a channel you can run with confidence. This guide explains exactly what HIPAA and Google allow, what they prohibit, and how to set up campaigns that bring in clients without putting your practice at risk.
Quick answer: You can run Google Ads for a therapy practice, and doing so does not by itself violate HIPAA. The rules that matter are simple to state: do not send protected health information to Google, do not target people based on health conditions, keep your ad copy neutral, and advertise only where you are licensed.
Key Takeaways
- Running Google Ads is not a HIPAA violation on its own. The risk comes from how you handle data, not from advertising itself.
- Google will not sign a Business Associate Agreement (BAA) for Google Ads or Google Analytics. That means you must never send protected health information (PHI) to these tools.
- Health is a sensitive category in Google Ads. You cannot target users by health condition, and you generally cannot use your own uploaded or remarketing audiences.
- Ad copy cannot imply a person’s condition. “Are you struggling with depression?” is not allowed. Neutral, service-focused language is.
- The biggest real-world risk is tracking on the wrong pages. Pixels on client portals, telehealth, and intake forms have led to multimillion-dollar settlements. Keep tracking off those pages.
- Advertise only where you are licensed. Geo-target the states and areas where you can legally practice, and exclude the rest.
A quick note before we start: This article is educational and reflects current policy and legal developments. It is not legal advice. HIPAA interpretation, Google’s policies, and related case law change over time, so confirm your setup with a healthcare attorney or a qualified compliance professional before you rely on it.
Worried your current ad setup might be exposing client data? MHIS reviews therapy practice websites and ad accounts for HIPAA-aware configuration and shows you where the gaps are. Book a free consultation with MHIS.
Is Google Ads HIPAA Compliant for Therapists?
Google Ads is not a HIPAA-covered service, and Google will not sign a BAA for it. That does not make advertising off-limits; it means the responsibility falls on your practice to run ads without ever exposing protected health information. Handled correctly, a compliant therapy campaign is entirely achievable.
There are two separate rulebooks at play, and therapists get into trouble when they only think about one:
- HIPAA is federal privacy law. It governs how you handle protected health information and who you are allowed to share it with.
- Google’s advertising policies are a private company’s rules. They govern how you can target and what you can say in your ads, especially in sensitive categories like health.
Both apply at the same time. A campaign can satisfy Google’s policies and still create a HIPAA problem, or vice versa. The sections below cover each so you can stay on the right side of both. For a broader primer on the channel itself, see our overview of Google Ads for therapists.
What Counts as Protected Health Information in a Google Ads Context?
Protected health information (PHI) is any health-related information tied to an identifiable person, such as a name, email, IP address, or device ID combined with the fact that they sought therapy. In advertising, PHI usually leaks through tracking and forms, not through the ad itself.
Here is where it tends to appear:
- Intake and contact forms that capture a name, email, or symptoms and then fire a tracking event containing that data.
- Conversion tracking that passes appointment details, form contents, or condition-specific page paths back to Google.
- Tracking pixels or analytics placed on a client portal, telehealth page, or scheduler, where the visitor is a known client.
- URLs that reveal a condition, such as a landing page path like /depression-intake, combined with an identifier.
The ad copy and keywords themselves are not PHI. The danger is in the data your website sends to Google after the click. Keeping that data clean is most of the compliance battle.
What Therapists Can Do with Google Ads
You have more room than the fear suggests. You can advertise your services, appear at the top of local search, and bring in new clients, as long as you avoid targeting by condition and avoid sending PHI to Google. The list below covers the practices that are clearly allowed.
- Advertise therapy and counseling services to people searching for them
- Bid on service and location keywords, such as “therapist in Austin” or “couples counseling near me”
- Use predefined Google audiences (Google’s own interest and demographic groupings)
- Use location targeting to focus on the areas you serve
- Use content or placement targeting to show ads alongside relevant topics
- Track conversions using PHI-free events, such as a generic “contact form submitted” signal with no personal data attached
- Write ad copy that describes your services, credentials, specialties, and availability
What Therapists Cannot Do with Google Ads
The prohibitions cluster around two ideas: do not target people based on their health, and do not hand PHI to a vendor that has not signed a BAA. The list below covers the practices to avoid.
- Target users based on a health condition or imply you know their condition
- Use advertiser-curated audiences, such as customer match lists built from client emails
- Run standard website remarketing that retargets past visitors of your therapy pages
- Place tracking pixels or analytics on client portals, telehealth platforms, or intake pages
- Pass names, emails, appointment details, or symptoms into conversion tracking
- Write ad copy that assumes or states the user’s mental health status
- Name specific prescription medications in ads without the required certification
- Advertise in states or regions where you are not licensed to practice
Google’s Sensitive Category Rules and What They Mean
Google classifies health, including mental health, as a sensitive interest category. Therapy ads are automatically labeled “Eligible (limited),” which is normal and not a penalty. It simply means certain targeting options are switched off to protect user privacy. Your goal is not to remove the limitation; it is to avoid the “Not Eligible” status that blocks ads entirely.
In practice, the sensitive category rules mean a few specific things for a therapy practice.
You cannot use advertiser-curated audiences
Advertisers in sensitive categories are not allowed to use advertiser-curated audiences. That includes customer match lists built from client contact details and custom segments you build from your own data. Predefined Google audiences remain available, so you are not without options, but the “upload my client list and target similar people” approach is off the table.
Standard remarketing is effectively restricted
Retargeting people who visited your therapy pages relies on building an audience from your own site data, which falls under the restricted advertiser-curated category and also raises a health-inference concern (you would be targeting people because they looked at therapy content). For most therapy practices, standard site-visitor remarketing should be treated as unavailable.
Content and placement targeting is a compliant alternative
Instead of audience targeting, you can place ads alongside relevant content or on specific placements. Combined with strong keyword and location targeting, this reaches the right people without relying on sensitive audience data.
You can read Google’s own explanation on its Health in personalized advertising policy page.
Remarketing, Tracking Pixels, and Health Data: The Biggest Risk
This is where most compliance failures actually happen. The single most dangerous move a therapy practice can make is placing tracking technology on pages where a visitor is a known client, or passing client data into tools that Google will not cover with a BAA. Get this part right and you have removed the majority of your exposure.
Google will not sign a BAA for Ads or Analytics
HIPAA generally requires a signed BAA before any vendor can receive PHI. Google’s HIPAA BAA covers Google Workspace and Google Cloud services; it explicitly does not cover Google Ads, Google Analytics, Google Maps, or Google Business Profile. Google’s own Analytics terms state that if you are a covered entity or business associate, you may not use Google Analytics for any purpose involving protected health information. Because there is no BAA, sending PHI to these tools is an impermissible disclosure. You can review Google’s covered services on the Google Cloud HIPAA BAA page.
Authenticated pages versus public pages
The rules around tracking on healthcare websites have shifted recently, and the distinction that matters is whether a page is authenticated.
In December 2022, the HHS Office for Civil Rights (OCR) issued a bulletin warning that online tracking technologies on the websites of HIPAA-covered entities could disclose PHI. In June 2024, a federal court in American Hospital Association v. Becerra vacated a central part of that guidance, holding that HIPAA obligations are not automatically triggered simply because tracking connects a visitor’s IP address with a visit to an unauthenticated public webpage about health conditions or providers. HHS withdrew its appeal in August 2024, so that ruling stands. You can see OCR’s current guidance and the court note on the HHS online tracking technologies page.
Here is what that means for you, stated plainly:
- Public marketing pages (your unauthenticated homepage, service pages, and general landing pages) are on firmer ground than they were, and analytics there is less likely to be treated as an automatic HIPAA violation.
- Authenticated pages (client portals, telehealth platforms, appointment schedulers, and intake forms where a client is identified) still clearly involve PHI. Tracking on those pages remains high risk, and the ruling did not change that.
- The court decision is not a green light to disclose PHI. State privacy and wiretapping laws still apply, and litigation risk remains.
The litigation reality
This is not theoretical. Tracking pixels on healthcare websites have led to large, publicly reported settlements, including a reported $12.25 million settlement involving Advocate Aurora Health and a reported $6.6 million settlement involving Novant Health. Enforcement and lawsuits have concentrated on authenticated pages like patient portals, schedulers, and intake tools. The lesson for a therapy practice is direct: keep tracking off those pages.
The safe approach in one line
Track only your public marketing pages, keep pixels and analytics off portals, telehealth, and intake forms, use PHI-free conversion events, and consider a server-side setup with a vendor that will sign a BAA. A marketing partner that builds HIPAA-aware therapist websites and campaigns can configure this so you do not have to guess.
Ad Copy Rules: What You Can and Cannot Say
Your ad copy must not assume or state a person’s mental health condition, and it must not make unrealistic promises. Neutral, service-focused language keeps you compliant and, in most cases, performs better anyway. Google strengthened its stance here, so copy that “diagnoses” the reader in the headline will get flagged.
The table below shows the difference in practice.
| Not compliant | Compliant alternative |
|---|---|
| “Struggling with depression? Get help now.” | “Licensed therapy in Denver. Book a free consultation.” |
| “Cure your anxiety in six weeks.” | “Evidence-based therapy for adults. Now accepting new clients.” |
| “PTSD keeping you up at night?” | “Trauma-informed counseling. Telehealth appointments available.” |
| Naming a specific prescription drug in the ad | “Psychiatry and medication management. Board certified.” |
A few guardrails to keep in mind:
- Do not imply knowledge of the user’s condition. Speak about your services, not about the reader’s assumed struggles.
- Avoid unrealistic promises. No guaranteed cures, timelines, or outcomes.
- Be careful with medication names. Prescription drug names generally cannot appear unless you hold the required certification, which is relevant for psychiatric practices.
- Keep claims accurate. Credentials, specialties, and services should be truthful and verifiable.
If you are building your first campaign, our step-by-step guide on how to create a Google Ads campaign for a therapy practice walks through the setup.
Licensing and Geo-Targeting Rules
You may only advertise where you are licensed to practice. Geo-target the specific states and areas your license covers, and exclude everywhere else, so you do not pay for or accept inquiries you cannot legally serve. This is a scope-of-practice issue as much as an advertising one.
- Match targeting to your license. If you are licensed in Illinois, your ads should serve in Illinois, not neighboring states.
- Use precise location settings. Target by state, metro, or radius, and set location options so you reach people located in your area rather than merely interested in it.
- Handle teletherapy carefully. Telehealth does not extend your license across state lines. Advertise for teletherapy only in the states where you are authorized to provide it.
- Exclude what you cannot serve. Add location exclusions for areas outside your license to protect your budget and avoid inappropriate inquiries.
Running Google Ads well for a mental health practice is not a plug-and-play task. It requires compliant targeting, PHI-free tracking, careful ad copy, and a landing page built to convert, all working together. MHIS builds and manages Google Ads campaigns specifically for therapists, paired with HIPAA-aware website development, local SEO, and conversion-focused design. See how our Google Ads management for therapists works.
Common HIPAA Mistakes Therapists Make with Google Ads
- Uploading a client email list to build a customer match or remarketing audience, which is prohibited in sensitive categories.
- Leaving a tracking pixel on the client portal or intake form, the exact placement that has driven pixel lawsuits.
- Passing form data into conversion tracking, so names, emails, or symptoms flow to Google.
- Writing “diagnosing” ad copy that implies the reader’s condition and gets the account flagged.
- Advertising outside licensed states, creating scope-of-practice risk.
- Assuming the 2024 court ruling removed all risk, when authenticated pages, state laws, and Google’s no-BAA position still apply.
- Using automation without oversight. AI-assisted tools can help, but they still need compliant guardrails. Our guide on AI-powered Google Ads for therapists covers doing this responsibly.
A HIPAA-Aware Google Ads Setup, Step by Step
- Map your pages. Separate public marketing pages from authenticated pages (portal, telehealth, scheduler, intake).
- Remove tracking from authenticated and intake pages. No pixels or analytics where a visitor is a known client.
- Configure PHI-free conversion tracking. Track a generic “form submitted” or “call started” event with no personal data attached.
- Turn off advertiser-curated audiences and site remarketing. Rely on keywords, location, and predefined Google audiences instead.
- Write neutral, compliant ad copy. Describe services and credentials, never the reader’s assumed condition.
- Set precise geo-targeting. Serve only where you are licensed, and exclude the rest.
- Consider server-side tracking with a BAA-signing vendor for cleaner, safer measurement.
- Document your setup and review it periodically. Policies and case law change, so revisit your configuration.
Compliance Checklist
| Area | Checklist item |
|---|---|
| BAA | Confirm no PHI flows to Google Ads or Analytics, since Google will not sign a BAA for them |
| Tracking placement | Verify pixels and analytics are off portals, telehealth, schedulers, and intake pages |
| Conversion data | Confirm conversion events contain no names, emails, symptoms, or appointment details |
| Audiences | Turn off customer match and site remarketing; use predefined Google audiences only |
| Ad copy | Ensure no ad implies the user’s condition or makes unrealistic promises |
| Medications | Avoid prescription drug names unless certified |
| Geo-targeting | Serve ads only in licensed states and areas, with exclusions elsewhere |
| Review | Reassess the setup periodically as policies and case law evolve |
Risk Comparison: Risky Practice Versus Safer Approach
| Risky practice | Why it is a problem | Safer approach |
|---|---|---|
| Uploading a client email list to build an audience | Prohibited in sensitive categories; risks PHI disclosure | Use predefined Google audiences with keyword and geo targeting |
| Placing a pixel on your client portal or intake form | High PHI exposure; the focus of pixel lawsuits | Keep tracking off authenticated and intake pages |
| Passing appointment or form data into conversions | Sends PHI to a vendor with no BAA | Use PHI-free conversion events; consider server-side tracking |
| Ad copy that names a condition and implies the user has it | Violates Google’s personalized advertising policy | Neutral, service-focused copy |
| Running ads where you are not licensed | Scope-of-practice and legal risk | Geo-target licensed areas only, with exclusions |
Frequently Asked Questions
Is it legal for therapists to run Google Ads under HIPAA?
Yes. Advertising your services on Google is legal and does not violate HIPAA by itself. HIPAA governs how you handle protected health information, not whether you can market your practice. Compliance problems arise from the way data is handled, such as sending client information to tools that are not covered by a Business Associate Agreement or placing tracking technology on pages where visitors are identified clients. When you avoid targeting by health condition, keep protected health information out of your tracking, use neutral ad copy, and advertise only where you are licensed, running Google Ads is a legitimate and common way for therapists to attract new clients. Because interpretation can vary, it is wise to confirm your specific setup with a healthcare attorney.
Will Google sign a BAA for Google Ads or Google Analytics?
No. Google does not offer a Business Associate Agreement for Google Ads or Google Analytics. Google’s HIPAA BAA covers Google Workspace and Google Cloud services, and it explicitly excludes Ads, Analytics, Maps, and Google Business Profile. Google’s own Analytics terms state that covered entities and business associates may not use Analytics for any purpose involving protected health information. Because HIPAA generally requires a signed BAA before a vendor can receive PHI, and Google will not sign one for these products, you must never send protected health information to them. This is why PHI-free conversion tracking, careful pixel placement, and server-side setups with BAA-signing vendors matter so much for a therapy practice.
Can therapists use remarketing or retargeting in Google Ads?
Generally, no, at least not in the standard form. Health is a sensitive category in Google Ads, and advertisers in sensitive categories cannot use advertiser-curated audiences, which includes customer match lists and audiences built from your own website visitors. Standard site remarketing, where you retarget people who viewed your therapy pages, relies on exactly this kind of audience and also raises a health-inference concern, since you would be targeting people because they looked at mental health content. For most practices, remarketing should be treated as unavailable. Predefined Google audiences remain available, and you can reach the right people effectively through keyword targeting, location targeting, and content or placement targeting instead.
What does “Eligible (limited)” mean on my therapy ads?
“Eligible (limited)” is a normal status for healthcare and mental health advertisers, not a penalty or a violation. It means your ads can run, but certain targeting features are restricted because health is a sensitive category. Google applies these limits to protect user privacy, so you cannot use advertiser-curated audiences or target people based on health conditions. Your goal is not to remove this status; it is to make sure you do not fall into “Not Eligible,” which blocks your ads entirely. Practices sometimes worry that the limited label signals a problem, but it is simply how Google handles every advertiser in a sensitive category, including legitimate therapy providers.
Can I put a Google tracking pixel on my website?
You can place tracking on your public, unauthenticated marketing pages with less risk than before, following the June 2024 court ruling that narrowed OCR’s position on such pages. What you should not do is place pixels or analytics on authenticated pages, such as client portals, telehealth platforms, appointment schedulers, or intake forms, where a visitor is an identified client. Those placements have been the focus of pixel-related lawsuits and remain high risk. Even on public pages, avoid passing any personal data through the tracking, and be aware that state privacy and wiretapping laws still apply. When in doubt, keep tracking minimal and confirm your configuration with a compliance professional.
What can therapists say in their Google ad copy?
You can describe your services, specialties, credentials, location, and availability, and invite people to book a consultation. What you cannot do is write copy that assumes or states the reader’s mental health condition. Headlines like “Struggling with depression?” or “PTSD keeping you up at night?” imply knowledge of the user’s health status and violate Google’s personalized advertising policy. Instead, use neutral, service-focused language, such as “Licensed therapy in Denver, now accepting new clients.” Avoid unrealistic promises like guaranteed cures or fixed timelines, and do not name specific prescription medications unless you hold the required certification. Neutral copy keeps you compliant and usually performs at least as well as condition-based messaging.
Do I need to worry about which states my ads run in?
Yes. You may only advertise where you are licensed to practice. Your geo-targeting should match your license, so if you are licensed in one state, your ads should serve there and not in neighboring states. This is a scope-of-practice issue, and it also protects your budget from inquiries you cannot legally serve. Teletherapy does not change this; providing telehealth across state lines requires appropriate authorization in each state, so advertise for teletherapy only where you are permitted to deliver it. Use precise location settings, target people located in your area rather than merely interested in it, and add exclusions for areas outside your license.
Did the 2024 court ruling make Google Analytics safe for healthcare?
No. The June 2024 ruling in American Hospital Association v. Becerra vacated a specific part of OCR’s tracking guidance, holding that HIPAA is not automatically triggered simply because tracking connects an IP address with a visit to an unauthenticated public health page. That narrowed the risk on public marketing pages, but it did not make Google Analytics HIPAA compliant. Google still will not sign a BAA for Analytics, so sending protected health information to it remains an impermissible disclosure. Authenticated pages, state privacy laws, and litigation risk all still apply. The practical takeaway is that public marketing pages are on firmer ground, but portals, intake forms, and any page handling client data should stay free of Google tracking.
Is Meta Ads different from Google Ads for HIPAA?
The core principles are the same. Like Google, Meta does not provide a Business Associate Agreement for its advertising platform, so you cannot send protected health information to it either. Both platforms restrict targeting based on sensitive health topics, both prohibit ad copy that implies a user’s condition, and both have been named in tracking-pixel litigation. The differences are in the details of each platform’s policies and audience tools, but the compliance foundation is identical: no PHI to the platform, no condition-based targeting, neutral copy, and careful pixel placement. Whichever platform you use, the safe setup looks the same, and it is worth having a partner who understands the nuances of each.
Can a psychiatrist advertise medication management on Google?
Yes, with care. A psychiatric practice can advertise services like medication management, evaluations, and telehealth, using neutral, service-focused copy. The key restriction is around prescription drug names. Google generally does not allow specific prescription medication names or active ingredients to appear in ads unless the advertiser is certified, so keep your copy at the service level, such as “psychiatry and medication management, board certified,” rather than naming particular drugs. All the other rules still apply: no targeting by condition, no implying the reader’s diagnosis, no PHI in tracking, and licensing-matched geo-targeting. If your practice spans multiple states, confirm your authorization in each before advertising there.
Should I hire someone to run HIPAA-aware Google Ads?
Many practices do, because the setup involves several moving parts that are easy to get wrong. A specialist can configure PHI-free conversion tracking, keep pixels off the pages that create risk, set compliant targeting and copy, and match geo-targeting to your license, then monitor the account over time. The alternative is learning all of this yourself and staying current as policies and case law change. If you have the time and interest, a compliant do-it-yourself setup is possible. If you would rather focus on clinical work, a mental health marketing partner removes the guesswork and reduces the chance of an expensive mistake. Either way, having a healthcare attorney review your approach is a sensible safeguard.
Does using Google Ads mean my clients’ data is exposed?
Not if the setup is done correctly. Client data is exposed only when your website sends protected health information to Google, such as through pixels on a portal or intake page, or conversion events carrying personal details. When you keep tracking off authenticated and intake pages, use PHI-free conversion events, and avoid uploading client lists, the ad platform never receives protected health information. The people who click your ads are anonymous searchers until they choose to contact you through a properly secured channel. The exposure risk is a function of configuration, not of advertising itself, which is why a HIPAA-aware technical setup is the heart of running ads safely for a therapy practice.
Final Key Takeaways
- Advertising a therapy practice on Google is legal and compliant when done correctly; the risk is in data handling, not in advertising.
- Google will not sign a BAA for Ads or Analytics, so protected health information must never reach them.
- Health is a sensitive category: no condition-based targeting, and generally no advertiser-curated audiences or standard remarketing.
- The biggest real risk is tracking on authenticated and intake pages, which has driven multimillion-dollar settlements.
- Keep ad copy neutral, respect prescription drug rules, and advertise only where you are licensed.
Action Checklist
- Separate your public marketing pages from authenticated pages (portal, telehealth, scheduler, intake).
- Remove Google tracking from all authenticated and intake pages.
- Confirm your conversion tracking contains no PHI.
- Turn off customer match and standard site remarketing.
- Rewrite any ad copy that implies a condition or makes promises.
- Remove prescription drug names unless you are certified.
- Set geo-targeting to licensed areas only, with exclusions.
- Have a healthcare attorney or compliance professional review your setup.
Conclusion
The fear that keeps therapists off Google Ads is understandable, but it is based on the assumption that advertising and privacy are in conflict. They are not. HIPAA and Google’s policies give you a clear set of boundaries, and inside those boundaries you can run campaigns that reach people actively looking for help. Keep protected health information away from Google, avoid condition-based targeting, keep your copy neutral, watch where your tracking lives, and advertise only where you are licensed. Do those things, and Google Ads becomes a dependable, compliant source of new clients.
Because policies and case law in this area continue to evolve, treat this guide as a strong starting point rather than a final word, and confirm your specific configuration with a qualified professional.
Ready to make sure your ads and website are set up the right way? MHIS will review your current configuration, build a custom, HIPAA-aware growth strategy for your practice, and give you a clear plan across Google Ads, website development, and local SEO. Book your free consultation and website review with MHIS today.