Server-side Tracking for wellness and health brands: How to keep your conversion data accurate

If you’ve watched your conversion tracking deteriorate over the past eighteen months despite no implementation changes being made on your side, the problem is likely not your setup. It’s ad platforms viewing your website as health-related and restricting the conversion data they will accept from it due to categorizing it as sensitive data. 

Meta can switch off conversion optimization for your website without you having done anything wrong. It sorts advertisers’ sites into categories and, if it places your site in the health and wellness category, you lose the ability to optimize towards Purchase, Lead or Subscribe. Google limits the same category separately by removing remarketing and Customer Match from accounts in sensitive interest categories. Safari sits underneath both, deleting the cookie that would have connected a click to a booking made a few months later. The restrictions are automatically applied to your website by each platform and user consent does not lift them.

This reaches further than most marketers expect, covering businesses offering supplements and skincare, weight loss and fertility services, mental health apps, dental and aesthetic clinics, physiotherapy practices and more. 

This guide covers what exactly has changed in Meta and Google, what triggers a restriction and how to address issues with Server-side Tracking for wellness & health brands. We will also walk through some scenarios that commonly appear for each industry and group, so you can work out where your own setup is losing data.

What changed on Meta

In late 2024, Meta began categorizing data sources, meaning the websites and apps that send events through Meta Business Tools, based on the topic of the site and the products or services it offers. One of those categories is health and wellness. Meta describes it as covering businesses associated with medical conditions, specific health statuses, or provider and patient relationships. Examples provided by Meta itself include a wellness tracker for depression and a patient portal.

Once your domain sits in that category, Meta applies one of three levels of restrictions:

• Core setup. You lose the ability to share custom parameters and URL parts beyond the domain. Custom audiences built on URL rules match on that data, so they degrade over time. Catalog items added through the Pixel may fail to register. Automatic advanced matching may become unavailable and some reporting features disappear from Events Manager, including sampled activity and the test events tool.
• Restriction on certain standard events. Mid and lower funnel events become unavailable for optimization, including Purchase, Add to Cart, Lead, Subscribe and Schedule. Upper funnel events such as Landing Page View and View Content remain available, and registered custom events may still work depending on your level. However, approach this last point carefully. Renaming a restricted event to get around the restriction can be viewed as circumvention and it puts your Business Tools access at risk.
• Full restriction. All events can be restricted in specific regions or all regions and Meta Business Tools cannot be used for campaign optimization where those restrictions apply. An account at this level runs without conversion-based bidding.

There are a few notable details you need to be aware of.

Restrictions apply to the data source, so a cookie banner can’t resolve them. A user can give explicit, granular, fully documented consent and the event still gets dropped on Meta's side. Your consent setup still governs what you are allowed to collect and send to your tools and whether a user gives their consent or not will not change what data Meta ends up accepting.

Enforcement is regional. Meta notes that restrictions may vary by country or region, or apply globally, depending on the applicable local regulations. EU advertisers have consistently reported experiencing more restrictions than US advertisers on comparable websites, which follows from GDPR treating data concerning health as a special category under Article 9.

Sending the same events server-side changes nothing about the restriction. Where a source is fully restricted, Meta drops the events on receiving them, including events delivered through the Conversions API. A server container changes nothing about the restriction itself.

Additionally, Meta puts the compliance responsibility on you. The Business Help Center states that while Meta's systems are designed to filter out the prohibited information that they detect, the advertiser is ultimately responsible for the shared data and Meta's systems are not a substitute for your own compliance mechanisms. Repeated warnings about sharing prohibited data precede account-level action, so treat them as urgent.

What changed on Google

Google approaches the same problem through its Personalized advertising policy. Health is a sensitive interest category and Google's definition is extremely broad. It covers physical and mental health conditions, chronic conditions, products and services used to treat or manage them, sexual and reproductive health, anything involving intimate body parts or functions and invasive medical procedures, including cosmetic surgery and injections.

Advertisers promoting products or services in a sensitive interest category can’t use advertiser-curated audiences. That removes remarketing lists, Customer Match and similar audience types from your account. Predefined Google audiences such as in-market and affinity segments stay available, because Google builds them without sensitive signals. Custom Segments using sensitive creative or pointing at sensitive landing pages are limited to contextual and non-sensitive Display placements, and other campaign types using them will not run at all.

In practice, it means that an aesthetic clinic or a weight loss brand loses a large part of the Google audience toolkit, which leaves conversion data as the main input Google has left to optimize on. That makes the accuracy of what you send worth protecting.

If you advertise in the EEA or the UK, Consent Mode v2 has been required since March 2024. Without the four consent signals in place, Google stops building remarketing audiences and conversion modelling degrades for those users.

What happens in the browser layer on top of everything else

Ad platform policy is the newest problem, but the older one concerning browser-level limitations has not gone away. 

Safari caps cookies written by JavaScript at roughly seven days, and shortens that to about 24 hours when the landing URL carries a known advertising parameter such as gclid or fbclid. Paid clicks carry those parameters. Meanwhile, cookies set by your own server over HTTP from your own domain follow their normal lifetime.

That gap hurts health and wellness more than most categories because of the long decision cycles in these verticals. A fertility patient spends months on research. Someone comparing clinics for a dental implant books a consultation weeks after seeing the first ad. A supplement buyer reads three comparison articles before finally making an order. A mental health app converts a trial to a paid subscription after fourteen or thirty days. In every one of those cases, the browser has already forgotten which campaign started the journey.

Ad blockers increase the data loss further, and health audiences tend to consist of more privacy-aware users browsing on mobile devices who are likely to run them. Safari's newer protections keep tightening, which we cover in more detail in our write-up on tracking protection in Safari 27.

What actually triggers a restriction

Most brands that get categorized as health-related did not intend to send anything sensitive. It usually comes from URLs, event names and parameters that were built for other reasons.

• URL paths and query strings. A page at /collections/menopause-support or /treatments/acne-scarring tells Meta the topic of the visit as soon as the full URL is included in an event. The same thing happens with quiz results and filter parameters.
• Custom event and conversion names. An event called hair_loss_consultation_booked or a conversion named IVF Lead state a health condition in plain text.
• Custom parameters. Product names, category fields, plan types and treatment identifiers passed alongside a Purchase event carry the same information as the URL.
• Pixel placement. A pixel on a patient portal, a symptom quiz, an intake form or a post-booking confirmation page is the most common cause of an escalated restriction.
• Catalog and product feed data. Product titles in a supplements or skincare feed frequently name the condition the product is used to treat.
• Ad copy and landing page content. Restrictions can be triggered indirectly by the copy on your creatives and pages. Meta's health and wellness ad standards discourage copy that makes people feel negatively about themselves. Also, naming a specific condition in an ad implies information about the person who clicks it.

For a quick check, look at one raw event payload and ask whether a stranger reading it could infer a health condition or status about the person it describes. If the answer is yes, that payload is a liability regardless of how it’s delivered.

What Server-side Tracking does about this

Server-side Tracking moves the tracking work onto a server container running on your own domain. Your website sends event data there and you decide what goes to each destination.

For an advertiser in health or wellness, that control carries five key benefits:

One place to manage the data that leaves your systems

Instead of auditing every tag, plugin or theme template across your site, you define the allowed fields once in the server container. Strip the URL path, drop the treatment parameter, rename the event, hash the identifiers – every downstream tool inherits those rules. Most of that work happens in GTM transformations.

Measurement stays complete regardless of what the platform does with the events

A restriction stops Meta from using an event for optimization but it does not stop you from recording that conversion. When your server holds the full event stream, your analytics, dashboards and budget decisions stay intact even while Meta only receives upper funnel signals. Your reporting still shows what each campaign cost and what it returned, which is what you need to decide where the budget goes next month.

Send conversions from systems that the browser doesn’t see

Clinic bookings that complete in practice management software, phone consultations, subscription renewals, trial-to-paid upgrades, and refunds all happen away from the website. A server-side setup lets you feed those into your reporting and, where policy allows, into the platforms as offline conversions with neutral event names. This is particularly important for clinics, as it’s often the only way for them to get an accurate view of their revenue.

Consent can be enforced as a rule

Your server checks the consent state before a tag fires and forwards data only for the purposes that the visitor agreed to. When someone withdraws consent, the server stops sharing the data with all downstream tools. We go into how this works alongside a consent management platform in our article Beyond the banner.

Data stays in the region

Running the server container on European infrastructure means the event stream, including anything you filter out before it reaches a platform, stays in the EU. That is a straightforward answer to give a DPO, an auditor, or a clinic's compliance officer. More on that in our GDPR guide and on our infrastructure page.

The limitations of Server-side Tracking

Server-side Tracking gives you control over what data you send and what you keep. But it also has some limitations that you should be aware of before you plan around it:

• It will not change how Meta has categorized your website. To change the categorization, remove the health-related detail from the data and submit an appeal.
• It will not restore optimization at a fully restricted source. Meta drops those events when they arrive, whether they came from the Pixel or the Conversions API.
• It will not make prohibited data safe to send. Forwarding a treatment name from your server is the same kind of violation as sending it from a browser, and the responsibility lies on you either way.

Where measurement breaks along a wellness journey

Each of these happens where a browser tag has limited reach, either because too much time has passed, the visitor moved to another domain or the event happened outside the website.

• The paid click. It carries a gclid or fbclid, which is the clearest indication of where the visit came from. Safari shortens cookies written by JavaScript to around 24 hours when one of those parameters is present in the landing URL.
• The quiz or symptom checker. High intent, and also the page most likely to carry a condition name in its URL or its results parameters, which makes it valuable to track and risky to send.
• The consultation request or booking. Often completed in third-party scheduling software on another domain, so the browser treats it as a separate visit and the original click is no longer connected to it.
• The first purchase or appointment. Usually happens days or weeks after the click, by which point the client-side cookie has already been deleted.
• Subscription renewals and repeat treatments. Recorded in billing or practice management software where no Pixel is present, meaning they are kept out of your ad platform.
• Refunds, cancellations and missed appointments. These are recorded in your billing or practice management software, so capturing them means sending them from that system and not from the website.

Four tracking scenarios in health and wellness advertising

Restrictions and browser limits show up differently depending on the business model and specific vertical. These four situations cover a few commonly found patterns.

A supplement brand selling condition-specific formulas

Category page URLs contain the condition name, product feed titles repeat it, and the Purchase event passes the product name as a parameter. The data source moves to core setup, so the URL detail those audiences match on stops being shared and they start to shrink. Handling the event server-side lets the brand send a conversion with value and currency under a neutral name, without the product identifier or the URL path. The sensitive content stays out of what Meta receives, and the conversion count and revenue figure remain unchanged.

An aesthetic clinic that gets most bookings for treatments by phone

The website only records form fills, so reported conversions cover a fraction of actual revenue. Meta optimizes toward the form fill because that is the only event it gets, which pushes budget toward campaigns generating cheap leads rather than booked treatments. The clinic can send attended appointments from its practice management software to the server, then forward them to Meta under a conversion name that identifies the event without naming the treatment.

A fertility clinic with a consideration cycle measured in months

A first click happens in January and the consultation gets booked in April, on the same device. The client-side cookie set during the first visit has been deleted by then, so the browser has no record of where the visit originated and the booking is attributed to brand search or direct traffic. The campaigns that generated the original interest show no return, even though they brought the patient in. A cookie set by your own server over HTTP keeps its standard lifetime, so the click identifier is still available in April and the booking can be credited to the campaign behind the January click.

A mental health app converting trials to paid subscriptions after two weeks

Meta has restricted the Subscribe event for the domain, which means it cannot be used for optimization. The server container still records each conversion, so the team can see which campaigns drive paying subscribers even though Meta will not report on it. Meta optimizes on the highest funnel event still available, while the team judges performance on their own record of paid conversions.

Implementing Server-side Tracking step by step 

To get started, you don’t need to completely rebuild your tracking. Your current setup keeps running while you add a server container alongside it, move events across one at a time, and compare the results before you switch anything off.

1. Check your restriction level first. The rest of the plan depends on which tier you are in. In Events Manager, select your data source and open Settings, where Manage data source categories and Data restrictions will show your current status. The Diagnostics tab is also worth checking, since it lists notices about prohibited information being removed from your data.
2. Audit what you are currently sending. Open a live event payload and read every field. Look at your URLs, custom event names, custom parameters and catalog titles.
3. Remove the Pixel from patient-facing pages. This will typically include portals, intake forms, quiz result pages and post-booking confirmations.
4. Set up the server container and route one event through it. Start with your single most important conversion.
5. Apply your filtering rules in the server container. Give events neutral names, pass through only the parameters you have approved, and strip URL detail beyond the domain.
6. Compare browser and server data before you switch anything off. Your Safari and mobile traffic will show the difference most clearly.
7. Bring in the offline sources. This is usually where the biggest reporting gap closes for clinics. Add in bookings, renewals, refunds and anything else.
8. Write the rules down and add them to your release checklist. One new parameter added by a developer a few months from now can re-trigger a restriction. Our Server-side Tracking checklist is a good starting point.

How TAGGRS helps health & wellness brands

TAGGRS hosts and maintains the server container for you, so you get a working data pipeline without your developers having to configure cloud infrastructure or maintain it afterwards. Everything runs on European servers, so your data stays within the EU and you know exactly where it is processed so you can document it for your privacy officer.

The setup extends your current Google Tag Manager container so your existing web container keeps running while you migrate tags and validate the results. Meta connects through a hosted Conversions API Gateway, which removes the need for custom integration.

A few TAGGRS features are particularly relevant here.

• Enhanced Tracking Script replaces your standard GTM script and masks it, so events from visitors with ad blockers still reach your server container. It also improves cookie resilience on ITP browsers when paired with the right server-side setup. Events captured this way are labeled separately in your dashboard, so you can see how much data it recovers.
• Data Enricher combines, filters and augments event data on the server before anything is forwarded. This is where you enforce your allowed-field rules and add non-sensitive context such as city, region and device, which increases your Meta Event Match Quality and Google Enhanced Conversions match rate.
• Cookie Recovery stores a user ID in an ITP-compliant first-party cookie and restores marketing cookies on return. A booking made weeks after the initial click can still be connected to the campaign that produced it.
• Click ID Recovery holds the click identifier server-side across the long consideration windows.
• Multi Domain Tool keeps the journey connected when a patient moves from your marketing site to a separate booking or portal domain.

Most of the configuration is already built. Ready-made templates and a GTM copy-paste option cover the standard setups for GA4, Google Ads and Meta, so the work on your side is filling in your own IDs and adjusting the elements that are specific to your site. That leaves your time for the decisions that matter here, which are the filtering rules and what you permit each platform to receive.

Conclusion

Health and wellness advertisers now work with fewer usable signals than many other categories and industries. Meta limits which events it will accept, Google limits which audiences you can build, and browser restrictions reduce what either of them receives. 

What you are still able to do is stay in control of your own data pipeline. You decide what leaves your server and keep a full conversion record regardless of what the platforms accept. You also maintain the ability to remove the data that triggered the restriction in the first place. All of that starts with knowing what your current tracking setup looks like and where it falls short.

Our free website tracking checker scans your domain and scores your tracking across pixels, server-side coverage, cookies and consent. No GTM or ad account access needed. You get every finding with a recommended fix attached.

Test Server-side Tracking with a free TAGGRS account, or book a demo if you want us to look at your setup with you.

FAQ

Does Server-side Tracking remove Meta's health and wellness restrictions?

No, and be careful with anyone who says otherwise. Restrictions are applied to your data source based on how Meta categorizes your website. Where a source is fully restricted, Meta drops the events on receipt, including events sent through the Conversions API. What a server-side setup does is let you control what you send, keep your own measurement complete when the platform stops accepting events, and avoid the mistakes that escalate a restriction.

Can user consent lift a Meta restriction?

No. The limit is applied on Meta's side at the data source level. Consent remains legally necessary for the data you collect, and it governs what you may forward, but it does not change what Meta will accept from a categorized domain.

How do I find out which restriction level I am on?

In Events Manager, select your data source and open Settings. Check Manage data source categories and Data restrictions. The Diagnostics tab will also show notices when prohibited information has been removed from your data. Meta does not always make these notices prominent, so check directly rather than waiting for an email.

I think Meta has categorized my business incorrectly. Should I appeal?

Appeal, but fix the data pipeline first. If the signals that caused the categorization are still present, an appeal may not do much. Miscategorization happens – make sure you provide a specific, factual description of what your business does and does not do. Be prepared for the possibility that Meta won’t change their categorization.

Is Server-side Tracking GDPR compliant for health data?

Server-side Tracking is a method of collecting and routing data. It works within GDPR when paired with a lawful basis and proper consent, and it supports compliance by giving you control over what leaves your environment and letting you keep data on European infrastructure. Health data is a special category under GDPR Article 9, so the relevant question is usually whether you should be forwarding a given field at all, and a server-side setup is where you enforce that decision.

What should clinics do about bookings that happen offline?

Send them from the system where they are recorded. A server-side setup lets you bring confirmed appointments, attended appointments, and cancellations into your reporting, and forward neutral conversion signals to platforms where policy allows. For most clinics this closes the largest single gap between marketing reports and finance numbers.

Will this recover the conversions I lose to ad blockers and browser limits?

It recovers a meaningful share. Because data flows from your own domain rather than a third-party script that blockers target, many events browser tracking loses still reach your server. How much depends on your audience and setup. The TAGGRS dashboard shows you the difference between browser and server data for your own site.

How long does implementation take?

The core setup can be live quickly with managed hosting, since time needed for the cloud configuration is removed. First recovered conversions show up soon after. Covering the full journey across consultations, bookings, subscriptions and offline sources takes longer and works best in stages, starting with your highest-value event.