Say what's true. Show who's paying.
A working reference for FTC rules, health claims, privacy and platform policies, with tools you can use on every page, video and email you publish.
Last reviewed November 14, 2026
What this review changed
Updated November 14, 2026: Pinterest's limited prescription GLP-1 ad exception, separate Gmail and Yahoo sender requirements, current consumer-health privacy sources, and clearer limitations for the tools below.
For prescription programs, also use the Telehealth Affiliate Compliance Guide, including current FDA, FTC and DEA developments. This hub focuses on U.S. affiliate marketing.
Five core rules
Most health marketing trouble comes from breaking one of these. Everything else on this page builds on them.
Disclose every relationship
Commissions, free products, discount codes and sponsorships all count as material connections.
- Put the disclosure where people see it before they click.
- Use plain words such as “I earn a commission if you buy.”
- Repeat it in every post, video, email or live stream.
- Don't rely on a platform label alone.
Claim only what you can prove
The FTC expects health benefit and safety claims to be backed by competent and reliable scientific evidence, generally randomized controlled human trials.
- Review product-specific evidence before publishing; a study link or merchant approval alone does not establish substantiation.
- Testimonials count as your claims, so don't repeat ones you couldn't prove yourself.
- Say less when you know less.
Don't diagnose, treat or promise
Regulatory category matters: supplements cannot be sold as disease treatments, while prescription promotions have product-specific requirements. Unsupported promises remain misleading.
- Describe what a product is and how you use it.
- Never suggest stopping or replacing medication.
- Point to a clinician for any condition.
Protect health data
State laws can treat information tied to a person's health, including some tracking data, as sensitive consumer health data.
- Collect only what you need and get clear consent.
- Review the pixels and tags on health pages.
- Publish a privacy policy that matches what you do.
Follow each platform's rules too
Platforms often restrict more than the law does. Supplements and weight-management content are the usual flashpoints.
- Check the Policy Tracker before you build on a channel.
- Use the platform's disclosure tool and your own words.
- Expect age gating or approval in restricted categories.
Disclosure Builder
Pick where you're publishing and what your relationship is. Get wording you can copy, plus where to put it and what to avoid.
Where are you publishing?
What is your relationship?
Use “we” for a publication and “I” for an individual. Adapt every example truthfully. Add price or editorial-independence assurances only when verified.
Write it like this
Short version for captions and titles
Where to put it
- At the top of the page, before the first affiliate link or product box
- Repeat beside comparison tables and “buy” buttons
- Link to your full disclosure page, but don't rely on that alone
Platform tool
Add rel="sponsored" to affiliate links. That tells search engines about the link and is separate from telling readers.
Avoid
- A footer-only disclosure
- Vague wording like “this post may contain links”
- A disclosure that appears only after the first affiliate link
Claim Checker
Use this limited wording screen to identify text for review. It does not approve claims or determine whether a product or promotion is lawful.
Your copy
Review
Paste or load copy to see your review.
This checks wording patterns only. It cannot assess truth, evidence, images, regulatory eligibility or disclosure placement. Review examples in context; do not paste patient or sensitive information.
Evidence and supplements
How much proof do you need, and how do supplement claims differ from disease claims?
Randomized, controlled human trials
The FTC's guidance says substantiation of health benefits will generally need randomized, controlled human clinical testing, conducted and evaluated objectively by qualified experts. Quality matters more than the number of studies.
The study must match your product, dose and population. A trial of a different formula doesn't support your claim.
Based on the FTC's Health Products Compliance Guidance (December 2022), which applies to supplements, foods, OTC products, devices, tests and health apps.
Three kinds of health statement
| Type | Example | What to know |
|---|---|---|
| Disease claim | “Lowers your blood pressure so you can skip medication.” | Claims to treat, cure, mitigate or prevent a disease are drug claims. Don't make them for supplements or everyday wellness products. |
| Structure or function claim | “Supports heart health.*” | Can describe normal structure/function. Dietary-supplement labeling has substantiation, disclaimer and FDA notification requirements. A disclaimer cannot legalize a disease claim. |
| General wellness | “Helps you stay active with low-impact moves.” | Describes lifestyle use, not a health outcome. Lowest risk, but keep it truthful. |
Health data privacy
Health publishers collect more sensitive data than they realize, often through analytics, quizzes and ad pixels.
Check the actual privacy framework
HIPAA applies based on the entity and activity. The FTC Act, the Health Breach Notification Rule where applicable, and state privacy laws can protect health information outside HIPAA.
State consumer health data laws
Washington, Nevada and Connecticut have distinct definitions, exclusions, consent requirements and enforcement systems. Assess actual health inferences and the jurisdictions involved; the tracker below links to official sources.
Tracking is where risk hides
Pixels, SDKs and email tracking can reveal which health topics someone engaged with. Regulators and plaintiffs have focused on this kind of marketing technology.
Health apps and tools
If you build a tracker, quiz or app that collects personal health information, the FTC's Health Breach Notification Rule may apply even outside HIPAA. Get counsel's view before launch.
Practical steps for your site
- Audit every pixel, tag and plugin on pages about health conditions, and remove what you don't need.
- Assess whether sharing is permitted at all and obtain any required specific consent or authorization. A cookie banner is not universal permission.
- Publish a consumer health data privacy policy if you collect that kind of data.
- Avoid building retargeting audiences from condition pages unless counsel approves it.
- Don't collect health details in quizzes or forms unless you need them, and say how you'll use them.
- Review vendor contracts and access; honor applicable rights requests. Hashed emails, click IDs and server-to-server events are not automatically anonymous.
Washington's law phased in: geofencing restrictions from July 23, 2023; sections 4–9 from March 31, 2024 for other regulated entities and June 30, 2024 for qualifying small businesses. Nevada's consumer-health provisions took effect March 31, 2024. Use current Connecticut guidance rather than treating its July 2023 launch date as the full set of obligations. This is not an exhaustive state or international survey.
Policy Tracker
What each regulator and platform requires for health content, with the date we last checked. Always confirm in the source before relying on a row.
| Policy | What matters for health content | Review status | Source |
|---|---|---|---|
|
FTC endorsements November 14, 2026 |
Disclose unexpected financial or other material connections clearly. Labels and link attributes do not replace a disclosure people understand. | Source checked | Official source |
|
Health-claim substantiation November 14, 2026 |
Support express and implied health claims with appropriate evidence. Advertiser approval or a disclaimer alone does not prove a claim. | Source checked | Official source |
|
Fake reviews and testimonials November 14, 2026 |
No fabricated experiences or sentiment-conditioned incentives. Disclose material connections and do not misrepresent controlled review sites as independent. | Source checked | Official source |
|
FDA supplement labeling November 14, 2026 |
Supplements are not preapproved by FDA. Structure/function labeling has specific disclaimer and notification requirements; disease-treatment claims are not ordinary supplement claims. | Source checked | Official source |
|
Washington consumer health data November 14, 2026 |
My Health My Data has phased dates, including June 30, 2024 for qualifying small businesses. Health inferences, consent, separate policy links and private enforcement can matter. | Source checked | Official source |
|
Nevada consumer health data November 14, 2026 |
NRS 603A.400–.550 covers health-data practices, with scope exceptions, consent rules, consumer rights and sale authorization requirements. | Source checked | Official source |
|
Connecticut consumer health data November 14, 2026 |
Consumer Health Data Controllers have special coverage rules without ordinary volume thresholds. Assess sensitive data, vendor contracts and consumer rights using current guidance. | Source checked | Official source |
|
FTC health breach notification November 14, 2026 |
Certain non-HIPAA health apps and related businesses have breach-notification obligations. Unauthorized disclosure can be relevant, not just hacking. | Source checked | Official source |
|
Subscriptions and cancellation November 14, 2026 |
ROSCA governs online negative-option terms, consent and stopping charges. Do not treat the vacated 2024 click-to-cancel amendment as an operative nationwide rule. | Source checked | Official source |
|
CAN-SPAM November 14, 2026 |
Use accurate headers and subjects, provide a postal address and opt-out, and honor unsubscribe requests within 10 business days. Provider deadlines can be shorter. | Source checked | Official source |
|
YouTube branded content November 14, 2026 |
Declare paid promotions and follow the branded-content rules. Check required age and geography restrictions; a disclosure label does not authorize a restricted product. | Source checked | Official source |
|
YouTube medical misinformation November 14, 2026 |
YouTube restricts harmful prevention and treatment misinformation. The policy also covers descriptions, livestreams and external links. | Source checked | Official source |
|
TikTok commercial disclosure November 14, 2026 |
Turn on the commercial content disclosure setting for promotional content and meet applicable rules. TikTok One can manage disclosure, but is not universal permission for health categories. | Source checked | Official source |
|
TikTok market and format eligibility November 14, 2026 |
Branded content, paid ads and Shop have different rules. Check the exact product, country and format; do not rely on a blanket supplement or OTC exception. | Source checked | Official source |
|
Meta health and branded content Launch verification required |
Before launch, confirm the current branded-content, healthcare, age, targeting and authorization requirements for the actual format and account. No blanket eligibility is stated here. | Launch check | Official source |
|
LinkedIn brand partnership November 14, 2026 |
Apply the Brand Partnership label to compensated public posts. The setting applies to the current post; clear disclosure and applicable advertising rules still matter. | Source checked | Official source |
|
Pinterest weight-loss ads November 14, 2026 |
The broad weight-loss restriction has a limited exception for approved prescription GLP-1 healthcare advertisers in the U.S. and Canada. Prior permission and country-specific rules apply; before-and-after weight-loss imagery remains prohibited. | Source checked | Official source |
|
Google Ads prescription services November 14, 2026 |
Restricted services require the appropriate certification and location eligibility. Do not assume a provider's approval covers a separate affiliate account or domain. | Source checked | Official source |
|
Gmail sender requirements November 14, 2026 |
Bulk status is around 5,000 messages daily to personal Gmail accounts, aggregated by primary domain, and persists once assigned. Bulk senders need SPF, DKIM, DMARC and one-click unsubscribe for marketing/subscribed mail. | Source checked | Official source |
|
Yahoo sender requirements November 14, 2026 |
Yahoo does not publish a numeric bulk-sender threshold. Bulk requirements include SPF, DKIM, DMARC, easy unsubscribe and complaint rates below 0.3%; honor unsubscribes within 2 days. | Source checked | Official source |
|
Google Search health content November 14, 2026 |
Trust is especially important for health content. E-E-A-T is not one specific ranking factor; provide useful content, clear authorship and accurate sources. | Source checked | Official source |
Review dates are shown per row. Meta requirements are marked for launch verification because its current policy page could not be independently rechecked. A source check is not approval for any account, product or campaign.
Pre-publish checklists
Pick the type of content you're about to publish and tick every box. Your ticks save in this browser.
Templates
Starting points for the pages every health affiliate site needs. Edit the brackets and have counsel review before use.
Affiliate relationship
Ranking and editorial process
Medical review credit
Testimonial review prompt
Supplement labeling disclaimer
Product limitations
Frequently asked
Quick answers to the questions we hear most.
Does rel="sponsored" replace a reader disclosure?
No. It qualifies links for search engines. People still need a clear disclosure of a material financial relationship.
Does the Claim Checker approve my copy?
No. It detects selected text patterns only. It cannot verify evidence, regulatory status, visual context, disclosure placement or legal compliance.
Is “results vary” enough for an unusual testimonial?
No. If a result implies what others can expect, provide substantiated generally expected performance or do not use the claim.
Are supplements FDA-approved?
FDA does not preapprove dietary supplements. Specific labeling claims have requirements, and supplement treatment or cure claims can make a product an unapproved drug.
Do Gmail and Yahoo use the same bulk threshold?
No. Gmail describes bulk status around 5,000 messages per day to personal Gmail accounts. Yahoo does not publish a numeric threshold.
Can I rely only on HIPAA or a cookie banner?
No. Assess the actual entity, data and recipients. FTC rules and state consumer-health privacy laws can apply outside HIPAA; generic consent is not universal permission.
Where are the telehealth-specific rules?
Use the linked Telehealth Affiliate Compliance Guide for prescribing, compounding, referral compensation and prescription-advertising considerations.
Does completing a checklist certify compliance?
No. Checklists organize review. They do not replace substantiation, product-specific platform approval or qualified legal advice.
MarketHealth Compliance Hub is educational content and doesn't constitute legal, medical or financial advice. Laws and platform policies change frequently, and nothing here guarantees compliance.
MarketHealth isn't affiliated with or endorsed by any platform named on this page. Some links on MarketHealth may be affiliate links, and we may earn a commission.