What is prohibited information in Meta business tools?
Prohibited information is data about people that Meta does not permit advertisers to share through its business tools, because it is sensitive under applicable laws, regulations or industry guidelines, or disallowed by Meta's terms and policies. Examples include health and financial information. Sharing it can mean performance issues, data restrictions, or suspension or termination of use.
Meta business tools, such as the Meta pixel and the Conversions API, send data about people to Meta. Meta does not permit you to send prohibited information through them, and you are responsible for the data you share. Meta says its examples are not exhaustive and may be updated.
What counts as prohibited information?
Meta defines it as information about people that is sensitive under applicable laws, regulations or industry guidelines, or otherwise disallowed by its terms and policies. Event names and the criteria you set for events, conversions and custom audiences must not reflect, imply or be based on it.
| Group | Examples Meta lists |
|---|---|
| Identifiers and credentials | SSN or local equivalent, password, GPS (latitude and longitude), access token, public services identifiers such as Medicare or EBT information |
| Financial | Bank account or routing number, credit or debit card number, income or tax information, credit score, loan approvals or denials, debt status |
| Health | Diseases and conditions, sexual and reproductive health, mental health, medical procedures and treatments, prescription medications |
Meta says this information should not be shared in URL parameters, custom audiences, custom conversions, custom event names or custom data.
What happens if you share it?
Meta says sharing it violates the Meta business tools terms and may violate laws. Consequences include performance issues, data restrictions, or suspension or termination of your use of its products and services, including the business tools.
Meta’s systems are designed to block and remove potentially prohibited information they detect. Meta also says they are not a substitute for your own compliance mechanisms.
How do you know Meta found some?
Notifications arrive by email or as in-product alerts in Events Manager or Ads Manager. The diagnostics tab of the relevant dataset in Events Manager has details. It does not display the detected and removed data itself.
How do you check your own setup?
- Open the diagnostics tab of your dataset in Events Manager.
- Read Events Manager’s summary of the pages, parameters and URLs recently sent.
- List the pages where your pixel is placed, including URLs, and remove it from pages you don’t want it on.
- Stop sending information from pages where visitors log in with potentially sensitive information, such as patient portals.
- Check forms and data fields, including product IDs, content names, custom properties and URL parameters such as UTM parameters.
- Confirm customer information parameters use the designated names and are hashed with SHA-256 where required.
- Review custom events in the events table on the data sources tab, custom conversions on the custom conversions tab, and custom audiences under audiences in Ads Manager.
What should you do if data was removed?
- Review the diagnostics tab for the parameters and pages that had information removed.
- Review your whole integration: URL strings, parameter names and values, and custom event names. If custom events were blocked in error, you may be able to request a review from Events Manager or Ads Manager.
- Update the integration. Do not attempt to send data that was previously detected and removed.
- Use the developer documentation or your Meta support contact, and work with your own legal counsel on a data-sharing compliance plan.
- Consider turning on core setup.
Core setup restricts transmission of certain data, such as custom parameters and anything in a URL after the domain. Meta can place a business tool such as the pixel into core setup, and you can too. It is not a substitute for compliance. You can also turn on data restrictions.
What do the privacy requirements add?
Meta says its privacy and data use requirements apply to all business tools, including the pixel and the Conversions API. You need a lawful basis and consent before sharing data, and Meta says some jurisdictions, such as the EU, require informed consent for storing or accessing information on a device.
- Pixel: no data is shared until cookies are accepted.
- Conversions API: no event data about people who haven’t consented.
- App events API and SDK: the same applies.
Meta may audit your use of the business tools.
FAQ
Does Meta remove prohibited data for you?
It tries, but you remain responsible. Meta says its systems are designed to block and remove potentially prohibited information they detect, and that they are not a substitute for your own compliance mechanisms. Check what your pixel and Conversions API send, because the removal is not a guarantee.
Can UTM parameters count as prohibited information?
They can if they carry it. Meta says prohibited information should not be shared in URL parameters, and its checklist tells you to review them, including UTM parameters, alongside product IDs and content names. Review your links as carefully as your events.
Can you ask for a review if events were blocked in error?
Possibly. Meta says that if custom events were blocked in error, you may be able to request a review from Events Manager or Ads Manager. Review your whole integration first, and do not try to send data that was previously detected and removed.
Sources
- About prohibited information (Meta, checked 2 Oct 2026)
- Troubleshoot Meta business tools prohibited information notifications (Meta, checked 2 Oct 2026)
- Privacy and data use requirements for Meta business tools (Meta, checked 2 Oct 2026)
Drafted with AI and checked claim by claim against the pages linked under Sources. Found a mistake? Tell us via the corrections policy.