A treatment center we work with had been running paid search for two years when their account was suspended without warning. The cause was a Custom Audience built from a list of past patients, which Google’s automated systems flagged for sensitive category use.
The account did not come back for six weeks while the appeal worked through Google’s review queue. The program lost a quarter of its forecast admit volume during the suspension.
The center had not done anything sudden. The Custom Audience had been live for over a year. The compliance issue had been accumulating quietly the entire time. Google’s enforcement schedule, not the center’s behavior, was what triggered the suspension.
That pattern is the most expensive thing about Google Ads compliance in behavioral health. The mistakes are usually multi-month accumulations, not single events.
The enforcement is sudden. The recovery is slow. By the time a program learns what got the account flagged, it has already lost a quarter of admits.
Compliance for rehab Google Ads is not a marketing department issue. It is a legal architecture decision that has to involve compliance, IT, and marketing in the same room.
Mitch Marowitz, Director of Paid Admissions, Webserv
The five mistakes below are the ones we see most often when we audit treatment center Google Ads accounts. None of them are exotic. All of them are preventable. None of them are recoverable from once enforcement hits, except by suspension and appeal.
Key Takeaways
- Google Ads compliance failures in behavioral health usually accumulate for 12 to 24 months before enforcement hits. By the time the account is suspended, the misconfiguration has been live for over a year.
- The five most common triggers are LegitScript lapses, HIPAA-violating conversion tracking and Custom Audiences, unsubstantiated treatment claims, sensitive-category audience targeting, and non-compliant landing pages.
- Custom Audiences built from patient or inquiry data are the highest-risk single configuration — they are sensitive-category use by Google’s own definition and flag automatically once match rates cross a threshold.
- A quarterly compliance review covering all five areas takes a few hours and prevents the campaign-level pulldowns that accumulate into account-level suspensions.
1. Operating without LegitScript certification
LegitScript certification is required for treatment center advertising on Google Ads. Without it, the account either cannot run substance use disorder treatment ads or runs them in a state of policy violation that surfaces eventually.
The certification process takes 2 to 8 weeks depending on documentation completeness. The application reviews the program’s licensing, clinical staffing, marketing claims, and patient outcomes. LegitScript verifies the program against its own monitoring standards before issuing the certification.
A renewal is required annually. Certifications can be revoked mid-term if LegitScript identifies non-compliance through its ongoing monitoring.
The pattern we see: programs apply once, get certified, treat it as a one-time setup, then forget about it. The renewal lapses. The Google Ads account continues running until Google catches the lapse, at which point the suspension hits.
The fix: treat LegitScript certification as a recurring annual obligation with a 90-day pre-renewal review. Confirm certification status quarterly through the LegitScript dashboard. If the program goes through any clinical, ownership, or location change, notify LegitScript proactively rather than waiting for the next renewal.
2. HIPAA violations in conversion tracking and Custom Audiences
Google Ads compliance and HIPAA compliance are different rule sets. A treatment center can be in violation of one and not the other. The intersection is where most paid search suspensions happen in behavioral health.
The pattern usually involves three specific issues that compound over time.
The Custom Audience built from patient or inquiry data. Google’s Personalized Advertising policy prohibits using sensitive categories (health conditions, substance use, mental health) for ad targeting. A list-based Custom Audience built from past inquiries or admissions is sensitive category use by definition. Google’s automated systems flag these audiences once they reach a certain match rate.
The conversion tracking that transmits PHI. A standard GA4/GTM setup transmits IP address, URL paths, and form data into systems that have no Business Associate Agreement coverage. The HIPAA violation is one issue. The Google Ads policy violation, separately, is that the conversion data Google receives may contain identifiable health information that violates Personalized Advertising rules.
The remarketing audience based on URL paths that reference health conditions. A remarketing list of “users who visited /opioid-addiction” is a sensitive-category audience. Google does not always flag it on creation. It often flags it later, after the audience has been live and used in campaigns for months.
The fix: route all conversion tracking through a HIPAA-compliant intermediary platform with BAA coverage. Build remarketing audiences from non-sensitive URL paths only. Do not upload patient lists to Google Ads under any framing.
3. Unsubstantiated treatment claims and outcome statistics
Google Ads has explicit policies against medical claims that cannot be substantiated by the advertiser. Behavioral health is treated as a high-scrutiny category under those policies.
The claims that trigger reviews and suspensions:
Success rate language without specific clinical sourcing. “85% of our patients stay sober” or “92% completion rate” without published methodology behind those numbers. The numbers may be accurate. Google requires that the advertiser be able to substantiate them on demand. If the program cannot, the ads come down.
“Best” and “leading” superlatives. “Best rehab in [city],” “leading addiction treatment center,” “top-rated facility.” Google’s policies require substantiation for comparative claims. Most programs cannot produce the third-party data behind these claims at the standard Google requires.
Before and after testimonial framing. Strict policy violations across all healthcare verticals. Even patient quotes that describe specific clinical outcomes can trigger reviews if Google interprets them as testimonial-equivalent.
Fear-based copy. “Don’t let addiction destroy your family.” “Without treatment, you will die.” Google’s policies prohibit ads that exploit emotional distress or use scare tactics in ways that do not align with the actual service offered.
The fix: every claim in every ad needs a sourcing document on file with the marketing team. If the source is internal data, the methodology has to be documented. If the source is third-party data, the citation has to be specific. Generic, unsourced claims get pulled, and the ad-level pulldowns accumulate into account-level enforcement over time.
4. Sensitive-category targeting that violates Personalized Advertising policy
Google Ads Personalized Advertising rules prohibit using sensitive categories for ad targeting. Behavioral health, addiction, mental health, and substance use disorders are all explicitly listed.
The targeting violations that show up most often in audits:
Affinity or in-market audiences related to addiction or mental health. These are not always available in the ad platform interface, but third-party data integrations sometimes import them. Once imported into Google Ads as a custom segment, they become a policy violation.
Demographic targeting in combination with location targeting that proxies sensitive categories. Targeting “ages 18-34, household income low, ZIP codes near methadone clinics” is a proxy for substance use disorder. Google’s automated systems detect these patterns and flag accounts.
Lookalike audiences seeded on patient data. Even when the source list is anonymized, a lookalike audience derived from a sensitive-category seed inherits the sensitivity. Google policy treats the derived audience the same as the source.
Manual exclusions that imply sensitive-category targeting. Excluding “people not interested in addiction recovery” is the inverse of including the sensitive category. Same policy violation, just framed differently.
The fix: treatment center campaigns should use intent-based keyword targeting and broad geographic targeting only. No audience layering on sensitive categories. No lookalike or in-market segments that proxy health conditions. No exclusion logic that implies the same.
5. Landing pages that do not meet Google Ads policy requirements
The landing page is the part of the campaign Google reviews most carefully in healthcare verticals. A compliant ad pointing to a non-compliant landing page is a policy violation that gets the campaign pulled and the account flagged.
The landing page issues that surface in suspensions:
Missing or inadequate privacy policy. Google Ads policy requires a privacy policy on every landing page that describes data collection. Healthcare landing pages need a HIPAA-aware privacy policy that addresses tracking, intake forms, and patient data handling. A generic boilerplate privacy policy is treated as missing.
Tracking pixels firing without consent prompts. Google Ads policy is now aligned with broader privacy regulations. Pages that load tracking pixels before any consent interaction are flagged in regions that require consent.
Claims on the landing page that are not in the ad. A landing page that contains success rate statistics, before/after content, or unsubstantiated medical claims will trigger Google review even if the ad is clean. The destination page is part of the policy surface.
Lack of clear contact information and physical address. Google Ads policy for healthcare requires verifiable physical contact information on the landing page. Missing or generic contact details flag the destination as a misrepresentation risk.
Form fields that ask for protected health information without the right legal framing. Forms that collect substance use, mental health, or insurance details without a clear privacy notice and consent flow are flagged as data collection policy violations.
The fix: every landing page used in a paid search campaign needs a quarterly compliance review covering privacy policy, tracking consent, claim sourcing, contact information, and form data handling. The review takes 30 minutes per page and prevents the campaign-level pulldowns that accumulate into account-level enforcement.
How Profound Treatment drove 31 admits and a 42% drop in cost per viable in one quarter
Broad match pivot, negative keyword management, and intake-level conversion tracking turned a fragmented paid strategy into a predictable admissions engine.
Read the case study →68 viable VOBs at $4,529 cost per viable
What suspended programs have in common
The treatment centers we see suspended share a common pattern. Compliance was treated as a setup task at the beginning of the program rather than as an ongoing operational discipline.
The LegitScript certification was completed once and not actively monitored. The conversion tracking was set up by an agency that did not specialize in healthcare. The Custom Audiences were created opportunistically as the team learned about audience layering. The landing pages were built by a designer who did not have visibility into Google Ads policy.
None of those decisions look like compliance failures at the moment they happen. They become compliance failures when Google’s enforcement runs into the accumulated configuration. The interval between setup and enforcement is usually 12 to 24 months.
The programs that do not get suspended have a quarterly compliance review built into their operating cadence. The review covers all five of the areas above. It takes a few hours per quarter. It catches the accumulating issues before Google’s enforcement does.
If your current paid search operation does not run a quarterly compliance review at the level the five areas above describe, the question is not whether the account will get flagged. The question is when.
That is closeable. The first review surfaces most of what needs to change. The cadence after that keeps the program out of the suspension queue.
The perspective in this article comes from 9 years working exclusively inside behavioral health.
We are a team built by people in recovery who understand that behind every admission is someone asking for help. If that resonates, get to know us.
Mitch Marowitz is the Director of Paid Admissions at Webserv. Webserv works with behavioral health and addiction treatment centers on SEO, paid media, and full-funnel admissions strategy.
