Meta Ads for Startups: Facebook and Instagram After the Privacy Changes

1. Blog
2. Demand & Channels

By Saroj Jha · October 4, 2026 · 14 min read

Meta ads suit buyers you can reach as people: consumers, prosumers and small-business owners. Since Apple’s tracking changes, results depend on the conversion data you send back and the creative you test, so judge them with a control group.

Meta’s apps reached an average of 3.6 billion people a day in June 2026^[4], and its automated targeting can find buyers with little setup, which is why many consumer startups try it first. The rules changed in 2021, when Apple began requiring apps to ask permission to track users, and Meta has leaned on automation since.

In healthcare, three more rules sit on top: health data stays out of your ad tools, ads never imply you know a person’s health, and every claim stays inside what the FDA cleared. Below are the five steps I would work through with a founder, with one example company from start to finish.

Running case: Example Co. Fictional

Example Co. is a seed-stage MedTech startup. Its benchtop blood analyzer runs routine tests, such as HbA1c and a lipid panel, from a fingerstick sample in about 12 minutes, so a clinician can discuss results during the visit. In this story it is FDA-cleared and CLIA-waived. A clinic hosts it under a three-year agreement and buys single-use cartridges at about $14 each, about $25,000 a year. Its first market is independent primary-care practices with 3 to 10 clinicians, where the owner signs and the practice manager runs the numbers. Can Facebook and Instagram reach them? Example Co. and all its numbers are illustrative.

Step 1: Decide whether Meta fits your buyer

Meta works when your buyer can be reached as a person, not only as a job title:

• Consumer and prosumer products, where Meta’s reach and automated targeting work well.
• Small-business products, where the owner is also the buyer.
• B2B products with a broad buyer, such as software used by many roles, sometimes. For narrowly defined business buyers, LinkedIn’s job and company targeting is usually a better fit. I found no independent research on Meta ads for B2B, so test before you commit.

Effects vary widely between businesses. A field experiment on Yelp, not Meta, gave three months of free ads to 7,209 of 18,294 restaurants, chosen at random. Purchase-intention measures rose 7% to 19%, and independent and higher-rated restaurants gained more^[5]. The only way to know what Meta ads do for you is to test.

Example Co., step 1 Fictional

Practice owners are small-business owners who decide and sign, so independent practices fit. Urgent care centers fit later. Health systems buy through a value analysis committee, and retail clinics buy centrally, so Meta is not where Example Co. starts with either.

Do this

Describe your buyer in one sentence as a person, not a job title. If you can only describe them by title and company, test LinkedIn first. If your ads offer housing, jobs or credit, declare Meta’s Special Ad Category: those ads cannot narrow by age, gender or ZIP code, or use lookalike audiences^[6].

Free template

Turn your buyer into Meta targeting

The free Paid Audience Spec Builder turns one persona into Meta targeting, shows which settings Meta treats as hard limits and which as suggestions, and checks your budget can finish a test before you spend.

Step 2: Understand what Apple’s tracking rule changed

Since iOS 14.5, apps must get users’ permission through App Tracking Transparency before tracking them across other companies’ apps and websites^[7]. Apple defines tracking as “the act of linking user or device data collected from your app with user or device data collected from other companies’ apps, websites, or offline properties for targeted advertising or advertising measurement purposes.” Most people said no. A 2023 working paper using billions of mobile ad impressions found that the share of US ad traffic on Apple devices that could be tracked fell from 73% to 18%^[1].

Research on what the lost data means for advertisers:

• Research on e-commerce firms found click-through rates on conversion-optimized Meta ads fell by about 37% after ATT, and revenue at firms most reliant on Meta fell by 8% to 40% relative to less exposed firms, and smaller firms bore most of the decline^[8].
• A randomized study of more than 70,000 advertisers found that losing data from outside Meta’s platforms would raise the median cost per incremental customer from $38.16 to $49.93, a 31% increase, and that small advertisers were hurt most^[2]. Two of its four authors were Meta employees when the research was done.

A 2025 review of privacy research warned that privacy measures “may favor large companies” that need less third-party data and can afford compliance costs^[9]. For a startup, that makes clean first-party data more important, not less.

What Meta’s filings show

Meta’s own annual reports describe the same change from the platform’s side. These are what the filings say, not an account of how Meta made its choices internally.

In its 10-K for 2021, Meta wrote that “in 2021, Apple made certain changes to its products and data use policies in connection with changes to its iOS operating system that reduce our and other iOS developers’ ability to target and measure advertising, which has negatively impacted, and we expect will continue to negatively impact, the size of the budgets marketers are willing to commit to us and other advertising platforms.” It added that “our advertising revenue in the second half of 2021 was negatively impacted by marketer reaction to targeting and measurement challenges associated with iOS changes”^[10].

A year later, the 10-K for 2022 repeated the iOS risk and described the response: “we are making significant investments in AI and machine learning, including … to enhance our advertising tools and improve our ad delivery, targeting, and measurement capabilities”^[11].

In my view, the lesson for a startup is that the platform itself says it sees less, and is leaning on automation to fill the gap. Automation learns from the data you send it, which is the subject of Step 3.

Example Co., step 2 Fictional

Because Meta sees less data from iPhone users, Example Co. will not rely on Meta’s reporting to tell it which ads found signed clinics. It will send its own conversions from its CRM (Step 3) and measure with a control group (Step 5).

Do this

List which of your conversions happen in a browser and which happen later, in your CRM or billing system. The later ones are the ones Meta is most likely to miss.

Step 3: Send the right conversion data, and keep health data out

Use two connections:

• The Meta Pixel on your website, for browser events.
• The Conversions API, a connection “from an advertiser’s server, website platform, mobile app, or CRM to Meta systems”, whose events are processed like pixel events^[12]. It sends conversions the browser cannot, including events that happen later, such as a qualified lead or a signed agreement recorded in your CRM.

In practice, send the events that matter to the business, not just sign-ups, so Meta’s automation learns to find customers who sign. My post on tracking setup for startups covers the full setup.

Respect privacy rules as you do this. In California, sharing data for “cross-context behavioral advertising” is something consumers can opt out of, and businesses covered by the CCPA must honor opt-out signals such as Global Privacy Control^[13]. Meta’s Limited Data Use setting, available for people in seven states including California, limits how Meta uses the data you send^[14].

In healthcare, a further rule applies: no health data goes to the ad platform. Meta’s Business Tools Terms say you must not share data that “includes or is based on, directly or otherwise, health information, financial information, consumer report information, or other categories of sensitive information”, and that event and audience names “must not reflect, imply or be based on” those categories^[15]. So an event called “hba1c_test_ordered” breaks the rule even if no patient is named.

The law points the same way. Under HIPAA, a covered entity such as a clinic “must obtain an authorization for any use or disclosure of protected health information for marketing”^[16]. HHS’s bulletin on tracking technologies says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals’ HIPAA-compliant authorizations, would constitute impermissible disclosures”^[17].

On 20 June 2024 a federal court vacated part of that bulletin: the part saying HIPAA obligations are triggered when a tracking tool connects a visitor’s IP address with a visit to an unauthenticated public webpage about specific health conditions or healthcare providers. HHS notes this at the top of the bulletin page. The bulletin is guidance, not a regulation; the authorization rule for marketing comes from the regulation itself, which the ruling did not change. A device maker that handles patient data for clinics may be a business associate, bound by the same limits^[18]. In 2023 the FTC alleged that GoodRx violated the FTC Act “by sharing sensitive personal health information for years with advertising companies and platforms”^[19]. This is orientation, not legal advice.

Example Co., step 3 Fictional

The Pixel runs only on the marketing website. The CRM sends qualified demos and signed agreements through the Conversions API, with names such as “demo_booked”. The results portal, where clinics see patient results, has no pixel, no ad SDK and no link to Meta, and no event or audience name mentions a test or a condition. This design is fictional; a real company should take legal advice.

Do this

List every event you plan to send to Meta and where it comes from. Mark any page or screen that could show patient information, and keep all ad tags off it.

Step 4: Aim at the buyer, keep claims inside the cleared use, and test the creative

Advantage+ is Meta’s automated setup for sales, app and leads campaigns: a campaign counts as Advantage+ when its budget, audience and placements are all left to Meta’s automation^[20]. I found no peer-reviewed study comparing it with manual campaigns. One measurement firm, Haus, reported that 58% of brands in its clients’ head-to-head tests got a higher incremental return from manual campaigns; those clients spend about $14 million a year on Meta on average^[21]. So treat Meta’s claims about Advantage+ as the platform’s own, and test it against a manual campaign.

In practice, automation needs signal. It works better once you send enough conversion events for it to learn from, and it depends on the creative you give it. When automation chooses the audience, creative becomes your main lever.

Two rules shape a healthcare ad. First, Meta’s Advertising Standards say “ads must not contain content that asserts or implies personal attributes”, including “physical or mental health (including medical conditions)”, and their examples of what ads cannot say include “Do you have diabetes?”^[22]. Speak to the clinic about its practice, not to a person about their health. In late 2021 Meta also announced that, from 19 January 2022, it would remove Detailed Targeting options “referencing causes, organizations, or public figures that relate to health”^[23].

Second, claims stay inside the cleared use. The FDA’s labeling page quotes an appellate court: “Most, if not all advertising, is labeling”^[24]. A device’s intended use “may, for example, be shown by labeling claims, advertising matter, or oral or written statements by such persons or their representatives”^[25]. The FTC says health claims need “competent and reliable scientific evidence”, and its guidance covers “diagnostic tests”^[26]. Do not say “approved”: a 510(k) clearance “does not in any way denote official approval of the device”^[27]. If you opt in to Meta’s AI text generation, which writes variations of your primary text, Meta says advertisers are responsible for previewing AI-generated creative before it runs^[28]; check each variation against the labeling, or leave the feature off.

Test creative one change at a time. Meta’s split testing “ensures no overlap between groups” and asks you to “select only one variable per test”^[29]. Test the idea first (the problem you lead with, the promise, the proof), then the format, then details such as headlines. Keep a log of every test and its result so you build knowledge, not just campaigns. The A/B Test Significance Calculator tells you whether a difference is real.

Example Co., step 4 Fictional

It targets US adults aged 18 and over, lets automation optimize for qualified demos, and tests the idea first. Variant A leads with its message: “Results during the visit, not two days later.” Variant B leads with the workflow: “A fingerstick test, about 12 minutes, in your own clinic.” Image, audience and budget stay the same. Both lines describe the product, and a regulatory lead checks them against the cleared labeling. Meta’s AI text generation stays off, so every line that runs is one the lead approved. The copy is fictional.

Do this

Write down the one variable your next test changes, and check every line of copy against your cleared labeling.

Step 5: Measure with a lift test, then decide how much to spend

Run a test with a control group. Fifteen large experiments at Facebook, with 500 million user-experiment observations, found that methods without a randomized control group “often fail to produce the same effects as the randomized experiments”^[30]. A later study of 663 experiments found that for lower-funnel outcomes such as purchases, the median lift in the experiments was 5%, while non-experimental methods estimated 24% to 64%^[3].

Meta’s Conversion Lift studies split people into “a randomized test group” that sees your ads and a control group that does not; through Meta’s API, access is currently limited and arranged with a Meta representative^[31]. If you cannot run one, hold out a region or a period and compare. My post on incrementality testing for startups explains how.

How much to spend? I know of no independent cost benchmark with a published method, so plan from a test. In practice, set a test budget large enough to produce a few dozen conversions of the event you optimize for, run it for several weeks, and compare the cost per signed customer with what a customer is worth. The Paid Media Budget Allocator and the Unit Economics Calculator help with both.

Example Co., step 5 Fictional

It runs ads in some states and holds out comparable ones for eight weeks. Practices take about 60 days to decide, so it counts signed clinics 60 days later. Its rule: scale only if the test shows extra signed clinics, and only if the cost per extra clinic is below $25,000, one clinic’s yearly revenue. With no lift it changes the idea or stops; if the lift is too costly, it fixes the creative or conversion events first. All fictional.

Do this

Before the next campaign starts, write the result that would make you scale, the result that would make you stop, and how you will measure both.

What changes by stage?

• Pre-seed — Small tests of messages and audiences. Set up the Pixel and the Conversions API from the start, and keep tags away from anything that shows patient information.
• Seed — Send down-funnel events, move to automated campaigns once you have enough conversions, and run a creative test every few weeks. Check ad copy against your cleared labeling.
• Series A–B — Run a Conversion Lift or holdout test each quarter, and set budgets by incremental cost per customer, not attributed return.

What mistakes should I avoid?

• Pixel only. Without the Conversions API, Meta can miss conversions the browser doesn’t report.
• Optimizing for sign-ups. Automation finds more sign-ups, not more customers.
• Testing everything at once. You learn nothing from a test with five changes.
• Trusting attributed return. Use lift tests.
• Ignoring privacy settings. Honor opt-outs and consent.
• Letting ads or tags touch patient data. Speak to the buyer, never imply you know someone’s health, and keep ad tags off any screen that shows patient information.