AHPRA's Adult Content Rule: What It Means for Your Build

Key Takeaways

• AHPRA’s advertising guideline for higher-risk non-surgical cosmetic procedures took effect 2 September 2025
• Higher-risk procedures advertised on social media must be classified as adult content, so platform controls stop under-18 audiences seeing the ad
• The requirement sits on the advertisement, not the landing page. There is no website-level age gate mandated by the guideline text
• AHPRA’s information sheet names injectables, thread lifts, PRP, lipolysis, hair transplants, and veneers as higher-risk examples
• The build consequence is ad account audience settings and page copy, not a popup or interstitial
• AHPRA investigated about 360 notifications on non-surgical cosmetic procedures between September 2022 and March 2025, closing around 300
• National Law maximum penalties for a breach of the advertising provisions sit at $60,000 for an individual and $120,000 for a body corporate

Since 2 September 2025, AHPRA’s guideline for advertising higher-risk non-surgical cosmetic procedures has required that when one of those procedures is advertised on a social media platform, the advertisement is classified as adult content so under-18 audiences cannot see it. That sits on the advertisement itself, not on the web page the ad links to. If your clinic runs Meta or TikTok ads for injectables, thread lifts, or a similar procedure, the setting that matters is in the ad account’s audience controls, and the check that matters on your site is whether the page copy and structure give that ad something sensible to point at.

Most clinics hear “adult content” and picture a website popup asking visitors to confirm their age, the kind gambling and alcohol sites use. That is not what AHPRA asked for. This post reports what the guideline says, what changes in the ad account versus what changes on the page, and how to check your own setup against it.

What AHPRA’s Guideline Says

The relevant document is AHPRA’s Guidelines for advertising higher risk non-surgical cosmetic procedures, published alongside the separate performance guideline and in effect from 2 September 2025. Two provisions matter for this post, and they are not the same obligation.

First, advertising of higher-risk non-surgical cosmetic procedures must not target, or be directed at, people under 18, and must not appear in publications or media likely to have a significant under-18 audience. This is an audience-targeting restriction.

Second, when that advertising runs on a social media platform, it must be identified as adult content, specifically so young people are prevented from accessing it through the platform’s own controls. This is a content classification requirement layered on top of the targeting restriction, and it is scoped to higher-risk procedures on social media, not to every cosmetic advertisement everywhere.

AHPRA’s accompanying information sheet on visual examples names the procedures the higher-risk category covers: cosmetic injectables (both anti-wrinkle injections and dermal fillers), thread lifts, platelet-rich plasma (PRP) treatments, lipolysis or fat-dissolving injections, hair transplants, and veneers. Skin needling, LED treatments, and general facials are not on that list.

AHPRA is not a quiet regulator on this topic. Between September 2022 and March 2025, it investigated about 360 notifications concerning non-surgical cosmetic procedures and closed around 300 of them, alongside more than 1,500 calls to its dedicated cosmetic surgery hotline in the same period.

That volume is general context for how active this regulator is in the category, not evidence tied to the adult content classification requirement specifically. Keep the two separate; the next section does.

Takeaway: the guideline asks for two things, an under-18 targeting ban and, on social platforms only, an adult content classification. Neither one is written as a website requirement.

What That Means for the Build

There is no field, form, or markup change AHPRA’s guideline asks for on the website itself, and pretending otherwise is how a clinic ends up building an age-verification modal that satisfies nobody and blocks search crawlers. The real work sits in three places.

Ad account audience settings. Meta, TikTok, and Google Ads each carry a minimum age setting and an under-18 exclusion at the ad set or ad group level, standard features that have existed for years. Setting the minimum age on the ad set carrying a higher-risk procedure to 18, and confirming the platform’s own sensitive content classification is applied at ad review, is the mechanism available to satisfy AHPRA’s stated outcome of keeping the advertisement away from under-18 viewers. AHPRA does not mandate a specific platform toggle by name; it states the outcome and leaves the platform’s own controls to deliver it.

Page structure. Each higher-risk procedure needs its own indexable, ad-linkable page rather than being folded into a general “treatments” page. That is not a legal requirement in the guideline text, but it is what makes the audience restriction meaningful. If the ad for dermal filler links to a page that also markets skin needling and facials to a general audience, the classification on the ad does nothing for the page’s exposure through organic search or social sharing.

Copy audit. The under-18 targeting ban is broader than any ad platform setting can catch. A procedure page’s headline, meta description, and body copy should not use language with significant under-18 appeal, formal season, schoolies, or “before you turn 18” framing occasionally shows up on clinic sites chasing a seasonal keyword. That is a text problem, checked by reading the page.

Tracking hygiene. If a higher-risk procedure page carries a Meta Pixel or similar tag for remarketing, that page’s visitor list feeds audiences back into an ad account for content AHPRA has classified as adult content. Confirm the remarketing audience built from that page inherits the same age exclusion as the original ad, rather than reopening the under-18 exposure a step removed.

Takeaway: the setting lives in the ad account, the structure and copy live on the page, and neither one is a popup.

Which of Your Pages Carry the Obligation

Use this against your own site map before your ad account, because it tells you which pages need the copy audit and which ad sets need the age exclusion checked.

A Worked Example

A cosmetic clinic ran Meta ads to its dermal filler landing page, which also carried a paragraph promoting the clinic’s general facial treatments and a seasonal banner mentioning “formal season specials.” The ad set had no minimum age set, inheriting Meta’s account default rather than an explicit 18-and-over restriction, and the pixel on that page fed a remarketing audience used across the account, including the facials campaign, which had no age restriction at all.

Two things changed. The dermal filler ad set got an explicit 18-and-over minimum age, confirmed against Meta’s sensitive content classification at ad review. The landing page was split: dermal filler content stayed on its own URL with the facials paragraph and the formal season banner removed, and facials moved to a separate page with its own remarketing audience that never touches the filler campaign’s list. Nothing about the appointment booking changed. The fix sat in how the ad account and the page were separated from each other.

What to Check on Your Own Site

1. List every page advertising a procedure from the higher-risk table above.
2. For each one, open the ad set or ad group serving it and confirm a minimum age of 18 is set, not the platform default.
3. Read the page copy for language with obvious under-18 appeal: school, formal, schoolies, “before you turn 18,” birthday-tied offers.
4. Check whether the page also markets a lower-risk treatment in the same block of copy, which drags a general audience into content built for a restricted ad.
5. Confirm the pixel or tag on that page feeds a remarketing audience that inherits the same age exclusion, not the account-wide default list.
6. Get a second read from your marketing account manager if you use one, since the ad-side settings sit in a system this website content check cannot see.

Get in touch and RockingWeb will walk your procedure pages the way a patient or a regulator would and report which ones carry this obligation, with each finding mapped to the specific rule.

The Enforcement Anchor

There is no published AHPRA determination or infringement notice naming the adult content classification requirement specifically. The guideline took effect less than a year before this post was published, and the gap between a notification being opened and a disciplinary outcome being published typically runs well past that.

What is published is the enforcement architecture the rule sits inside. Advertising a regulated health service in a way that is false, misleading, or deceptive, or that breaches an approved advertising guideline, is an offence under section 133 of the Health Practitioner Regulation National Law, carrying maximum penalties of $60,000 for an individual and $120,000 for a body corporate per breach. Some marketing commentary circulates lower figures around $30,000 and $60,000; the legislation itself is the source to check, and the maxima above are what section 133 states.

Beyond the statutory penalty, AHPRA and the relevant National Board can act through the notification and disciplinary process directly: conditions on registration, mandated further education, a reprimand recorded on the public register, suspension, or in serious cases cancellation. Those powers apply to the practitioner’s conduct generally and are not contingent on a court prosecution ever happening.

Takeaway: no case has been published against this specific rule yet, but the penalty and disciplinary machinery it sits inside is real, current, and already used against cosmetic advertising more broadly.

Where This Gets Hard

The guideline’s own wording, “identified as adult content,” borrows a phrase from platform content policy without defining one technical mechanism a clinic can point to and call done. A setting that satisfies Meta’s ad review does not automatically satisfy TikTok’s. A clinic running ads across three platforms is checking three different interfaces against one sentence of regulatory text.

There is also a genuine question about pages that were never built as ad landing pages at all. A dermal filler page that only ranks organically and has never carried a paid ad has no advertisement to classify, so the guideline’s adult content requirement, read narrowly, does not reach it. Whether AHPRA would treat organic social sharing of that page, or a Google Business Profile post linking to it, as advertising for this purpose is not settled by anything published.

The regulator says higher-risk procedure advertising on social media must be identified as adult content so under-18 audiences cannot access it; the build consequence is an explicit minimum age setting on the relevant ad set and a page structure that keeps restricted content away from general-audience copy; whether your particular ad and page arrangement satisfies that requirement in your circumstances is a question for your medical defence organisation or your lawyer.

Status

In force since 2 September 2025. This is a current, commenced guideline, not a proposal and not pending a start date, as at 14 August 2026. The separate under-18 booking cooling-off obligation and the Online Safety Amendment social media minimum age provisions are different regimes and are not the basis for anything stated in this post.

Frequently Asked Questions

Does the adult content rule mean I need an age verification popup on my website?

No. AHPRA’s guideline requires the advertisement of a higher-risk procedure to be classified as adult content on the social media platform it runs on, not the landing page it points to. Nothing in the guideline text requires a website-level age gate, interstitial, or verification step. A practice can choose to add one for its own reasons, but it is not what this rule asks for.

Which procedures count as higher risk under AHPRA’s advertising guideline?

AHPRA’s information sheet on advertising higher-risk non-surgical cosmetic procedures names cosmetic injectables (anti-wrinkle injections and dermal fillers), thread lifts, platelet-rich plasma treatments, lipolysis or fat-dissolving injections, hair transplants, and veneers as examples. Skin needling, LED therapy, and general facials sit outside this list.

Does the under-18 targeting ban apply to all cosmetic advertising or only higher-risk procedures?

AHPRA’s guideline states that advertising of higher-risk non-surgical cosmetic procedures must not target people under 18 or appear in media likely to have a significant under-18 audience. The adult content classification requirement sits alongside this and applies specifically when that advertising runs on a social media platform.

Where does this rule turn into a setting rather than a sentence in a policy?

In the ad platform, not the website’s code. Meta, TikTok, and Google Ads each let an advertiser set a minimum audience age and exclude under-18 segments at the ad set or ad group level. That is the mechanism available to satisfy AHPRA’s stated outcome of keeping the advertisement away from under-18 viewers.

Has AHPRA taken action against a clinic for breaching the adult content rule specifically?

Not that is published as at 14 August 2026. The rule took effect 2 September 2025, and AHPRA’s disciplinary and prosecution pipeline runs on a lag from notification to outcome. What is published is the general enforcement architecture the rule sits inside, covered in the enforcement section above.

Sources

1. AHPRA - Guidelines for advertising higher risk non-surgical cosmetic procedures. In effect 2 September 2025. Checked 14 August 2026.
2. AHPRA - Booming billion-dollar cosmetic industry on notice with new cosmetic procedures guidelines, 3 June 2025 (notification and hotline volumes, September 2022 to March 2025). Checked 14 August 2026.
3. AustLII - Health Practitioner Regulation National Law, section 133, Advertising. Checked 14 August 2026.

Last reviewed: 14 August 2026.