AHPRA Advertising Compliance Audit Checklist 2026: 12 Points Every Cosmetic Clinic Must Check

Key Takeaways

• AHPRA’s advertising guidelines apply to all advertising by regulated health services — paid ads, organic social, website, email, and directory listings
• 12 audit points cover every channel where non-compliant content commonly appears
• Before/after images and testimonials must be removed from every channel, not just paid ads
• Penalties for non-compliance start at $30,000 per individual practitioner and $60,000 per corporate entity
• The most commonly missed non-compliant content is on landing pages and the website (not the ad itself)
• Google Business Profile reviews referencing clinical outcomes are the hardest to control — but you must not solicit them
• Running a compliant audit takes 3–6 hours for a clinic with typical digital presence across 4–6 channels

The September 2025 amendments to AHPRA’s advertising guidelines removed a lot of grey area that clinics had previously used to justify borderline content.

Before/after images: banned. Full stop. Not “banned if they create unrealistic expectations” — banned.

Testimonials: banned. Not “banned unless they accurately describe the result” — banned.

The clarity is actually helpful. The problem is that most cosmetic clinic marketing managers and business owners have not audited all their channels since the change took effect. The checklist below gives you a systematic way to do that before AHPRA does it for you.

Audit Point 1: Google Ads — All Active Ad Copy

What to check:

• All active responsive search ads across every campaign
• All ad extensions: callout extensions, sitelink descriptions, location extensions with any descriptive text
• All Performance Max asset groups: headlines, descriptions, and any image or video assets
• All active ad copy in paused campaigns (pause does not equal inactive if you reactivate)

Remove if present:

• Testimonial language in any form (“patients love”, “clients say”, “as reviewed by”)
• Before/after references (“transform your look”, “see the difference”)
• Specific substance names for TGA-regulated treatments
• Superiority claims (“Perth’s leading”, “best results”, “most advanced technique”)

Safe format: Treatment category + consultation booking CTA. “Anti-wrinkle consultations in Perth. Book with our accredited practitioners.”

Audit Point 2: Meta Ads — All Active and Paused Ad Sets

What to check:

• All active ad sets across Facebook and Instagram
• All creative assets: images, videos, carousels, Reels used in paid promotion
• All boosted posts (boosting a post makes it advertising under the guidelines)
• All creative in draft or paused status — these get reactivated without review

Remove if present:

• Before/after images in any placement (including carousel slides)
• Patient video testimonials
• Patient-generated content used in ads
• Copy referencing specific scheduled substance names
• “Transformation” language that implies specific clinical outcomes

Add to process: A pre-flight review for any new Meta creative before it runs, against this checklist.

Audit Point 3: Website — All Service Pages

What to check:

• Every service page for every treatment category you offer
• Any page that receives paid traffic (check your Google Ads and Meta Ads destination URLs)
• Pages linked from any active ad or social post

Remove if present:

• Before/after patient images
• Patient testimonials or review excerpts
• Star ratings attributed to individual patient experiences
• Specific trade names of TGA-regulated treatment substances in promotional context
• Outcome claims (“achieve X result”, “typical results include Y”)
• Superiority claims (“Perth’s most experienced”, “only clinic in WA with”)

Common miss: A landing page built in 2024 that still has a “patient results” gallery section. If paid traffic goes to that page, the ad campaign is non-compliant even if the ad copy itself is clean.

Audit Point 4: Website — Home Page

What to check:

• Hero section and above-fold content
• Testimonial sliders or review carousels
• “Results” or “gallery” sections
• Any video on the home page showing patient content

Remove if present:

• Any patient imagery showing clinical results
• Any testimonial text, video, or star rating from patients
• Before/after image pairs in any format

What can stay: Clinic and team photography, practitioner credential statements, general value propositions about the consultation experience.

Audit Point 5: Website — Blog and Educational Content

What to check:

• All published blog posts and articles
• Any post that includes patient stories, case studies, or “patient journey” content
• Posts that include before/after images for educational purposes

The rule: Educational intent does not exempt content from the advertising guidelines if it promotes a regulated health service. A blog post that functions as advertising (and most clinic blog posts do) must comply.

Remove if present:

• Before/after patient images used to illustrate educational points
• Named or anonymised patient case studies with clinical outcome descriptions
• Testimonial excerpts embedded in articles

What can stay: General educational content about treatment categories, practitioner information, clinic news without clinical outcome references.

Audit Point 6: Instagram — All Posts and Highlights

What to check:

• Your last 24 months of Instagram posts
• All active Highlights (these persist and constitute advertising)
• Reels and video content
• Stories saved as Highlights
• Tagged posts where your clinic is tagged (you cannot always remove these but should not actively promote them)

Remove or archive if present:

• Before/after image posts
• Video posts showing clinical results
• Patient testimonials in captions (“Tag a friend who needs this”, “This client wanted X and we delivered Y”)
• Any content naming specific scheduled substances in promotional context

The time cost: Reviewing 24 months of Instagram content for a typical cosmetic clinic with 3–5 posts per week is approximately 4–8 hours. This is unavoidable if the account has not been audited.

Audit Point 7: Facebook Page — Posts and Pinned Content

What to check:

• Posts with high reach or engagement that may have been boosted
• Pinned posts (common location for before/after or testimonial content)
• Facebook Reviews section settings
• The About section for any restricted claims

Remove if present:

• Non-compliant pinned posts
• Posts with before/after imagery
• Posts soliciting testimonial-style reviews

Note on Facebook Reviews: You cannot remove legitimate patient reviews from your Facebook page. However, you cannot solicit reviews that describe clinical outcomes. Disable the Reviews tab only if the reviews on it are systematically non-compliant and you cannot address individual posts.

Audit Point 8: Google Business Profile

What to check:

• Your photo gallery (remove any patient imagery showing clinical results)
• Recent posts (same rules as advertising — remove non-compliant content)
• Your business description
• The Q&A section

Remove if present:

• Before/after patient photos in the gallery
• Posts referencing clinical outcomes or specific substances
• Business descriptions with superiority claims

The review problem: Google reviews cannot be removed by the business owner (only by Google, for policy violations). You cannot actively solicit reviews that describe clinical outcomes. If you have reviews describing specific results (“I got X and my wrinkles disappeared”), you should seek legal advice on whether those reviews constitute advertising by the clinic.

Audit Point 9: Email Marketing — All Active Templates

What to check:

• All active automated email sequences (welcome, nurture, reactivation)
• Broadcast email templates
• Any email that includes before/after imagery or testimonial content

The grey area: Email to existing patients about their own care is generally clinical communication, not advertising. Email to an opt-in marketing list promoting treatments is advertising and must comply.

Remove if present:

• Before/after images in marketing email templates
• Patient testimonial quotes in promotional emails
• Promotional language naming specific scheduled substances

What can stay: Educational content about treatment categories, clinic news, reactivation prompts focused on the consultation (“It has been 12 months since your last consultation — book a review”).

Audit Point 10: Third-Party Directories and Listings

What to check:

• Health Engine profile
• Yelp business listing
• True Local
• Any cosmetic or health-specific directory you are listed in
• Any PR or media mentions where you can control the content

The challenge: Third-party content you do not control does not fall under your compliance obligation in the same way your own content does. However, content you submit to directories does.

Remove or update if present:

• Before/after images submitted to directory profiles
• Testimonial quotes included in your directory listings
• Claims that would be non-compliant in your own advertising

Audit Point 11: Review Solicitation Process

What to check:

• Any automated or manual process for requesting reviews from patients
• Any review request templates (SMS, email, in-clinic card)

The rule: You cannot solicit testimonials — including reviews that describe clinical outcomes. You can invite patients to leave a review about their experience of the clinic, the consultation process, and the staff — but not about their clinical results.

Update if non-compliant:

• “Please share your transformation story” → Remove
• “Tell others how your treatment went” → Remove
• “Rate your experience with our clinic and team” → Compliant (general service, not clinical outcome)

Audit Point 12: Staff Social Media and Practitioner Personal Accounts

What to check:

• Instagram accounts of practitioners who identify as working at your clinic
• Any social content that functions as advertising for the clinic’s services

The rule: The guidelines apply to advertising by registered health practitioners, not just the business entity. A practitioner posting before/after images on their personal Instagram account with their clinic mentioned in their bio may be in breach — and the practitioner is personally liable.

Action if non-compliant:

• Brief your practitioners on the guidelines and their personal liability
• Request removal of non-compliant content from practitioner personal accounts
• Establish a policy for practitioner social media that aligns with clinic compliance

After the Audit: What to Do With What You Find

Non-compliant content found: Remove or archive it before running any new advertising. Do not leave non-compliant content live and run compliant ads — AHPRA reviews advertising holistically.

Uncertain about specific content: Seek legal advice from a health law solicitor familiar with the National Law advertising provisions. AHPRA also publishes guidance and accepts compliance enquiries through their advertising enquiry process.

Content removed but still indexed: Content removed from your website may still appear in Google’s cache or in archived versions. This is not your immediate liability, but if an AHPRA investigation is underway, document the removal date.

Set up an ongoing compliance review: The guidelines can change. New advertising channels create new compliance questions. Build a quarterly review of all advertising channels into your business operations.

Need a Compliance Audit Done For You?

ClinicPipeline by RockingWeb includes a full AHPRA compliance audit as part of every new client onboarding. We review every channel against the September 2025 guidelines, produce a written report of what needs to change, and rebuild your marketing on a compliant foundation.

Book your free compliance consultation — we cover the full audit scope above, tell you exactly what needs to change, and give you a plan.