48 AHPRA Rules Apply to Every Cosmetic Clinic Facebook Ad in 2026

Key Takeaways

AHPRA’s Guidelines for advertising higher risk non-surgical cosmetic procedures contain 48 numbered rules across 9 categories, in force since 2 September 2025
13 of those 48 rules name social media, hashtags, algorithm boosting, or influencer content by name
Rule 9.2 requires social media advertising of these procedures to be tagged as adult content
Maximum penalty per breach: $120,000 for a body corporate, $60,000 for an individual practitioner, up from $10,000 and $5,000 before a 2022 amendment to the National Law
Western Australia did not adopt that 2022 penalty increase; a different maximum still applies there
Rule 5.7 bans 6 separate creative techniques, including emoji reactions on treatment images and lifestyle-style photo settings
AHPRA states it cannot pre-approve or check an ad before it runs, so compliance is only ever tested after a complaint

Forty-eight. That is how many numbered rules sit inside AHPRA’s Guidelines for advertising higher risk non-surgical cosmetic procedures, in force in Australia since 2 September 2025. Thirteen of those 48 name social media directly: hashtags, algorithm boosting, Stories, influencer arrangements. A Facebook or Instagram ad for a cosmetic injectable, dermal filler, or thread lift has to clear every one of them, not just the two rules most clinics already know.

Most clinic marketing teams stop reading after “no testimonials” and “no before/after photos.” Rule 9.2 requires certain ads to be tagged as adult content. Rule 9.3 bans boosting a post toward a vulnerable audience through the platform’s own targeting tools. Rule 5.7 bans six specific things in your creative, including emoji reactions on treatment images.

This guide breaks down the digital-specific rules buried inside the 48, what a breach actually costs, and what it means for your ad account and landing pages.

What Changed on 2 September 2025

AHPRA and the National Boards issued the Guidelines for advertising higher risk non-surgical cosmetic procedures, effective 2 September 2025. They sit on top of the broader Guidelines for advertising a regulated health service and apply to procedures such as cosmetic injectables, dermal fillers, injection lipolysis, and thread lifts, where a registered health practitioner is required.

The document splits into 9 numbered categories, from practitioner responsibility through to targeting people at risk, holding 48 individually numbered rules between them.

The table below carries the full breakdown.

Category	Numbered rules	Covers
1. Practitioner responsibility	5	Duty of care, cost disclosure
2. Titles and claims	8	Registration numbers, specialist claims
3. Testimonials	7	Patient stories, Stories function, liking a review
4. Social media influencers	3	Paid partnerships, ambassador content
5. Images, before/after	8	Editing, consent, emoji reactions
6. Risk, recovery	7	Minimising language, competition prizes
7. Body image	3	Prediction apps, “fix” language
8. Realistic outcomes	3	Timeframes, benefit claims
9. Targeting at-risk people	4	Under-18s, adult content tag, algorithm boosting
Total	48

Takeaway: the 48 rules are not scattered guidance. They are a structured, numbered document, and a Facebook ad campaign is expected to comply with the entire set, not the two or three rules that get repeated in industry Facebook groups.

The Digital-Specific Rules Hiding Inside the 48

Most cosmetic clinic compliance conversations stop at testimonials and before/after photos. The guidelines go further, and several rules exist specifically because of how social media advertising works.

Rule	What it requires	What it means for your Facebook ad
9.2	Ads for these procedures on social media must be tagged adult content	Age-restrict placements and disclose it in your ad settings
9.3	No algorithms, hashtags, or metadata used to reach vulnerable groups	Avoid outcome-optimised targeting and vulnerability-coded hashtags
3.4	A Story counts as advertising, even though it disappears	A 24-hour testimonial Story is still a breach
4.2	The clinic is responsible for an influencer’s content	Every paid partnership post must meet the same 48 rules
5.7	Bans 6 creative techniques, including emojis and lifestyle shots	Strip emoji reactions and pool, bedroom, or beach settings
9.4	Practitioners must consider posting frequency	An always-on, unlimited frequency cap is itself a risk

Rule 9.3 is the one most ad managers have never seen. It bans leveraging a platform’s algorithm, or using hashtags and metadata in targeting fields, to reach people the guidelines consider vulnerable.

Takeaway: 13 of the 48 rules name social media, hashtags, or algorithms directly. They were written with a platform like Facebook in mind, not a print advert.

What a Breach Actually Costs

Advertising penalties under the National Law changed in 2022, before the cosmetic-specific guidelines arrived. AHPRA’s own advertising compliance and enforcement strategy page confirms the increase: the maximum penalty per offence for an individual rose from $5,000 to $60,000, and for a body corporate from $10,000 to $120,000.

Advertiser type	Pre-2022 maximum	Current maximum (per breach)
Individual practitioner	$5,000	$60,000
Body corporate	$10,000	$120,000
Western Australia	Different structure	Not increased in the 2022 amendment

Western Australia is the exception worth knowing about if your clinic operates there. AHPRA states plainly that “in Western Australia the maximum penalty for advertising offences has not increased and different penalties apply.” That is a state-specific divergence most national compliance guides gloss over.

Takeaway: a $120,000 exposure applies per breach, not per campaign. A Facebook ad set with three non-compliant elements is not one problem. It is three.

No Pre-Approval, No Safe Harbour

AHPRA answers this directly in its own FAQ: it “cannot give you advice or an opinion about advertising and cannot check or pre-approve your advertising.” There is no lodgement process and no clearance certificate.

Meta’s own review approves or rejects an ad against Meta’s policies, a separate system that does not check for AHPRA compliance at all. A Meta-approved ad that breaches rule 9.2 or rule 5.7 stays live, spending budget, until a patient, a competitor, or a member of the public complains. Our breakdown of the gap between Meta’s policy and AHPRA’s guidelines covers this in more depth.

Takeaway: a Facebook ad running for three months without a Meta rejection has not been assessed for AHPRA compliance in that time. Nobody at AHPRA has looked at it yet.

What This Means for Your Landing Pages

The 48 rules extend to wherever the click lands. A compliant ad sending traffic to a landing page with a testimonial slider or an unlabelled before/after gallery is still a breach, because the guidelines define advertising broadly enough to cover the whole journey from ad to booking form.

That affects which treatments justify their own dedicated landing page. A generic “cosmetic treatments” page mixing testimonial language with clinical claims carries more risk than individual, category-level pages that stick to what a treatment is and what a consultation covers. Category pages also tend to produce better enquiry quality, since the visitor has already read specific information before submitting a form.

What you can say is narrower than most existing clinic sites assume: practitioner qualifications and registration numbers, what a treatment category involves, and realistic risk and recovery information. What you cannot say is anything implying a specific outcome, or anything borrowing a testimonial’s language.

RockingWeb checks whether your landing pages match what your Facebook ads are now allowed to promise. For clinics rebuilding from scratch, AHPRA-compliant cosmetic clinic website builds bake the 48 rules into the template rather than retrofitting them after a complaint arrives.

Takeaway: the rules follow the click. A compliant ad pointed at a non-compliant landing page is still a breach, and the landing page is usually what gets missed in a self-audit.

A Pre-Flight Checklist Before You Boost Anything

Run through this before a campaign for a higher risk cosmetic procedure goes live:

Age settings: is the ad age-restricted and tagged as adult content, per rule 9.2?
Targeting: does it avoid algorithm-driven or hashtag targeting toward vulnerable groups, per rule 9.3?
Creative: no emoji reactions, lifestyle settings, or sexualised imagery, per rule 5.7?
Testimonials: no patient testimonial, linked Story, or liked review, per rules 3.4 to 3.6?
Landing page: does it avoid testimonials and unlabelled before/after imagery?

Takeaway: five checks cover most of the 48 rules that apply to a live Facebook campaign specifically. The rest govern language and claims across the whole guideline.

FAQ

How many advertising rules apply to a cosmetic clinic’s Facebook ad in Australia?

AHPRA’s Guidelines for advertising higher risk non-surgical cosmetic procedures set out 48 numbered rules across 9 categories, in force since 2 September 2025. They apply to any advertising of a higher risk cosmetic procedure, including a paid Facebook or Instagram ad, on top of the broader Guidelines for advertising a regulated health service.

Does a Facebook ad for a cosmetic injectable need to be tagged as adult content?

Yes, for higher risk non-surgical cosmetic procedures. Rule 9.2 of the guidelines states that advertising of these procedures on social media must be identified as adult content, specifically to prevent young people from accessing it on the platform.

What is the maximum penalty for a non-compliant cosmetic clinic Facebook ad in Australia?

Up to $120,000 per breach for a body corporate and $60,000 per breach for an individual, following a 2022 amendment to the National Law. Western Australia is the exception. Its maximum advertising penalty was not increased in that amendment, and different limits apply there.

Will AHPRA review or pre-approve my Facebook ad before I run it?

No. AHPRA states directly that it cannot give advice or an opinion about advertising and cannot check or pre-approve it before it runs. Compliance is assessed only after a complaint is made, which means a live, spending ad campaign carries the risk until someone reports it.

Get Your Facebook Ads Checked Against All 48 Rules

RockingWeb runs AHPRA-compliant Facebook and Instagram campaigns for Australian cosmetic clinics under ClinicPipeline. We audit existing ad accounts and landing pages against the current 48-rule guideline, flag every breach against the specific rule it falls under, and rebuild campaigns to stay inside them from the first impression.

Talk to RockingWeb about ClinicPipeline

Sources and References

AHPRA - Guidelines for advertising higher risk non-surgical cosmetic procedures, dated 2 September 2025: the 48 numbered rules and 9 categories cited above
AHPRA - FAQ confirming AHPRA cannot pre-approve advertising
AHPRA - the 2022 penalty increase and the Western Australia exception

Related reading: