What You Can't Advertise on Facebook

The two lists you actually need to know

Almost everything you cannot advertise on Facebook and Instagram fits into one of two categories that Meta defines in its Advertising Standards, published on the Transparency Center. The first is Prohibited Content: things that are never allowed, full stop, with no application, no license and no workaround. The second is Restricted Content: things that are allowed, but only if you meet specific conditions or obtain prior authorization from Meta before running the ad.

Getting this distinction right saves a lot of wasted effort. If your product is prohibited, no amount of careful wording or targeting will get it approved. If it is restricted, rejection usually means you skipped a condition, and the fix is procedural: age-gate the audience, add a license, or apply for authorization. Most rejected ads from legitimate businesses fall into the restricted tier, which is good news, because those are solvable rather than dead ends. The trick is knowing which bucket you are in before you spend money, not after a rejection.

The rest of this guide walks through both lists in the order that matters most to a small or mid-sized advertiser, with a dated citation for each category so you can verify it yourself. Meta updates individual policy pages on different dates, so a rule you read about a year ago may have shifted. When in doubt, the Transparency Center is the source of truth, and our broader overview of Facebook ad policies covers how the whole review system fits together.

What is prohibited outright

Prohibited content is the short, hard list. These products and messages are never advertisable, regardless of your licenses, your market, or how you phrase the copy.

A couple of these deserve emphasis. On the drug side, Meta prohibits ads that promote the sale or use of illicit or recreational drugs and other unsafe substances or supplements, and THC or psychoactive cannabis products have no authorization path at all. On the financial side, the prohibited list is specific and worth re-reading if you work in fintech or lending: payday loans, paycheck advances, bail bonds, short-term loans of 90 days or less, penny auctions, binary options, initial coin offerings, and contract-for-difference trading are all banned by name, per Meta's Prohibited Financial Products and Services policy (2025). Legitimate banking, insurance and investment products are not on this list, but they are restricted, which is a different set of rules covered below.

It is worth noticing that two of the six rows are about messaging rather than products. Deceptive business practices and, as a later section covers in detail, asserting personal attributes about the viewer are prohibited no matter what you actually sell. A skincare brand with a perfectly legal product can still land in the prohibited bucket purely through how the ad is written or what image it uses. That is the single most useful thing to internalize early: the two-list model sorts categories of ad, not just categories of merchandise, so reading your own copy and creative against these rules matters as much as checking your product against them.

Restricted content: allowed, but only with conditions

Restricted content is where most advertisers get tripped up, because the product is legal and legitimate but the ad still needs to clear extra hurdles. As of 2025, Meta lists 15 Restricted Goods and Services categories. Here is the full set, with the headline condition for each.

The pattern across the whole table is consistent: a legal product plus a specific gate. The gate is usually one of three things, an age minimum, a license or local-law requirement, or a formal authorization you apply for through Meta. Some categories stack all three. The next sections take the categories that most often affect everyday advertisers and explain exactly what the gate is, because the difference between a restricted category you can clear and one that quietly blocks you is almost always in the fine print of the condition.

Alcohol: age and country, market by market

Alcohol is restricted, not banned. You are allowed to advertise it if you comply with all applicable local laws, industry codes, licenses and approvals, and if you apply Meta's age and country targeting controls. At a minimum, alcohol ads may not target anyone under 18.

The complication is that the minimum age is not universal. The baseline is 18, but several countries set it higher, for example 19 in Canada, 20 in Japan, 21 in the United States and 25 in Sweden, per Meta's Alcohol policy (2024). Beyond age, alcohol advertising is banned outright in roughly 18 countries and regions, including Saudi Arabia, Russia, Thailand and Egypt. Those are examples rather than the complete list, so if you are targeting anywhere outside your home market, confirm both the legal minimum age and whether alcohol ads are permitted at all before you build the campaign. The reason this matters operationally is that a mis-set country or age control does not always throw a loud error; sometimes the ad simply under-delivers because a chunk of your intended audience is ineligible. Getting the country targeting wrong is one of the quieter reasons an alcohol ad silently fails to deliver.

Online gambling: authorization first, and off-limits in Malaysia

Online gambling and games ads carry one of the strictest gates. They are only allowed once your ad account has obtained authorization through the Authorizations and Verifications tab in Meta Business Suite, and you must provide evidence that the gambling activity is appropriately licensed or otherwise lawful in the territory you want to target, per Meta's Online Gambling and Games policy (2026). Meta polices this category tightly because unlicensed betting operators are a persistent source of consumer harm, which is why the evidence bar for licensing sits higher here than for almost any other restricted vertical.

Two details matter. First, the approval is granular: it covers specific URLs in approved territories, and you must declare your intent for each new jurisdiction. A green light in one market does not carry over to the next country or a new landing-page URL, both of which need fresh approval. The minimum age is 18 everywhere. Second, and important for advertisers in Southeast Asia, some markets are simply unsupported. Malaysia is one of roughly 18 unsupported markets where online gambling and gaming ads cannot run at all, alongside Singapore, Indonesia, Thailand, Vietnam and the Philippines. In an unsupported market, no authorization exists that will unlock the category, so a Malaysian advertiser cannot run these ads regardless of licensing.

Financial, insurance and crypto: licensed, authorized, age-gated

Not every money-related ad is banned. Genuine banking, insurance, and investment products that sit outside the prohibited list can all be advertised, but they live in the restricted tier with their own conditions. Financial and insurance products and services must be targeted to people 18 and older, and you are expected to hold the appropriate licenses and comply with the local laws of every market you run in. The prohibited items covered earlier, payday loans, paycheck advances, bail bonds, short-term loans of 90 days or less, binary options, ICOs and contract-for-difference trading, are carved out of this and can never run, so the first job is to confirm your product is not on that list before you worry about the restricted-tier conditions.

Cryptocurrency products and services sit in their own restricted category and are treated more cautiously still. In practice they typically require prior written authorization from Meta before any ad can run, on top of the usual licensing and local-law expectations. If you promote an exchange, a wallet or a token, assume you will need to apply through Authorizations and Verifications and be ready to document that the offering is lawful where you target. Because crypto eligibility and the list of qualifying countries change, treat this category as one to re-verify on the Transparency Center before every new campaign rather than something you configure once and forget.

Drugs and pharmaceuticals: OTC versus prescription

Meta draws a sharp line between over-the-counter and prescription medicine. Over-the-counter medicine is allowed with conditions and no prior authorization: the ad must comply with applicable local laws and industry codes, which in Malaysia means KKLIU approval for medicine ads, and it must not be targeted to people under 18. That covers the everyday pharmacy products most retailers actually sell. The distinction hinges on how the product is dispensed rather than what it treats, so an off-the-shelf remedy and a version of the same active ingredient that sits behind a pharmacist's counter can land on opposite sides of the line.

Prescription drugs are a different matter. They may only be advertised with prior written authorization from Meta and an active LegitScript certification, and even then the permission is limited to the United States, Canada and New Zealand, targeted to people 18 and older, per Meta's Drugs and Pharmaceuticals policy (2025). Outside those three countries, prescription-drug advertising is not available. A related restricted category, drug and alcohol addiction treatment, carries its own conditions and, in some regions, its own authorization step, so treatment providers should not assume the OTC rules apply to them. And the outright prohibitions still apply on top: ads must not promote the sale or use of illicit or recreational drugs, unsafe substances, or unsafe supplements, and THC or psychoactive cannabis products remain banned with no authorization path.

Health, weight-loss and cosmetics: the SMB minefield

More legitimate small-business ads die in the Health and Wellness category than almost anywhere else, and it is the daily reality for clinic and aesthetic advertisers in Malaysia, so it is worth slowing down here. The category is restricted, which means the products are fine to sell but the ads carry strict rules, and Meta last updated the policy on 26 December 2024.

Three rules cause most rejections. First, ads promoting or marketing dietary, health or weight-loss products, and cosmetic products, procedures or surgeries, must be targeted to people at least 18 years or older. If your audience is not age-gated, the ad fails before anyone reads the copy. Second, transformation imagery is prohibited: side-by-side comparisons showing a body after using a product, close-ups that pinch fat to highlight a body area, and side-by-side wrinkle or anti-aging transformations for treatments like Botox or dermal fillers. Our deeper guide on before-and-after ads walks through what you can show instead. Third, ads must not imply or attempt to generate negative self-perception, and must not declare there is a perfect body type or appearance one should aspire to.

The practical fix is to change what the creative sells. Show the product, the ingredients, the routine or the lifestyle rather than a person's body being compared against itself. Replace guaranteed outcomes with supportive language, for example "formulated to support" rather than "melts fat in a week." Absolute and exaggerated claims do not just weaken the health category, they also trigger the separate deceptive-practices rules discussed below. If a health ad of yours has already been rejected, our checklist on what to do when a Facebook ad is rejected covers the appeal and rebuild process.

Personal attributes: do not tell people who they are

One of the most misunderstood rules is the Personal Attributes policy, last updated 26 June 2024. Ads must not assert or imply personal attributes about the person viewing them. The protected list is long: race, ethnicity, religion, age, sexual orientation or practices, gender identity, disability, physical or mental health, vulnerable financial status, criminal record, trade-union membership, and a person's name.

The trap is that this applies to phrasing, not just targeting. Copy such as "Struggling with diabetes?", "Are you over 50 and in debt?", or "As a single mother, you deserve this" can be read as asserting the viewer has that attribute, and that is enough to get the ad rejected even when the product is perfectly legitimate. The reliable fix is to describe the product rather than the person. "A supplement designed for blood-sugar support" is safe, while "Fix your diabetes" is not. "Debt-consolidation options" is safe, while "You're drowning in debt" is not. Our dedicated breakdown of the personal attributes policy has more examples of compliant rewrites, and the shift is almost always from second-person accusation to third-person description.

Deceptive claims and the whole-experience review

A large share of prohibitions live under Unacceptable Business Practices, which Meta treats as fraud and updated most recently in 2026. Ads must not use deceptive or exaggerated claims about a product's success to mislead people, must not pair a famous person's image with misleading tactics to bait engagement, and must not promise financial benefits by misrepresenting an entity, an industry association, or a news outlet. Fake endorsements, invented press logos, and "as seen on" claims you cannot back up all fall here. The underlying principle is that an ad should not promise an outcome the product cannot reliably deliver, and Meta reads success claims strictly, which is why cautious, qualified language survives review far more often than bold guarantees.

Crucially, Meta reviews the whole ad experience, not just the creative. That means your Facebook Page, the ad itself, and the landing page you send people to are all in scope. A compliant ad with a non-compliant destination still gets rejected. The usual landing-page offenders are unclear or hidden pricing, fake countdown timers that reset on refresh, fabricated reviews or testimonials, and a claim mismatch where the page promises something the ad did not, or vice versa. Before you launch, click your own funnel as a stranger would: confirm the price is visible, any urgency is genuine, the testimonials are real, and the offer on the page matches the offer in the ad. Subscription and auto-renewal terms should be stated plainly too; while Meta does not name negative-option billing as its own category, hiding a recurring charge reads as a deceptive practice.

How to get authorized and stay compliant

Several restricted categories, gambling, prescription drugs, cryptocurrency, dating and certain financial products, require you to apply for authorization before you can run anything. You do this through the Authorizations and Verifications tab in Meta Business Suite, where you submit evidence of licensing or certification appropriate to the category and territory. Approvals can be narrow, as with gambling's per-territory and per-URL model, so plan for a separate application each time you enter a new market. Build that lead time into your launch calendar; a category that needs authorization is not something you can spin up the night before a sale.

For everyday advertisers who are not in a heavily gated vertical, compliance comes down to a short discipline you can apply to every ad:

None of this is exotic. Most rejections come from a handful of repeat mistakes, and once you internalize the two-tier structure, you can usually predict a rejection before you hit publish. If you run a lot of creative, keeping your research, generation and review in one place helps you catch policy problems early, and a platform like AdPlay.ai keeps research, generation and launch together so compliance is not an afterthought. Whatever your workflow, the discipline is the same, and the foundational walkthrough in how to run a Facebook ad puts these rules in the context of a full campaign.

A note on AI-generated creative

One area worth flagging honestly is AI-generated content. There is a lot of secondary commentary suggesting Meta requires a hard "Made with AI" disclosure on ads, but the Advertising Standards introduction does not contain an explicit AI-disclosure clause, and the exact scope, whether it is mandatory for ads specifically, and any effective date could not be confirmed from a primary Meta policy page. What is documented elsewhere is that Meta applies automatic labelling to some AI-generated creative and offers disclosure controls in its tools. Rather than treat a firm rule as settled, verify the current requirement directly in the Transparency Center before you rely on it, and see our separate discussion of the Made with AI label on Meta ads for where things stand. The safe default is straightforward: if your creative is AI-generated, be ready to disclose it, and never let AI production tempt you into claims or imagery that the policies above already prohibit.

The bigger picture is that Meta's rules are not arbitrary once you see the structure. Two lists, prohibited and restricted, cover almost everything. Learn which bucket your product sits in, satisfy the gate if it is restricted, keep your claims honest and your funnel clean, and the overwhelming majority of your ads will clear review the first time.