Aesthetic before-and-after photo compliance guide — FTC, state medical boards and HIPAA

FTC 16 CFR §255 — substantiation, typicality and material connection

The 2023 revision of the FTC Endorsement Guides was the most significant update to the endorsement framework since 2009. Three practical shifts matter for before-and-after imagery specifically.

Substantiation must exist at the moment of publication

A before-and-after photo is an implicit performance claim. Under 16 CFR §255.2, an advertiser must have a reasonable basis for the claim at the moment the advertisement is published. In aesthetics, the reasonable basis is the underlying clinical documentation for the depicted patient: the treatment plan, the dated pre-treatment photograph, the dated post-treatment photograph, the injector or surgeon of record, and any objective measurement (before-after ruler in the frame, standardised lighting, clinical scoring). "We think this outcome looks good" is not substantiation; a substantiation dossier is.

Typicality is measured by consumer expectation

Under §255.2(b), if a depicted result is not what consumers can generally expect from the advertised service, the advertisement must clearly and conspicuously disclose the generally expected performance. "Individual results vary" alone is not sufficient when the depicted result is dramatically atypical; the disclosure must give the consumer a fair sense of what is typical. In aesthetics, that means a phrasing such as "Results shown are individual; typical outcome ranges vary — book a consultation for a personalised expectation" rather than a bare disclaimer.

Material connection covers staff, influencers, family, discount

Under §255.5, any connection between the endorser and the seller that could materially affect the weight or credibility of the endorsement must be disclosed. In an aesthetic practice, material connections include: the endorser is a member of staff or the medical director, the endorser received free or discounted treatment, the endorser is a spouse or family member of an owner or provider, the endorser is a paid social-media influencer, or the endorser is a referring provider. Each of these is disclosable. A photograph of a staff-member patient with no disclosure of the employment relationship is a violation even if the outcome is truthful.

Clear-and-conspicuous on social and short-form video

The 2023 revision emphasised that "clear and conspicuous" must be measured on the actual surface. A disclosure that is legible in a magazine ad is not automatically clear-and-conspicuous in a fifteen-second Instagram Reel. Text disclosures on video must appear for a duration a viewer can actually read; audio disclosures must be paced to be understood; and disclosures cannot be hidden behind a "more" click, buried below the fold, or lost in a caption a viewer must expand to see. In practice, a burned-in on-screen disclosure that appears for at least three seconds is the operational minimum for short-form video.

HIPAA marketing authorisation for photographic imagery

Under the HIPAA Privacy Rule, a photograph of an identifiable patient is Protected Health Information. Using or disclosing PHI for marketing requires a written authorisation under 45 CFR 164.508. The general treatment consent signed at intake does not cover marketing — that is a separate document, and its specific content is prescribed by regulation.

What the authorisation must contain

A valid HIPAA marketing authorisation for a before-and-after image must contain: a specific and meaningful description of the information to be used or disclosed (the specific image or set of images, dated), the name of the person or class of persons authorised to use or disclose (the practice and its marketing agency by name), the name of the recipient (the practice and each downstream media surface by category), a description of each purpose (marketing on website, social media, print), an expiration date or event, a statement of the individual's right to revoke, a statement that PHI once disclosed may be re-disclosed and no longer protected, a statement that the practice may not condition treatment or payment on the authorisation, and the signature and date of the individual.

Financial-remuneration disclosure

If the practice receives direct or indirect financial remuneration from a third party in exchange for making the communication (for example, a device manufacturer paying for a testimonial campaign), the authorisation must state so on its face. This is the Omnibus Rule addition and it is treated seriously in enforcement.

Revocation

The authorisation must be revocable in writing. Practices must have an operational process for handling revocations: pulling the image from active use within a defined timeframe, notifying downstream vendors, and documenting the revocation in the patient's record. Revocation does not undo distribution that has already occurred, but it does bar future use.

Anatomy of a defensible before-and-after release form

Every aesthetic practice should have a documented release form for photographic marketing use. A defensible release has eleven sections. It is not a legal document you download once and forget — it is a living instrument reviewed annually against current FTC, state board and HIPAA guidance.

• Section 1 — patient identification and treatment context. Full name, date, provider of record, procedure(s) performed, and the specific dates the before and after images were captured.
• Section 2 — image inventory. Each image identified by file name or reference number, with a thumbnail preview attached. Blanket "any images" language is not compliant; the images must be specifically identified.
• Section 3 — purpose of use. Marketing generally is not enough. Specify: website (the practice's own domains), social media (Meta, Instagram, TikTok, X, YouTube by name), paid advertising (Google Ads, Meta Ads, TikTok Ads by name), print, out-of-home, editorial pitches, industry conferences.
• Section 4 — geographic and durational scope. Duration in years (typically two to five) with an explicit expiration date. Territory (typically United States, or United States and social-media global reach where applicable).
• Section 5 — retouching and editing scope. A statement that images may be adjusted for lighting normalisation, cropping and consistent framing, but not to alter the depicted clinical outcome.
• Section 6 — financial-remuneration disclosure. Whether the patient is receiving any consideration (free treatment, discount, cash payment) in exchange for the use, and whether any third party is paying the practice to run the campaign.
• Section 7 — revocation process. Right to revoke in writing, mechanism (email to a specific address, mail to a specific person), and the practice's operational timeframe for pulling the image once revoked.
• Section 8 — re-disclosure statement. Once the image is distributed on public platforms, third parties may re-share it and it is no longer protected by HIPAA in the hands of those third parties.
• Section 9 — no-conditioning statement. The practice may not condition treatment or payment on signing the authorisation. This is a specific HIPAA requirement.
• Section 10 — signature block. Patient signature and date; witness signature if used; e-signature audit trail reference if electronic.
• Section 11 — file retention pointer. Reference number linking the authorisation to the underlying substantiation file, the treatment record, and the ad-file archive.

Google Ads, Meta Ads and TikTok Ads — before-and-after photo policy

Platform policies sit on top of federal and state rules and can independently disqualify a compliant ad from running. The three ad platforms most used in US aesthetic marketing each treat before-and-after imagery slightly differently.

Google Ads

Google's Healthcare and Medicines policy restricts certain aesthetic categories, and its Personalised Advertising policy limits categorised targeting on health conditions. Before-and-after imagery is not per se prohibited but is scrutinised for shock-value framing, unrealistic outcome portrayal, and comparative superiority. Landing-page substantiation must match the ad; a "results in one visit" claim in the ad copy with substantiation only for multi-visit protocols will trigger disapproval.

Meta Ads

Meta's Cosmetic Procedures and Weight Loss policy is stricter than Google's on aesthetics. Meta has periodically prohibited certain before-and-after formats — split-screen dramatisations, zoomed-in body-part imagery presented in a way that "implies dissatisfaction" — and limits targeting on health-condition attributes. Personal Attributes rules bar assertion or implication that Meta knows a specific user's health condition; an ad that says "you have wrinkles, we can help" is a violation regardless of the underlying photo.

TikTok Ads

TikTok's Cosmetic Procedures policy varies by country and account status. Certain aesthetic categories are permitted only for verified providers, and before-and-after imagery must include age-gating in some jurisdictions. The platform's Community Guidelines prohibit graphic surgical footage; aesthetic before-and-after content must be non-graphic and non-clinical in tone.

Where photo compliance sits in the wider stack

Before-and-after photography clears a federal envelope — HIPAA, FTC, ADA, TCPA (if the campaign uses SMS or voice) and CAN-SPAM (if it uses email) — plus the state medical board layer and platform policy. Pricing for an outsourced compliance review of a photo library varies with volume: a targeted 25-asset audit typically prices from $2,500-$5,000, and a full aesthetic-practice photo-compliance retrofit from $10,000-$25,000 depending on the state, the platforms in use, and the retroactive consent work required. Ongoing retainers for aesthetic campaigns start at $2,000-$3,500 per month for review coverage on a rolling content calendar.