FTC Rules for Med Spa Before and After Photos and Testimonials

The question this post answers: what are the FTC rules for med spa before and after photos, and what do they require when a med spa shows a patient’s before-and-after photo, quotes a testimonial or asks for reviews, and what should you set up in GoHighLevel so your workflows follow them? This is not legal advice. The FTC writes general advertising rules. Whether a specific photo or phrase passes is a call for healthcare or advertising counsel, and your state medical board sets its own physician-advertising rules. Sources were opened on October 15, 2026.

This post sits under our overview of med spa text and ad compliance in GoHighLevel. If you want help setting these workflows up, see our GoHighLevel expert for med spas page.

What are the FTC rules for med spa before and after photos?

Before and after photos are allowed under the FTC rules, but the photo makes a claim and you must be able to back it. The FTC’s Endorsement Guides say that when an ad uses an endorsement about a key attribute, consumers will read it as showing that “the endorser’s experience is representative of what consumers will generally achieve.” If you cannot substantiate that, the ad must disclose the generally expected performance, and that disclosure must “alter the net impression of the advertisement so that it is not misleading” (16 CFR 255.2(b)).

The Guides add a basic rule: “Endorsements must reflect the honest opinions, findings, beliefs, or experience of the endorser,” and an endorsement may not be “presented out of context or reworded so as to distort in any way the endorser’s opinion” (255.1). And consumer endorsements “themselves are not competent and reliable scientific evidence” (255.2(a)), so a happy patient photo cannot be your proof that a treatment works.

What does the FTC say about “results not typical” disclaimers?

A short disclaimer is not a safe harbor. In the heat pump example in 16 CFR 255.2(e), the FTC reports that its testing found “Neither disclosure adequately reduced the communication that the experiences depicted are generally representative.” In that example the FTC says the advertiser “should clearly and conspicuously disclose the generally expected savings” and have substantiation for them.

The Guides’ weight-loss example is the closest to a before-and-after photo. It says the ad “should clearly and conspicuously disclose what they can expect to lose in the depicted circumstances.” It also says a generic range is inadequate when “the range specified is so broad that it does not sufficiently communicate what users can generally expect,” and that a disclosure fails when “it does not communicate what the typical outcome is for users who start the program.”

Those examples cover heat pumps and weight loss, not aesthetic treatments. The reasoning carries over (a picture promises a typical result) but the FTC has not written an aesthetics example in the sections we opened. Counsel can tell you what wording works for a given treatment.

The FTC’s Health Products Compliance Guidance says the same in plainer words: “Testimonials that report results more dramatic than users can generally expect are likely to be deceptive.” It also says the guidance is non-binding and gives no safe harbor. On placement, the FTC’s endorsement Q&A says a button that links to a disclosure is “easily avoidable” and that disclosures should be “placed where they aren’t likely to miss it.” Put the statement beside the image.

What does the FTC reviews rule ban?

The rule, 16 CFR Part 465, was published August 22, 2024 (89 FR 68077) and “went into effect on October 21, 2024,” per the FTC’s questions and answers page. Section by section, from the eCFR text:

Section	What it bars	Med spa example
465.2	Writing, creating or selling a review or testimonial that materially misrepresents who wrote it or their experience	Staff writing a “patient” review, or an agency posting invented ones
465.4	Paying or offering incentives for reviews expressing a particular sentiment, positive or negative	A coupon for 5-star reviews only
465.5	Insider reviews without a clear and conspicuous disclosure of the relationship	An employee or family member posting as an ordinary patient
465.6	Presenting a site you control as independent reviews	A “best med spas in town” site you own that ranks yourself first
465.7	Review suppression through unfounded threats, intimidation or false accusations	Threatening a patient with legal action to remove a review
465.8	Buying fake social media followers or views to misrepresent influence	Purchased Instagram followers shown as proof of popularity

Some points from the Q&A matter for how you build a request workflow:

• Incentives. The rule “does not prohibit giving incentives for reviews, as long as there isn’t an express or implied requirement that the reviews have to express a particular sentiment.” The FTC’s example of an implied requirement is “Tell us how much you loved your visit to John’s Steakhouse and get a $5 coupon.”
• Selective asking. The rule “does not contain a specific prohibition against such conduct” for asking only customers you think are happy, but the FTC says it could still violate the FTC Act.
• Reviews in ads. The FTC says reviews featured in advertising “become testimonials,” and a business that “puts testimonials on its own website is disseminating them and is not merely ‘hosting’ them.”
• Family and insiders. Family can write reviews, but “ask them to clearly and conspicuously disclose their relationship.”

Disclosures matter under the Endorsement Guides too. Under 255.5, a connection must be disclosed “clearly and conspicuously” when it could affect credibility and the audience would not expect it, and payments and free or discounted products both count. A free treatment given to a patient who then posts a testimonial is such a connection.

Do you need patient permission, and is the photo health information?

The FTC Guides concern honesty, not permission. Permission comes from other rules:

• HIPAA. If your med spa is a covered entity, 45 CFR 164.508(a)(3) says it “must obtain an authorization for any use or disclosure of protected health information for marketing,” except for a face-to-face communication or “a promotional gift of nominal value.” A recognizable photo of a patient receiving care can be protected health information. A purely cash-pay med spa may or may not be a covered entity under 45 CFR 160.103. Our HIPAA answer explains the test, and counsel decides your status.
• State boards. Rules vary. The Medical Board of California’s article on medical spas says using models without disclosing it, and using touched-up or refined photos, are prohibited in physician advertising. The article is undated and refers to 2006 and 2007 events, so confirm the current text with counsel (MBC article). We did not open any other state’s rules.

For the form itself, see med spa photo consent form requirements and our consent forms for med spas page.

How do you set this up in GoHighLevel?

HighLevel does not enforce any of the FTC rules for you. These are workflow choices that line up with them. Judgment, not a legal rule: build the photo-authorization filter first, because a workflow that can send a patient image without a recorded permission is the hardest mistake to undo once it has gone out.

FTC point	What to do in GoHighLevel
Typical-results disclosure beside the image (255.2(b))	In the email builder or landing page, add the expected-results sentence in the body text directly under or beside the photo. Do not rely on a footer link.
Original wording preserved (255.1)	Store each testimonial’s exact text, date and the person’s permission in a contact note or custom field. Do not retype it inside a template.
Permission to use the photo	Keep a separate marketing-authorization form. Record the result in a tag or custom field. Make any workflow that sends photos filter on it.
Material connection (255.5)	If you give a discount or free service for a testimonial, write the disclosure into the request text and the published copy.
No sentiment-conditioned incentive (465.4)	In the review-request workflow, do not branch an incentive on rating or wording. Send the same request to everyone.
Insider reviews (465.5)	Remove staff and owner contacts from review-request workflows, or tell them to disclose the relationship.
No suppression (465.7)	Do not add a step that asks a patient to remove a review. Route negative feedback to a manager task instead.

Texts and email that carry these images also have to meet consent, opt-out and hours rules. Those are mapped in the compliance overview, with the details in our TCPA setup and CAN-SPAM setup posts.

What did we not verify?

• We found no FTC page that applies the typical-results rule to injectables or other aesthetic treatments by name. The examples we quote are for heat pumps and weight loss.
• The FTC pages we opened did not state a dollar figure for civil penalties under Part 465. Do not use one from a secondary source without checking the rule or Federal Register notice.
• Only California’s medical board article was opened. State rules vary. Ask your board.
• The FTC Health Products Compliance Guidance page does not show a publication date in the text we read.

Founder’s note, Alpit Patel. I see before-and-after photos go into ads with no recorded permission. Build the photo-authorization filter first. A workflow that can send a patient image without a recorded permission is the hardest mistake to undo once it has gone out. Put the expected-results statement next to the image, not behind a link, because a short ‘results not typical’ disclaimer is not a safe harbor. Send the same review request to every patient, so no step depends on sentiment. I founded aibrevo in San Francisco in 2021, and through autoesta I have overseen 320+ GoHighLevel implementation projects across med spas, real estate, healthcare, dental, home services, SaaS and professional-services clients in the US, UK and UAE. About Alpit

Sources

All checked 2026-10-15.

• eCFR, 16 CFR Part 255: 255.1, 255.2, 255.5 and the examples quoted.
• eCFR, 16 CFR Part 465: sections 465.2 to 465.8, published 89 FR 68077, August 22, 2024.
• FTC, Consumer Reviews and Testimonials Rule: Questions and Answers: effective date, incentives, selective asking, reviews in ads.
• FTC, FTC’s Endorsement Guides: What People Are Asking: disclosure placement, negative reviews.
• FTC, Health Products Compliance Guidance: testimonials, typical results, non-binding status.
• FTC, press release announcing the final rule, August 14, 2024: civil penalty authority against knowing violators.
• eCFR, 45 CFR 164.508: marketing authorization.
• eCFR, 45 CFR 160.103: covered entity definition.
• Medical Board of California, medical spas article: example of state advertising points, undated.