Med Spa Text and Ad Compliance in GoHighLevel: Each Rule Mapped to a Setting

The problem this page solves: med spa text and ad compliance. A med spa owner or the person building their GoHighLevel account has to send promotions, show results and ask for reviews, and does not know which rule governs which part of a campaign or which switch in the platform covers it. Below, each rule is tied to a setting or a workflow decision. Rules are cited to the FTC, the FCC, the FDA, the eCFR and HighLevel’s own help pages, all opened on October 15, 2026.

This is not legal advice. It is a map of published rules and the GoHighLevel settings that line up with them. Final wording of ads, consent forms and templates belongs with a healthcare or advertising attorney who knows your state, and your state medical board decides what physician and licensed-staff advertising must look like. Where a primary source did not answer a question, this page says so and sends you to counsel or the board.

If you are choosing who builds your account, start with our GoHighLevel expert for med spas page. For setup order, see GoHighLevel setup for med spas.

What rules cover med spa text and ad compliance?

Four federal layers plus your state. They stack: one text can be fine under one and fail another.

Layer	Who writes it	What it covers	Primary source
Advertising claims and testimonials	FTC	Honest, substantiated claims. Typical-results disclosures. Fake and incentivized reviews.	16 CFR Part 255, 16 CFR Part 465
Texting consent and hours	FCC	Written consent for marketing texts, revocation, calling hours	47 CFR 64.1200
Marketing email	FTC	Header, subject line, ad label, address, opt-out	CAN-SPAM compliance guide
Carrier and registry rules	Carriers, through HighLevel’s A2P registration	Opt-in proof, opt-out wording, banned content categories	HighLevel A2P rejection article
Patient information and photos	HHS (if you are a covered entity)	Written authorization before using health information for marketing	45 CFR 164.508
Physician advertising	State medical board	Misleading ads, models, touched-up photos and more, varying by state	Varies. California example below.

A purely cash-pay med spa may or may not be a HIPAA covered entity under 45 CFR 160.103. Our HIPAA answer and HIPAA setup steps cover that call. State privacy and advertising rules apply either way.

How do you map each rule to a GoHighLevel setting?

This is the core table. “Do in GoHighLevel” is a configuration or workflow choice. Menu paths are the ones in HighLevel’s help pages cited at the bottom. HighLevel’s menus change, so confirm the path in your account.

Rule	What it requires	Do in GoHighLevel
FTC Endorsement Guides, 16 CFR 255.1	An endorsement must reflect the endorser’s honest experience and cannot be reworded to distort their opinion	Store each testimonial’s original text, date and the person’s permission in the contact record. Do not edit wording inside email or social templates.
16 CFR 255.2(b) typical results	If a pictured result is not typical, the ad must say what consumers can generally expect, in a way that changes the net impression	Put the expected-results statement in the body of the email or landing page next to the image, not behind a link. See the photo rules post.
16 CFR 255.5 material connection	Disclose payments, free or discounted treatment and other connections that audiences would not expect	If you give a discount or free service for a testimonial or review, write the disclosure into the request template and the published copy.
16 CFR 465.4 incentives for reviews	No paying for reviews that express a particular sentiment	Do not build a review-request workflow that rewards only 5-star ratings or ties the incentive to positive wording.
16 CFR 465.5 insider reviews	Staff, owners and agents must disclose their relationship	Exclude team contacts from review-request workflows, or tell them to disclose.
16 CFR 465.7 review suppression	No baseless threats or false accusations to remove reviews	Never add a workflow step that asks a patient to delete a negative review.
FTC Health Products Compliance Guidance	Health benefit claims need competent and reliable scientific evidence	Keep treatment claims out of templates unless counsel has approved them. Use one reviewed template library so nobody improvises.
HIPAA 45 CFR 164.508(a)(3)	A covered entity needs written authorization to use health information for marketing, with limited exceptions	Keep a separate marketing-use authorization, record it in a custom field or tag, and make workflows that use photos or treatment detail filter on it.
TCPA, 47 CFR 64.1200(a)(2), (f)(9)	Prior express written consent for autodialed marketing texts	Use an unchecked SMS consent checkbox on every form, separate from other terms, with message type, frequency, rates and STOP wording nearby. Keep the submission.
TCPA revocation, 64.1200(a)(10)	Honor reasonable opt-out requests, including STOP, QUIT, END, CANCEL, UNSUBSCRIBE	Settings, Phone System, Messaging: switch on “Make SMS compliant by adding an opt-out message” and review the opt-out keywords. Our TCPA setup post covers Do Not Disturb.
TCPA hours, 64.1200(c)(1)	No telephone solicitations before 8 a.m. or after 9 p.m. in the recipient’s local time	Automation, workflow, Settings tab, Communication Settings: turn on Time Window and set Timezone to Contact Timezone.
CAN-SPAM	Honest header and subject, ad label, postal address, working opt-out honored within 10 business days	Sub-Account Settings, Business Profile, General: keep Include Unsubscribe Link on. Type your address into the footer. See the CAN-SPAM setup post.
Carrier rules via A2P	Opt-in proof, separate marketing consent, opt-out and HELP replies that name your brand, no banned categories	Fix registrations using the codes in the A2P rejection guide. Do not describe prescription drug promotion in the campaign.
State medical board	Varies by state	Have counsel review ad and template copy against your state’s rules before it enters a workflow.

A longer rule-by-rule version for the two content-heavy topics is in our posts on before-and-after photos and testimonials and advertising Botox and prescription treatments by text and email.

What do the FTC rules say about testimonials and reviews?

The Endorsement Guides, 16 CFR Part 255, say an endorsement “must reflect the honest opinions, findings, beliefs, or experience of the endorser” and may not be “presented out of context or reworded so as to distort in any way the endorser’s opinion.” They also say consumer endorsements “themselves are not competent and reliable scientific evidence,” so a testimonial cannot prove a result you could not prove directly (16 CFR 255.1 and 255.2, eCFR).

The FTC’s consumer reviews and testimonials rule, 16 CFR Part 465, “went into effect on October 21, 2024,” per the FTC’s questions and answers page. It covers:

• Fake or false reviews and testimonials, including selling or buying them (465.2).
• Paying for reviews of a particular sentiment, positive or negative (465.4).
• Insider reviews without a clear disclosure of the relationship (465.5).
• Company-controlled sites presented as independent (465.6).
• Review suppression through baseless threats or false accusations (465.7).
• Fake social media followers or views (465.8).

Three practical points from the FTC’s Q&A matter for a review-request workflow:

1. Incentives are allowed in principle. The rule “does not prohibit giving incentives for reviews, as long as there isn’t an express or implied requirement that the reviews have to express a particular sentiment.”
2. Asking only happy customers. The rule “does not contain a specific prohibition against such conduct,” but the FTC adds that it could still violate the FTC Act. Sending the same request to everyone is the lower-risk build.
3. Reviews used in ads become testimonials. The FTC says that when consumer reviews are featured in advertising, they “become testimonials,” and a business posting testimonials on its own site is “disseminating them.”

How do you handle before-and-after photos and results claims?

Treat the photo as a claim that the result is typical. The Guides say that an endorsement about a key attribute is read as showing “the endorser’s experience is representative of what consumers will generally achieve,” and if that is not substantiated the ad must disclose expected performance clearly and conspicuously (16 CFR 255.2(b)). The FTC’s weight-loss example in the same section says that a before-and-after ad “should clearly and conspicuously disclose what they can expect to lose in the depicted circumstances.” That example concerns weight loss, not aesthetic treatments, so use it as the FTC’s reasoning, not as a rule written for injectables. The full walk-through, including patient authorization, is in our photo and testimonial rules post.

Two limits on what we can say. The FTC’s Health Products Compliance Guidance says testimonials that report results more dramatic than users can generally expect “are likely to be deceptive,” and that the guidance itself is non-binding and offers no safe harbor. And your state board may go further: California’s Medical Board article on medical spa advertising says using models without disclosing it and using touched-up photos are prohibited (see below).

Can you text and email patients about Botox and other prescription treatments?

Short answer: there is no single federal sentence that settles it, and three separate checks apply. This is the topic of its own post, advertising Botox and prescription treatments by text and email. The summary:

• FDA. The advertising rules under section 502(n) of the Federal Food, Drug, and Cosmetic Act, as implemented in 21 CFR 202.1, speak of ads “issued or caused to be issued by the manufacturer, packer, or distributor of the drug.” We opened FDA’s pages on prescription drug promotion and found none that says how those rules apply to a clinic’s own promotion of a treatment. Ask counsel and your state board.
• Carriers. HighLevel’s A2P article lists “Prescription drugs or controlled substances” (code 30941) as a disallowed category that is not eligible for resubmission. The article does not say how it treats a clinic’s appointment texts. Ask HighLevel support before you register or describe a campaign that way.
• HIPAA and consent. If you are a covered entity, marketing uses of patient information need authorization unless an exception applies, and every promotional text needs written consent.

What does a state medical board add?

Rules vary by state, and many med spa rules sit with the state’s medical board, so a single national checklist cannot cover them. As one example, the Medical Board of California’s article on medical spa advertising states that physician advertising must not be misleading, must include the physician’s name, and that using models without saying so, using touched-up photos and using phrases like “for as low as” are prohibited. The article carries no publication date and refers to 2006 and 2007 events, so confirm the current text of California Business and Professions Code section 651 with counsel before relying on it (Medical Board of California, Medical Spas article).

For any other state, open that state’s medical board site or ask counsel. We did not open another state’s rules for this page and do not summarize any.

What should a compliant GoHighLevel setup look like for a med spa?

A short build order, from the table above:

1. Consent first. Every form that collects a phone number gets a separate, unchecked SMS consent box with the required wording. Appointment texts and promotional texts get separate consent. See med spa appointment versus marketing text consent and text opt-in language examples.
2. A2P registration that matches reality. Register the campaign with accurate sample messages and a hosted opt-in proof. Our A2P registration page for med spas covers it.
3. Opt-out and quiet hours. Switch on the opt-out wording in Settings, Phone System, Messaging, and set a Time Window and Contact Timezone on every marketing workflow.
4. One approved template library. Counsel-approved copy for promotions, review requests and photo posts. See text message templates without PHI.
5. Photo and testimonial authorization. A separate form, stored and filterable. See consent forms for med spas.
6. Review requests that treat everyone equally. No sentiment filtering, no incentive tied to a rating, no staff reviews without disclosure.
7. An audit. A periodic check of live workflows against this list. See auditing and fixing a med spa account.

If you want an expert to build or audit this inside your account, start at aibrevo’s GoHighLevel service or contact us. aibrevo configures the platform. It does not provide legal advice, and it will ask you to take copy and consent language to your own counsel.

What did we not verify?

• We did not read the CTIA Messaging Principles and Best Practices document. The CTIA page we opened describes it as a set of voluntary best practices and does not show its consent or content rules. HighLevel’s A2P article refers to CTIA guidelines, which is what we relied on for carrier rules.
• We did not open any state rule other than the California article above.
• HighLevel’s help pages we opened do not show update dates, so check the live page for changes.
• The FCC adopted changes to its revocation rules that are not yet in effect, as described in our TCPA setup post. Check the current eCFR text before changing opt-out handling.

Founder’s note, Alpit Patel. I see ads and texts go out before anyone checked the rules, and it happens a lot. My rule: map each rule to a real GoHighLevel setting before you write a single campaign, and confirm the menu path in your own account, because HighLevel’s menus change. Treat a before-and-after photo as a claim that the result is typical, so the ad needs a clear expected-results line unless you can back the claim up. Have counsel check your state medical board’s advertising rules. A national checklist cannot cover them. I founded aibrevo in San Francisco in 2021, and through autoesta I have overseen 320+ GoHighLevel implementation projects across med spas, real estate, healthcare, dental, home services, SaaS and professional-services clients in the US, UK and UAE. About Alpit

Sources

All checked 2026-10-15.

• eCFR, 16 CFR Part 255, Guides Concerning the Use of Endorsements and Testimonials in Advertising: honest experience, typical results, material connections.
• eCFR, 16 CFR Part 465, Trade Regulation Rule on the Use of Consumer Reviews and Testimonials: the six prohibited practices (89 FR 68077, Aug. 22, 2024).
• FTC, Consumer Reviews and Testimonials Rule: Questions and Answers: effective October 21, 2024, incentives, selective solicitation, reviews in ads.
• FTC, Health Products Compliance Guidance: substantiation, testimonials, non-binding status. Publication date not shown on the page.
• FTC, CAN-SPAM Act: A Compliance Guide for Business: requirements, 10 business days, $53,088 per email.
• eCFR, 47 CFR 64.1200: prior express written consent, revocation, hours.
• eCFR, 45 CFR 164.508 and 164.501: marketing authorization and the definition of marketing.
• eCFR, 21 CFR 202.1: who prescription-drug ad rules address.
• FDA, Office of Prescription Drug Promotion: mission, sponsors.
• HighLevel Support, Understanding A2P Campaign Rejection Reasons and Required Fixes: consent codes, disallowed categories.
• HighLevel Support, How to Configure SMS Compliance Settings in HighLevel: opt-out toggles and keywords.
• HighLevel Support, Managing Default Unsubscribe Links in LC Email: unsubscribe link setting.
• HighLevel Support, Workflow Settings Overview: Time Window and Timezone.
• Medical Board of California, medical spas article: example of state advertising points, undated.
• CTIA, Messaging Principles and Best Practices page: description only.