Pharma programmatic advertising: the FDA rules on content, the privacy rules on data, and what is new in 2025 and 2026

A review usually runs through five questions. Each section below takes one, and the table near the end puts them together by data source.

1. What is the message? A product ad that names a drug and its use, a reminder ad that names only the drug, or disease awareness with no drug named. The first two fall under 21 CFR 202.1.
2. What is the format? Television and radio ads carry extra duties under the 2023 rule and the pending proposal.
3. Where does the audience data come from? Contextual signals, a health publisher, a professional registry, an inferred health audience or a pharmacy.
4. Does a HIPAA covered entity hold the data? If a pharmacy, provider or health plan supplies it, the HIPAA marketing and sale rules apply to that entity.
5. Which state, code and platform rules sit on top? Consumer health data laws, NAI and DAA principles, and Google and Meta policies.

What the law requires. Section 502(n) of the Federal Food, Drug, and Cosmetic Act treats a prescription drug as misbranded if its advertising lacks the established name and the required summary of side effects, contraindications and effectiveness (21 U.S.C. 352(n), LII). FDA's regulation sets the detail (21 CFR 202.1, eCFR):

• Brief summary. All prescription drug ads "must present a true statement of information in brief summary relating to side effects, contraindications ... and effectiveness" ((e)(1)).
• Broadcast ads. Radio, television and telephone ads must include the "major statement" of major side effects and contraindications. They must also contain a brief summary "unless adequate provision is made for dissemination of the approved or permitted product labeling" ((e)(1)(i)).
• Fair balance. An ad fails the true-statement test if effectiveness gets "greater scope, depth, or detail" than risks without a fair balance ((e)(5)(ii)). Paragraphs (e)(6) and (e)(7) list practices that are, or may be, false, lacking in fair balance or misleading.
• Reminder ads. Ads that give only the drug's name, without indications or dosage, are exempt from the brief summary. Apart from price-only reminders, they are not permitted for a drug whose labeling carries a boxed warning about a serious hazard ((e)(2)(i)).

What the media list says. The regulation's examples of advertising media date from the print and broadcast era: journals, magazines, newspapers, radio, television and telephone ((l)(1)). Brochures, mailers, sound recordings and similar pieces count as labeling ((l)(2)). Digital formats are not named.

What FDA has said. FDA's letters apply the same standards to digital media without a separate rule, as the letter table below shows. FDA issued draft guidance in June 2014 on presenting risk and benefit information on platforms with character limits (79 FR 34759, 18 June 2014). We found no final version in the Federal Register as of 9 November 2026.

What practitioners do. In practice, brands route risk-heavy formats, such as banners with an important safety information box, through medical, legal and regulatory review before release. The letters show why: each one concerns material the company "submitted ... under cover of Form FDA 2253", and FDA acted on it afterwards (FDA letter to Evolus).

What the law requires. The Food and Drug Administration Amendments Act of 2007 required the major statement in TV and radio ads to be "clear, conspicuous, and neutral". FDA's final rule set the standards (88 FR 80958, 21 November 2023). It took effect on 20 May 2024, and the compliance date was 20 November 2024.

For human prescription drug ads presented directly to consumers in "television or radio format", the major statement must meet five tests (21 CFR 202.1(e)(1)(ii)):

1. consumer-friendly language;
2. audio at least as understandable as the rest of the ad;
3. on TV, audio and text together ("dual modality"), with the text on screen while the audio plays;
4. on TV, text size, contrast and placement that "allow the information to be read easily";
5. no audio or visual elements likely to interfere with comprehension.

What changes the answer. The rule speaks of television or radio "format", not of the delivery network. A pharma brand buying connected TV or streaming audio programmatically asks whether its spot is in that format. FDA published a question-and-answer guidance with the rule on 27 December 2023 (88 FR 89303); we did not verify how it treats streaming.

The table lists each federal action, its source and its status on 9 November 2026. None of them has changed the text of 21 CFR 202.1 yet.

What the pending rule would change. Today a TV ad can carry the major statement and point viewers to a website, phone number or print ad for the full labeling. The agenda entry says FDA would instead require broadcast ads "to disclose all relevant risk and safety information to consumers within the confines of the ad itself". It also says the change "does not constitute a ban" (RIN 0910-AJ14). A proposal would open a comment period before any final rule.

What practitioners watch. The agenda text names broadcast media. Whether the proposal will also reach digital video, connected TV or audio streaming is unknown until the text is published.

FDA's Office of Prescription Drug Promotion (OPDP) posts its untitled letters on a dedicated page; its warning letters appear on FDA's general warning-letter page (FDA). The letters below, all untitled, show FDA applying 202.1 to digital media. Each finding is FDA's position in the letter, not a court ruling.

Two patterns matter for programmatic buyers. Professional websites and social posts get the same scrutiny as TV. And the offending asset is often the landing page or video that a programmatic ad links to, so review covers the whole path, not only the creative.

What the law requires. HIPAA applies to covered entities and their business associates (45 CFR 160.103). A manufacturer is usually neither, so HIPAA reaches a pharma campaign through the pharmacy, provider or plan that holds the data. Three rules decide most cases:

1. Paid communications are marketing. When a covered entity receives payment from a manufacturer to send a message about the manufacturer's drug, the message is marketing. It needs each patient's authorization, which must state that remuneration is involved (45 CFR 164.501; 164.508(a)(3)). Refill reminders are excepted if payment covers only the cost of the communication.
2. Selling PHI needs its own authorization. A disclosure of PHI for remuneration from the recipient is a sale and needs an authorization that states the remuneration (45 CFR 164.502(a)(5)(ii)).
3. De-identified data sits outside the rule. Data de-identified by expert determination, or by removing the 18 safe-harbor identifiers under the rule's conditions, is not PHI (45 CFR 164.514(b)).

Our page on the HIPAA marketing rule covers the exceptions and authorization form. The guide to HIPAA-compliant programmatic advertising covers architectures that keep patient keys inside the covered entity. A vendor that handles PHI for the pharmacy needs a business associate agreement; our review of HIPAA-compliant marketing platforms shows which vendors offer one.

What a pharmacy network says. CVS Media Exchange says its ad targeting uses "front-store ExtraCare® purchase history data combined with digital engagements on CVS properties" (CMX FAQ, accessed 9 November 2026). The profiles of CVS Media Exchange and Walgreens Advertising Group record what each network publishes about pharmacy data.

What the law requires. Section 5 of the FTC Act prohibits unfair or deceptive acts in commerce (15 U.S.C. 45, LII). The FTC's Health Breach Notification Rule adds a breach duty for vendors of personal health records and related entities. It "does not apply to HIPAA-covered entities" or to business associates acting as such (16 CFR 318.1).

The 2024 amendments, effective 29 July 2024, matter for pharma apps (89 FR 47028). "Health care services or supplies" now includes any website or app that tracks "treatment, medications, vital signs, symptoms" and similar data. A "breach of security" includes "an unauthorized disclosure", not only a hack. Notice is due without unreasonable delay and no later than 60 calendar days after discovery (16 CFR 318.2, 318.4).

What changes the answer. A personal health record must have "the technical capacity to draw information from multiple sources" and be managed by or for the individual (318.2). A medication-tracking app that pulls data from more than one source may meet that test; a static brand site usually does not. The FTC's health-data cases are listed in our pixel problem reference.

What the law requires. Washington's My Health My Data Act defines consumer health data to include "use or purchase of prescribed medication" and data "derived or extrapolated from nonhealth information", such as inferences made by algorithms (RCW 19.373.010(8)(b)(iv), (xiii)). Collecting it needs consent for a specified purpose, and sharing needs a separate consent, unless the data is necessary for a service the consumer requested (RCW 19.373.030).

The definition of "consumer" excludes "an individual acting in an employment context" (RCW 19.373.010(7)). That exclusion matters for professional targeting. Other states use different definitions; the state health privacy laws tracker lists them, and a planned page covers Washington's law for advertisers.

These codes bind members that sign up. They are practice standards, not law, though regulators and courts may look at them.

DAA. The Digital Advertising Alliance published its principles in July 2009. They say entities "should not collect and use" pharmaceutical prescriptions or medical records about a specific individual for online behavioral advertising "without Consent" (DAA Self-Regulatory Principles for OBA, Principle VI.B). The same document excludes contextual targeting from its scope.

NAI. The Network Advertising Initiative replaced its 2020 Code of Conduct with the NAI Framework on 1 February 2025 (NAI, accessed 9 November 2026). Principle 4 requires members to limit sensitive personal data to disclosed purposes and to purposes "consented to by the consumer as required by applicable laws" (NAI Principles, effective 1 February 2025). Under the former code, NAI guidance of January 2020 treated prescriptions and inferences about conditions such as cancer and mental health as sensitive, needing opt-in consent (NAI health audience guidance, January 2020).

Platform terms are contracts, not law, and they change. The dates below are the dates we read them.

This table is the core of the guide. Each row names a data source used in pharma programmatic buying, the rules that apply, and the facts that move the answer. "Applies" means the rule is engaged, not that the use is permitted or barred.

Two patterns run through the table. FDA's content rules apply to every row, because they follow the drug. The privacy rules grow stricter as the data moves from the page, to the person, to the patient record. For how clean rooms are built and where outputs leave them, see clean room architectures compared; the planned page on pharmacy retail media networks will cover each network's data policy.

A brand team plans a migraine campaign and splits its programmatic budget three ways. The scenario is illustrative; the rules behind each step are cited above.

1. Contextual display on health and news sites. The creative carries the brief summary or links to it, and medical-legal review covers the banner and its landing page. No user data from the brand reaches the bid; the landing page's tags are the open question.
2. HCP video on professional sites, targeted by NPI. FDA's rules for professional promotion apply, as the Lundbeck letter shows. The privacy review asks how the data partner matched NPIs to devices and whether any score came from patient claims.
3. Pharmacy retail media. The review asks the network which data the audience uses. If it is front-store loyalty data, state law and the network's terms apply. If prescription records were involved, the pharmacy would need patient authorizations or de-identified outputs.

1. 21 U.S.C. 352, Misbranded drugs and devices (section 502(n) of the FD&C Act). Legal Information Institute. https://www.law.cornell.edu/uscode/text/21/352
2. 21 CFR 202.1, Prescription-drug advertisements. eCFR, text current to 5 November 2026, read 9 November 2026. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-202/section-202.1
3. FDA, "Direct-to-Consumer Prescription Drug Advertisements: Presentation of the Major Statement in a Clear, Conspicuous, and Neutral Manner in Advertisements in Television and Radio Format", final rule, 88 FR 80958 (21 November 2023; effective 20 May 2024; compliance 20 November 2024). https://www.federalregister.gov/documents/2023/11/21/2023-25428/direct-to-consumer-prescription-drug-advertisements-presentation-of-the-major-statement-in-a-clear
4. FDA, Questions and Answers guidance and Small Entity Compliance Guide on the major statement rule, notice of availability, 88 FR 89303 (27 December 2023). https://www.federalregister.gov/documents/2023/12/27/2023-28530/direct-to-consumer-prescription-drug-advertisements-presentation-of-the-major-statement-in-a-clear
5. FDA, "Draft Guidance for Industry on Internet/Social Media Platforms With Character Space Limitations", notice of availability, 79 FR 34759 (18 June 2014). https://www.federalregister.gov/documents/2014/06/18/2014-14220/draft-guidance-for-industry-on-internetsocial-media-platforms-with-character-space-limitations
6. The White House, Memorandum "Addressing Misleading Direct-To-Consumer Prescription Drug Advertisements" (9 September 2025). https://www.whitehouse.gov/presidential-actions/2025/09/memorandum-for-the-secretary-of-health-and-human-services-the-commissioner-of-food-and-drugs/
7. FDA, "FDA Launches Crackdown on Deceptive Drug Advertising", press announcement (9 September 2025). https://www.fda.gov/news-events/press-announcements/fda-launches-crackdown-deceptive-drug-advertising
8. FDA, "Untitled Letters" (Office of Prescription Drug Promotion list; checked 9 November 2026). https://www.fda.gov/drugs/warning-letters-and-notice-violation-letters-pharmaceutical-companies/untitled-letters
9. Office of Information and Regulatory Affairs, Unified Agenda entry RIN 0910-AJ14, "Transparency in Direct-to-Consumer Advertising" (2026 agenda; read 9 November 2026). https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0910-AJ14
10. FDA OPDP, untitled letter to AbbVie Inc., Skyrizi (9 September 2025). https://www.fda.gov/media/188908/download