NY Med Spa Advertising Rules 2026: OPMC, FTC & Before/After Photo Requirements

Most med spa owners in New York think advertising is a marketing problem. It isn't. In New York, advertising is a licensure problem.

Because med spa services are the practice of medicine, every Instagram post, Google ad, before-and-after, and "free consultation" sign is a regulated communication subject to physician advertising rules — not just consumer protection law. A misleading Reel doesn't just annoy a competitor. It opens a file at the Office of Professional Medical Conduct and, in parallel, hands the FTC a textbook deceptive-practices case.

This guide covers the three regulatory layers, the specific NY rules and statutes that apply, what's required on before-and-after photos and testimonials, the most common complaint triggers, and what compliant ad copy actually looks like.

The Three Layers of NY Med Spa Advertising Oversight

One med spa ad. Three different agencies that can act on it. You need to satisfy all three simultaneously — there's no "FTC compliance" workaround for a NYSED rule, and no NYSED loophole that lets you skip the FTC.

Layer 1: NYSED — Office of the Professions

The New York State Education Department's Office of the Professions licenses and disciplines most health professionals in New York — RNs, NPs, PAs, estheticians, and others who actually deliver med spa services. The governing rule is 8 NYCRR §29.1, which defines unprofessional conduct, and Education Law §6509(2), which makes that conduct grounds for discipline.

Under §29.1, "advertising or soliciting for patronage that is not in the public interest" is unprofessional conduct. That phrase is broader than it sounds. It covers:

• False or misleading claims, including implied claims a reasonable consumer would draw from the ad
• Guarantees of results, cures, or specific outcomes
• Testimonials that are not from real patients with real, typical results
• Comparisons of skill, cost, or quality that can't be objectively substantiated
• Use of bait-and-switch promotions
• Failure to disclose material terms of an offer

Layer 2: OPMC — Physician Misconduct

Physicians and PAs are licensed by the Department of Health, not NYSED, and physician misconduct is investigated by the Office of Professional Medical Conduct (OPMC). The governing statute is New York Education Law §6530, the misconduct catalog for physicians.

Two subsections matter for advertising:

• §6530(27) — "Advertising or soliciting for patronage that is not in the public interest" — the physician analog of the §29.1 rule, with a broader practical reach because OPMC tends to charge it as a stand-alone violation.
• §6530(2) — "Practicing the profession fraudulently or beyond its authorized scope" — invoked when ads imply credentials, specialties, or services the physician isn't actually qualified to deliver.

Why this matters: even if you (the owner) aren't the licensed clinician, your supervising physician is on the hook for ads that run under their oversight. Their license is the one that takes the hit. They will care a lot about what you put on Instagram.

Layer 3: The FTC — Federal Floor

The Federal Trade Commission enforces the FTC Act's prohibition on "unfair or deceptive acts or practices in commerce." For med spas, the operative document is the FTC Endorsement Guides, which apply to every paid post, gifted treatment, employee review, and influencer collab.

FTC compliance is a federal floor, not a ceiling. Disclosing a paid post does not automatically make it compliant under §6530(27). But failing to disclose a paid post is automatically a problem under both regimes.

Before-and-After Photo Rules in New York

Before-and-after photos are the single most common compliance failure in med spa marketing — and the single most common complaint trigger. New York treats them as a special category because they function as visual testimonials and as protected health information at the same time.

What Patient Authorization Must Cover

Before any patient photo appears in marketing, you need a written authorization that satisfies both HIPAA and New York Public Health Law §18 (which governs access to and disclosure of patient information in NY). A generic consent buried in your intake forms will not cut it. The authorization must:

1. Specifically describe the photos being taken (areas of the body, conditions captured)
2. Identify the specific uses authorized — website, Instagram, Facebook, paid ads, print, etc.
3. Specify whether the photos may be cropped, edited, or shown with or without identifying features
4. State a duration and a clear right to revoke, with the practical limits on revocation explained
5. Be signed by the patient, separately from the general consent to treatment
6. Be retained in the medical record for the period required by NY recordkeeping rules (six years for adult records)

A separate, marketing-specific authorization is the standard. If a patient revokes consent, you need to be able to find every place the photo appeared and pull it down — including ads served programmatically that you may not directly control.

Photo Standards That Withstand Scrutiny

OPMC and FTC complaints around before-and-afters almost always allege that the photos are misleading even when consent exists. The standard the regulators apply is whether the photos fairly represent typical results.

• Same lighting and angle — Different lighting between the "before" and "after" is the most common deceptive-photo finding
• No makeup change — A bare-faced "before" and a contoured "after" is not a fair representation
• No retouching — Filters, smoothing, or color correction on the after photo is per se deceptive
• Time interval clearly stated — "Results after 12 weeks" is required context
• Number of treatments stated — A photo after six sessions implied to be after one is misleading
• Typical-results disclosure — If the photo represents an outlier, the FTC requires a "results not typical" disclosure that's clear, conspicuous, and near the photo (not buried in a footer)

What "Clear and Conspicuous" Actually Means

The FTC has been explicit that fine print at the bottom of an Instagram caption is not "clear and conspicuous." A disclosure must be:

• In the same language as the ad
• Visible without having to click "more" or scroll
• In a font size and color that's actually readable
• Placed near the claim it modifies, not at the end of unrelated content

Testimonials, Reviews, and Influencer Marketing

If photos are the most common visual violation, testimonials are the most common written one. New York applies all three regulatory layers here at once.

The Patient Testimonial Rule

Under both §29.1 and §6530(27), a testimonial must come from a real patient describing their actual experience and typical outcome. Implied testimonials count — a video reel of a patient saying "I love this place!" is a testimonial whether or not it's labeled one.

What this rules out:

• Composite or fictional testimonials, even if "based on real experiences"
• Testimonials from patients who received treatment for free or at a discount, without disclosing that material connection
• Testimonials describing atypical results without a "results not typical" disclosure
• Ghost-written reviews on Google, Yelp, RealSelf, or anywhere else
• Reviews written by employees, family members, or friends of the practice without disclosure

Influencer and Paid Endorsement Rules

The FTC Endorsement Guides require disclosure of any "material connection" between an endorser and the brand. For med spa influencers, the connections that always require disclosure include:

• Cash payment for posting
• Free treatment in exchange for posting
• Discounted treatment in exchange for posting
• Affiliate revenue or commission from referred patients
• Gift cards, products, or other in-kind compensation
• Family or employment relationships

Acceptable disclosure language is short, plain, and unambiguous: #ad, #sponsored, or "Paid partnership with [Practice Name]." Buried hashtags after a wall of #beauty #skincare #love do not qualify. The Instagram "Paid partnership" tag is the cleanest implementation; pair it with verbal disclosure in video content.

Employee and Owner Reviews

An employee posting a five-star Google review without disclosing they work there is a textbook FTC violation and an §29.1/§6530(27) issue. If you ask staff to write reviews, they must disclose the relationship — and most platforms ban the practice outright. The cleaner answer is to not ask.

Physician Identification and Practice Disclosures

New York treats med spas as the practice of medicine, period. That has direct consequences for how you advertise.

The Supervising Physician Must Be Identifiable

Med spa marketing in New York must not obscure the fact that a licensed physician is responsible for clinical care. NYSED's Office of the Professions has reinforced through enforcement that ads which present a med spa as a "spa" and hide the medical relationship are misleading by omission.

Standards that hold up:

• The supervising MD or DO is named on the website's About or Team page, with their NY license status visible
• The practice's legal entity (typically a Professional Service Corporation or PLLC under NY DOH rules) appears in footers, terms of service, and consent documents
• Social media bios identify the practice, not just a personal brand of an unlicensed owner
• If the supervising physician changes, the website is updated promptly — not on a quarterly schedule

For more on the underlying physician oversight requirements, see our New York medical director requirements guide and who can own a med spa in New York.

Credential Claims and Specialty Language

Under §6530(2), implying a specialty or credential the physician doesn't hold is misconduct. Practical applications:

• Don't call the supervising physician a "cosmetic surgeon" if they're not a board-certified plastic surgeon or dermatologist
• Don't use "specialist in [procedure]" unless the physician is genuinely board-certified or credentialed in that specialty
• "Expert," "leading," and "top" all require objective substantiation under §29.1
• Don't list certifications that have lapsed or were never completed

Scope-of-Practice Implications in Ads

An ad that pictures only RNs or aestheticians performing injections — without acknowledging physician oversight — implies independent practice that may exceed scope under New York law. See our guide to who can inject Botox in New York for the actual scope rules. Marketing has to match the legal reality.

"Free Consultation" and Pricing Promotions

Free consultation copy is everywhere in NY med spa marketing, and most of it is fine. The problems start when "free" isn't actually free, when the offer triggers §6530(27), or when the ad runs afoul of NY Public Health Law §238 fee-splitting and referral provisions.

Rules for "Free" Offers

• The consultation must actually be free, with no exam fee, photography fee, or "discovery fee"
• It cannot be conditioned on purchasing a treatment
• Material conditions (e.g., "new patients only," "Manhattan location only," "expires 12/31") must be disclosed clearly and conspicuously, near the offer
• If the "free consultation" is functionally a sales pitch, the ad's framing matters — calling it a consultation when no medical assessment occurs has been called out as misleading

Discount and Package Promotions

NY enforcement has historically focused on three patterns:

• Strikethrough pricing without a basis — Showing "$1,200 $499" requires that the $1,200 price actually existed and was charged in good faith
• Countdown urgency that resets — A "48-hour sale" that runs every week is deceptive
• Bundle obscurity — Advertising a treatment price that excludes mandatory injection fees, consult fees, or product surcharges

Referral Fees and Fee-Splitting

NY Public Health Law §238 and §238-a, along with parallel Education Law provisions, prohibit fee-splitting and certain referral arrangements. In an advertising context, that affects:

• Affiliate marketing programs that pay per converted patient (versus per click or per impression)
• "Refer a friend" credits where the credit is contingent on a paid treatment
• Influencer compensation tied to actual treatment purchases rather than a flat content fee

None of these are categorically banned, but they all need legal review before launch — and the FTC disclosure layer applies on top.

Common OPMC Complaint Triggers

The Office of Professional Medical Conduct does not publish a public complaint heatmap, but enforcement summaries and disciplinary actions show recurring patterns in med spa advertising cases.

The Top Recurring Patterns

1. Mismatched before-and-afters — Different lighting, makeup, retouching, or time periods between photos
2. Result guarantees — "Lose 30 pounds guaranteed," "Wrinkle-free in one visit," any "guaranteed" outcome language
3. Undisclosed paid endorsements — Influencer posts and patient testimonials without disclosure of the financial or in-kind relationship
4. Ghost-written or fake reviews — Employee, owner, or fictional reviews on Google, Yelp, RealSelf, or Healthgrades
5. Hidden physician supervision — Marketing that presents as a non-medical "spa" while delivering medical procedures
6. Implied specialties — "Cosmetic surgeon," "weight loss specialist," "hormone expert" without actual board certification
7. FDA off-label claims in ads — Promoting compounded GLP-1s, peptides, or off-label injectables with disease-treatment language
8. Bait-and-switch pricing — Advertised price not actually offered, or only offered with significant undisclosed conditions

For weight loss specifically — currently the highest-complaint subcategory — see our NY GLP-1 compliance guide, which covers FDA labeling rules for compounded products and the advertising language that draws the most scrutiny.

How Complaints Get Started

Most OPMC and NYSED complaints don't come from regulators trolling Instagram. They come from:

• Competitors who screenshot the ad and file the complaint themselves
• Disappointed patients who didn't get the result the ad implied
• Patients whose photos were used without authorization
• Former employees with a grievance
• State agency cross-referrals (FTC enforcement triggering NY follow-up, or vice versa)

The competitor screenshot is the single most common starting point. Your advertising is being read by the practice across the street, and they have an incentive to file. Compliance is your only defense.

Building an Advertising Compliance Process

Compliance is a process, not a one-time review. Practices that stay clean run their marketing through a repeatable sequence before anything goes live.

The Pre-Publish Checklist

1. Truth check — Every factual claim has a source. Outcome claims have a substantiation file.
2. Photo provenance — Every patient image has a written marketing authorization on file. Stock images are licensed and labeled as illustrative.
3. Disclosure check — Every endorsement has a clear, conspicuous, near-the-claim disclosure of any material connection.
4. Physician check — The supervising physician is identified, and the credentials and specialties claimed are accurate and current.
5. Pricing check — All material conditions on offers are disclosed clearly. Strikethrough pricing reflects actual former pricing.
6. Scope check — The ad does not depict or imply procedures by providers outside their scope.
7. Compounded product check — Any reference to compounded medications complies with FDA and NY pharmacy rules; no disease-treatment claims for off-label use.

Documentation That Saves You

If a complaint lands, the practices that survive are the ones with documentation. Maintain:

• A signed marketing authorization for every patient image, with date, scope, and patient signature
• A substantiation file for every outcome or comparative claim, with the data source and date
• An archive of every ad run, with the platform, run dates, and creative
• A log of disclosures used and where they appeared
• Endorser agreements with every influencer, including disclosure obligations and content approval rights

For the broader compliance stack — protocols, recordkeeping, supervision documentation, and HIPAA — see our NY compliance checklist and the NY med spa launch guide.

Summary

1. NY med spa advertising is governed by three layers at once: NYSED §29.1, Education Law §6530(27), and the FTC Act with its Endorsement Guides
2. Every patient photo requires a separate, written, HIPAA-compliant marketing authorization — and the photos must fairly represent typical results under consistent conditions
3. Testimonials and influencer content require clear, conspicuous disclosure of every material connection, placed near the claim — not buried
4. The supervising physician must be identifiable in marketing; ads that obscure the medical nature of the practice are misleading by omission
5. Implied credentials, guarantees of results, and bait-and-switch pricing are the most common §6530(27) complaint triggers
6. OPMC complaints most often come from competitors, disappointed patients, and former employees — not random regulators
7. Run every ad through a pre-publish checklist and keep substantiation files; documentation is what defeats a complaint

Disclaimer: This article is for educational purposes only and does not constitute legal advice. Med spa advertising compliance involves overlapping state, federal, and platform-specific rules that change frequently. Consult with a New York healthcare attorney and a marketing-experienced FTC compliance counsel before publishing campaigns.