The FTC regulates before-and-after photos as advertising claims, and those claims must withstand its ban on deceptive practices. A dramatic result posted without disclosing whether it’s typical or shot with better lighting in the “after” photo triggers the same enforcement standard the FTC has applied to weight-loss and skincare ads for decades. HIPAA adds a second layer, since a treatment photo becomes protected health information once it’s tied to a patient. Getting compliant means disclosing typical results accurately, avoiding the photo mistakes that draw complaints, and securing separate marketing consent your medical director signs off on.

What the FTC Actually Regulates in Before-and-After Marketing

No rule specifically covers med spas or before-and-after photos. The FTC’s authority comes from Section 5 of the FTC Act, which bans unfair or deceptive acts or practices in commerce. The agency treats a before-and-after photo as an implied claim that must be truthful and substantiated.

The agency’s Endorsement Guides, at 16 CFR Part 255 and updated in 2023, treat before-and-after images as a form of testimonial. An endorsement has to reflect the honest experience of the person shown, and it cannot imply a result that isn’t representative of what other patients achieve. The FTC’s Rule on the Use of Consumer Reviews and Testimonials took effect October 21, 2024, adding civil penalties for the same category of conduct.

Disclosure Requirements for Results and Typicality

A before-and-after photo makes an implicit claim: this is what you can expect. If the result is dramatic or unusual, the FTC requires either proof that it’s typical or a clear disclosure of what typical results look like. A generic line like “results not typical,” buried in six-point font, doesn’t meet that standard.

Two elements make a typicality disclosure defensible:

• Treatment and session count: The disclosure should name the specific treatment and number of sessions behind the photographed result, since six sessions of a resurfacing treatment isn’t the baseline for someone considering one visit.
• Disclosure placement: The disclosure needs to sit directly next to the photo it modifies rather than link out to a separate policy page in the footer.

A disclosure that covers one element but skips the other still leaves a practice exposed, since the FTC evaluates the disclosure as a whole rather than crediting partial compliance.

Common Before-and-After Marketing Mistakes

Most FTC complaints about before-and-after marketing trace back to a handful of repeatable mistakes. None require legal training to catch, which is why they keep showing up. A review before a photo goes live catches nearly all of them.

• Cherry-picked outliers: Posting the single best result from hundreds of patients, without disclosing that it’s an outlier, implies an outcome most patients won’t achieve.
• Inconsistent photo conditions: Shooting the “before” photo in flat light or a slouched pose and the “after” photo with better lighting exaggerates the visible change.
• Borrowed stock photos: Reusing a manufacturer’s stock photo and presenting it as an in-house patient result misrepresents whose result the practice is actually claiming.
• Missing session details: Leaving out the session count or the time elapsed between photos keeps readers from judging whether the result is realistic for their own treatment plan.

These baseline FTC rules apply everywhere, but state medical boards often add their own layer on top. Make sure to regularly check the updated med spa advertising rules by state for what changes depending on where you practice.

Patient Consent for Marketing Use of Photos

A patient who signs a general treatment consent form hasn’t agreed to appear in your marketing. Using a patient’s photo for promotional purposes is separate from providing clinical care, and it needs its own written authorization, or the gallery becomes both an FTC problem and a HIPAA problem at once.

That authorization should spell out how the image will be used, on which platforms, and for how long. It should also confirm the patient can revoke consent at any time, since HIPAA gives patients that right regardless of what the form says.

Once revoked, the photo has to come down from active ads, not just future campaigns. Marketing typically owns the photo and the campaign; the medical director or collaborating physician typically owns whether the consent is current.

How to Build a Compliant Before-and-After Photo Process

A compliant before-and-after program depends on a repeatable review step that runs before a photo reaches a website or social feed. Building that step once means every future photo runs through the same checklist automatically. Skipping it leaves consent and disclosure decisions to whoever happens to be publishing that day.

A workable process runs on three checkpoints:

• Consent verification: Confirm the marketing consent form is signed and current before the photo is used anywhere.
• Disclosure accuracy: Confirm the disclosure language matches exactly what the photo shows.
• Visual consistency: Confirm the lighting, angle, and pose are consistent enough that the comparison isn’t misleading.

Med spas that treat this as a marketing-only decision tend to miss the consent and typicality pieces, since those sit on the clinical and legal side. Sharing this checkpoint with a collaborating physician or medical director closes that gap