Meta Says “Potentially Prohibited Information Was Removed”: What It Means and What to Do

Meta's prohibited information notification means its systems detected and removed data from your Pixel or Conversions API events that may break the Meta Business Tools Terms, such as a condition in a URL, a product name or a custom event name. Find the field in Diagnostics and stop sending it: Meta says repeated notifications can put your dataset into Core Setup for at least 90 days.

The notification is one part of the system described in our guide to Meta's health and wellness restrictions, which covers the categories and the fix. This post goes deeper on the notification itself: what it says, what happens if it repeats, how to trace it to the field that triggered it and what to change in what you send. We checked every Meta detail against Meta's Business Help Center on October 24, 2026. This isn't legal advice.

What does Meta's prohibited information notification say?

Meta's troubleshooting guide describes notifications, by email, in the Diagnostics tab of Events Manager or in Ads Manager, saying that "potentially prohibited information was removed from the data you're sharing." The same problem can reach you in several forms:

Meta's prohibited information page defines what counts. For health, it covers conditions, sexual and reproductive health, mental health, treatments and testing, and prescription medications, over-the-counter products and supplements for specific medical conditions. It also covers financial information and anything defined as sensitive under applicable laws, regulations and industry guidelines. Meta adds that the names you give events, conversions and audiences must not reflect or imply any of it.

One detail shapes the whole triage: Meta shows you which parameters, on which pages, had information removed, but not the removed values. You find the value by looking at what you send.

---

What happens if you keep getting the notification?

Meta escalates. Here's what its own pages say about each stage:

The 90 days is a minimum. Meta doesn't say what happens at the end of it, and our explainer on what Meta Core Setup restricts covers what changes while you're in it: URL-based audiences, automatic advanced matching, pixel catalog updates and custom events.

Meta also sets a rule for after the fix: you must not try to send data it has already detected and removed. Renaming a field, or swapping a value for a code that means the same thing, falls on the wrong side of that rule.

---

How do you trace the notification to the field that triggered it?

Work from the diagnostic to the sender. You need full control of the business asset (the dataset) to see and act on blocked parameters, and if a developer maintains your store's tracking, bring them in at step 3.

Step 1: Open the blocked parameters in Diagnostics

1. In Meta Events Manager, click Datasets and select your dataset.
2. Open the Diagnostics tab.
3. Find the message Event parameters blocked and click Review.
4. Read the acknowledgment about the Meta Business Tools Terms and click I acknowledge.
5. The Action required tab lists the blocked parameters.

Write down each parameter, the events it arrived on, and any pages the diagnostic names.

Step 2: See what you actually send

Open an affected event, click View details, and under Event Breakdown choose URLs to see the pages it fires on. Sampled Activities shows the parameters and the connection method for recent events (Meta's steps). The connection method tells you whether the field arrived from the browser pixel, the Conversions API, or both.

If the dataset is already in Core Setup, these views hide custom parameters and URL paths. Check the payload where it's built instead: your tracking app's event log, your theme code or your server.

Step 3: Match the field to its source

Meta's own checklist names forms on your pages and the data you send with events: product IDs, content names, custom properties and URL parameters, including UTMs. It warns that UTM parameters can carry prohibited data from the landing pages viewed. On a Shopify store, the usual sources look like this:

Meta also tells advertisers to check the pages the pixel runs on, and not to send information about people from pages where visitors log in and share sensitive details, with patient portals as its example. You can remove the pixel from pages you don't advertise to.

Step 4: Fix every sender, not just one

The notification is about the dataset, so every tool that sends to it counts. On Shopify, list them all: the Facebook & Instagram app's data sharing (our guide to Shopify's Facebook & Instagram data sharing settings explains what it sends), pixel code in your theme, Google Tag Manager containers, other tracking apps and any Conversions API Gateway. Our Meta Pixel Helper guide shows how to count the pixels that fire on each page. Fix the field in one tool and leave it in another, and the notification comes back.

Step 5: Unblock or keep blocking

Back in the Action required tab, Meta gives you two choices for each parameter (Meta's steps):

• Unblock parameter, once you've fixed it and can confirm it only shares data that follows the terms. You may not be able to unblock a parameter Meta blocked itself.
• Keep blocking parameter, if you can't fix it now, can't confirm what it carries, or want to avoid further restrictions.

Our take. Keep blocking descriptive fields. content_name, content_category and custom properties describe the product, and none of them plays any part in how Meta matches an event to a person. Unblock only a field you need for a feature, after you've changed what it carries at every sender.

What should you change in what you send?

The principle is data minimization: send Meta who converted and for how much, and leave out what they bought and why. The hub has the full table of fields to remove and identifiers to keep. Beyond that list, four changes stop repeat notifications on Shopify stores:

1. Filter per destination, not at the source. Your analytics and warehouse still need product names and categories. Strip them from Meta's events only. Upstack applies field rules per destination for this reason.
2. Don't replace a flagged value with a code for the same thing. Meta says names and criteria must not reflect, imply or be based on prohibited information, and you must not try to resend data it removed. A neutral ID is fine; an abbreviation of the condition isn't.
3. Clean up campaign naming. UTMs carry campaign and ad names into page URLs, so a campaign named after a condition puts that condition in every landing page URL.
4. Keep the identifiers. Hashed email and phone, fbc, IP address, user agent, external_id, value and currency stay in. Dropping them doesn't make the payload safer, and it costs matching.

Meta also suggests turning on Core Setup yourself as a precaution. It's a reasonable backstop, but it doesn't reliably remove product titles, and it breaks URL-based audiences, so fix the fields first.

---

When is the notification a sign of a bigger restriction?

A notification on its own is about fields. If it comes with a category under Manage data source categories, or Purchase becomes unavailable as an optimization event, Meta has categorized the data source, and cleaning fields on the same dataset won't lift that. Meta says you can't edit a category it assigned, only request a review.

For health and wellness brands in that position, the setup on our health and wellness page is a new, clean pixel with nothing else connected, events sent server-side from a neutral domain with product names, URLs, categories and descriptions stripped, and optimization on the standard Purchase event. Upstack doesn't remove a category Meta has assigned, and your ads still have to follow Meta's ad policies.

---

Frequently asked questions

Can I see what data Meta removed from my events?

No. Meta's diagnostics show which parameters, from which pages, had information removed, but not the removed data itself. Compare the parameter names with what each sender puts in them, using Sampled Activities and your tracking tool's event log.

Should I unblock a blocked parameter?

Only after you've changed what it carries at every sender and can confirm it follows the Meta Business Tools Terms. If you can't confirm that, keep blocking it. A blocked parameter can't be used in custom conversions or custom audiences, but descriptive fields play no part in matching.

Will moving to the Conversions API stop the notifications?

No. The Conversions API is one of the Meta Business Tools, so the same terms apply to the data whichever tool sends it, and Events Manager shows parameters and URLs sent through both the Pixel and the Conversions API. A product title sent from your server is still a product title.

How long does Core Setup last after repeated notifications?

At least 90 days, according to Meta's guide to reviewing blocked parameters. Meta doesn't publish what happens after that period, so treat it as a minimum and keep the fixed fields out for good.

Does the notification mean my ad account is restricted?

Not by itself. It's about the data your dataset receives. Meta's escalation for repeated notifications is Core Setup on the Business Tool, while ad rejections and account restrictions come from Meta's separate ad policies.

---

Key takeaways

• The notification says potentially prohibited information was removed from the data you're sharing; Diagnostics shows the parameters and pages, not the values.
• Repeated notifications can put your dataset into Core Setup for at least 90 days.
• Trace each blocked parameter to its source: product titles, categories, URLs and UTMs, search terms, custom properties, custom event names and form fields.
• Fix the field at every sender, including Shopify's Facebook & Instagram app, theme code and tag managers.
• Keep blocking descriptive fields. Don't swap a flagged value for a code that means the same thing.
• If a category or a restricted Purchase event comes with the notifications, the fix is a clean data source, not more field cleanup.

Request a demo and we'll trace what triggered your notification with you.