How Data Sanitization Protects Health & Wellness Stores

​

The Short Version

For stores flagged under Meta’s Health & Wellness category, Upstack Data operates in server-side-only mode: the Meta browser pixel is removed entirely and all event data is sent from Upstack’s servers to Meta through the Conversions API (CAPI). Before any event reaches Meta, Restricted Category Mode replaces product names with placeholders, removes product categories and brands, and replaces page paths with a hash. Meta still gets what it needs for attribution and optimization — event type, value, currency, product IDs, and customer identifiers — but not the product content that causes flags.

​

Why the Meta Browser Pixel Is Removed

The standard Meta pixel is a JavaScript snippet that runs in your customer’s browser. When someone visits your store, the pixel automatically reads information from the page and sends it to Meta. This includes:

• The page URL (e.g., yourstore.com/products/organic-ashwagandha-supplement)
• The page title (e.g., “Organic Ashwagandha Supplement - 60 Capsules”)
• Product data embedded in the page (names, descriptions, categories)
• Referrer URLs that may contain health-related search terms
• Content IDs and other metadata tied to your product catalog

This happens automatically. For a Health & Wellness flagged store, it means Meta keeps receiving data full of the exact keywords and content that triggered the flag in the first place — product names with words like “supplement,” “vitamin,” “collagen,” “probiotic,” or “CBD.” Continuing to send this kind of data through the browser pixel can:

• Reinforce the flag, making it harder to resolve
• Trigger a re-flag if you’ve set up a new pixel
• Reduce Event Match Quality as Meta discards or downgrades events it considers non-compliant

You cannot selectively control what the browser pixel sends — it reads the page content and transmits what it finds. In a standard Upstack setup, the browser pixel and the Conversions API both send each event (deduplicated through a shared event_id); in Health & Wellness mode, the browser side is removed and only the Conversions API sends events.

​

How Events Reach Meta

Upstack doesn’t load any Meta JavaScript on your store, so Meta can’t read your page content directly. Other apps can still load it — see What You Need to Do.

​

What Gets Stripped

Meta’s Health & Wellness flagging system doesn’t just look at your domain once and make a decision. It continuously evaluates the data your pixel sends. Every event that arrives at Meta carries metadata — and that metadata can contain the keywords, product names, and URLs that trigger or reinforce the flag. Here’s what a typical unsanitized Purchase event looks like when sent to Meta: The product is called “Organic Ashwagandha Supplement” and the category is “Supplements > Adaptogens.” Both tell Meta’s automated systems that this store sells health and wellness products, and so does the page path. Restricted Category Mode changes these fields before any event is sent to Meta:

​

Product Names

Product titles like “Collagen Peptides Powder” or “Vitamin D3 5000 IU” are exactly what Meta’s classifiers look for. Upstack replaces each product’s title with a placeholder built from its product ID. Before: "title": "Organic Ashwagandha Supplement - 60 Capsules" After: "title": "UPSTACK_HW_8123456789012"

​

Product Categories and Brands

Category paths often contain the broadest health and wellness terms: “Supplements,” “Vitamins,” “CBD,” and so on. Before: "category": "Supplements > Adaptogens" After: Field removed. The product’s brand is removed too.

​

Page URLs (event_source_url)

The domain is replaced with your alias domain, and the path is replaced with a SHA-256 hash. Meta can’t see paths like /products/organic-turmeric-capsules or /collections/immune-support. Before: "event_source_url": "https://yourstore.com/products/organic-ashwagandha" After: "event_source_url": "https://youraliasdomain.com?path=9f2c…" Without a domain alias, the path is still hashed but the domain stays your store’s domain.

​

Sent Unchanged

Product and variant IDs (content_ids), quantities, item prices, the order ID, and the order value are sent as they are.

​

What Meta Receives

After sanitization, the event that reaches Meta looks like this: Always sent:

• event_name — The standard event name, such as Purchase. For most conversion events Upstack also sends a legacy UPSTACK_HW_* copy (see Health & Wellness Category Events (Deprecated)). Optimize on the standard event.
• Event time — When the action happened.
• event_source_url — Your alias domain with a hashed path.
• user_data — Hashed email, phone, first and last name, city, state, zip, country, and gender; an external ID; the Facebook click ID (fbc) and browser ID (fbp); IP address and user agent. These are the same customer identifiers as in a standard setup, and they contain no product information.

Sent for events with products or a value:

• value, currency, and order ID
• contents — Product and variant IDs, quantity, item price, and the placeholder title

Never sent:

• Product names, descriptions, categories, or brands
• Real page paths, or your store’s domain when the domain alias is on

​

Why This Level of Scrubbing Is Necessary

You might wonder: “Can’t we just rename the products or change the URLs?” In practice, partial measures don’t hold up: Meta’s classifiers are broad. They don’t just look for the word “supplement.” They flag terms like “capsules,” “extract,” “daily,” “formula,” “blend,” and dozens of other words common across health product catalogs. Trying to rename everything to be compliant is a losing game. The flag is persistent. Once a domain is flagged, Meta’s systems are primed to look for health-related content from that source. Even mildly suggestive terminology can reinforce the classification. Clean scrubbing removes the ambiguity entirely. You can’t control every surface. Product data shows up in URLs, page titles, meta tags, structured data, Open Graph tags, and more. The browser pixel can read all of these. Server-side sanitization is the only way to ensure nothing slips through. Future-proofing. If you add a new product line or a new employee adds products with flaggable names, the sanitization layer catches it automatically. You don’t need to audit every SKU before launching.

​

How This Differs from Standard CAPI Setups

Not all server-side tracking is the same. Here’s how Upstack’s H&W implementation differs from a standard CAPI setup:

Feature	Standard CAPI	Upstack H&W (Server-Only)
Browser pixel active	Yes (redundant tracking)	No (completely removed)
Data sanitization	No	Yes (product names, categories, brands and page paths)
Event source URL	Your real domain	Clean alias domain
Product data sent	Yes (IDs, names, categories)	IDs, prices and quantities only (names replaced)

A standard CAPI setup still relies on the browser pixel running alongside it. For H&W stores, that browser pixel is the source of the problem. Upstack’s approach eliminates it entirely and controls every byte of data that reaches Meta.

​

How It Fits with the Other Components

Server-side-only delivery and data sanitization are two pieces of the four-part H&W solution:

• Server-side-only tracking ensures the browser pixel never sends unsanitized data directly to Meta.
• Data sanitization cleans the event payload before it leaves Upstack’s servers.
• Domain aliasing replaces the flagged domain in the event_source_url field.
• Standard Purchase optimization — campaigns optimize on the standard Purchase event. Upstack still sends the legacy UPSTACK_HW_* events alongside it; ignore them (see Health & Wellness Category Events (Deprecated)).

All four layers work together. If you removed sanitization but kept the other three, product data in the event payload could still trigger a re-flag. If you kept sanitization but sent from the flagged domain, Meta’s domain-level restrictions would still apply.

​

What You Need to Do

Turn on Restricted Category Mode and Domain Alias on the Meta destination’s Category Mode tab (see How to Set Up Restricted Category Mode for Meta in Upstack Data). Upstack then skips the Meta browser pixel, sends events through the Conversions API only, and sanitizes them. See How to Set Up a Health & Wellness Pixel for Meta. How to Disable Facebook and Instagram Data Sharing in Shopify →

​

Related Articles

• How Upstack Data Solves Health & Wellness Restrictions
• How to Set Up a Health & Wellness Pixel for Meta
• How to Disable Facebook and Instagram Data Sharing in Shopify