Meta restricted a Shopify maternity store in five weeks: the full breakdown of what happened and what we did

This one is long, because the details are the useful part. A Shopify store we work with was restricted by Meta this autumn, and we went through every step of it with the founder. We have left out the name and anything that would identify the store. Everything else is what happened, including the parts that were already too late by the time we saw them.

The store sells maternity clothing on Shopify: dresses, leggings, nursing tops and a few support products. Most of its buyers are in the UK and Northern Europe, and Meta ads are how most of them find the brand for the first time. The brand is strong, the creative is good, and the team is small. For part of the month that mattered, the founder was unwell.

On 1 September Meta sent a warning that the site might belong to a restricted category. If you have had one, you know how it reads: serious in tone, vague in detail, and no deadline you can point to. Nothing changed in the ad account that day, so nothing was done. That is not carelessness. It is what almost everyone does with a notice that does not seem to change anything.

On 2 October Meta blocked the store's standard events. Purchase and Add to cart stopped arriving in Events Manager. The campaigns kept running and kept spending, but no sales signal was coming back, so Meta was now optimising blind.

On 6 October the founder requested a review, which is the obvious thing to do. Meta rejected it the same day and added a block for visitors in Europe. The status on the notice read full_blocking_web_actions for Europe, with standard event blocking for other locations. Europe was exactly where most of the buyers were. That is when we were asked to look, and by then the question was no longer how to avoid a restriction. It was how to keep a business running inside one.

First, the question everyone asks: why is a clothing store health? Because Meta is not judging what you sell. It is judging what your data says about the person who bought it. Meta's own help page lists sexual and reproductive health among the kinds of information it does not want businesses to send, and pregnancy sits in that group. An event that says a known person bought a maternity product says something about that person's body, even if the product is a dress.

Then we went through the store, its events in Events Manager and its Shopify settings. We found six things. None was dramatic on its own. Together they explain why the review never had a chance.

One: Shopify's Facebook and Instagram channel was sending everything. The channel is built to give Meta as much as it can: what was viewed, added and bought, the link to the product page, and the customer's email, phone and name. Every event carried the name of a pregnancy-related product and the link to its page. We saw it on the events themselves. It was the biggest source by far, because it repeated on every event, all day, including all the weeks Meta was deciding what to do with the store.

Two: advanced matching was sending gender and date of birth. On a maternity store, those two fields turn a hint into a near certainty. Turning them off takes two clicks, and the matching you lose is small.

Three: the founder's reasonable objection was that the data was hashed and match quality was high. Both were true. Hashing protects the identity on the way to Meta. It does nothing about what the event says. A hashed email attached to an event naming a pregnancy product still tells Meta that a specific person bought it. High match quality only meant Meta knew exactly who.

Four: the words on the site. Product titles used pregnancy and postpartum throughout, and so did the meta description, which is the first thing a crawler reads. One product page had a sentence about easing pressure on the lower back, hips and abdomen. That is a health claim, whatever the product is, and it was the clearest piece of health language on the whole site.

Five: the alt text. This is the one nobody knew about. The photos were fine. But behind each image sits alt text, the description screen readers use, and whoever set up the products had filled it with full product descriptions. The home page alone had 75 images whose alt text said pregnant or postpartum. Nobody had ever seen it, because you do not see alt text. A crawler does.

Six: the timing of the review. It was requested while all five of the above were still live. Vendor reports describe the review as automated: one button, no way to attach evidence, a decision in days, and a 30 day wait before you can ask again. If it is a re-scan, then a re-scan of the same data finds the same thing. That is what happened.

The decision that mattered most had nothing to do with tracking. It was where the buyers were. Outside a fully blocked region, a clean, neutral event sent from a server can still reach Meta, and campaigns can optimise for a custom conversion built on it. Inside a fully blocked region, nothing reaches Meta from that domain, from us or from anyone. The store's sales by country answered it in a minute: mostly the UK and Northern Europe. We could not confirm whether Meta's Europe includes the UK, so we planned for the worse case. That meant two tracks at once.

Here is what we actually did, in order. We connected Meta in the store's DataCops account, removed an old test code, and turned Health mode on. The founder turned off data sharing in Shopify's Facebook and Instagram channel and removed gender and date of birth from advanced matching. We created a custom conversion in Events Manager from the neutral order event, P_1, with the Purchase category and the plain name Order, and the agency pointed new sales campaigns at it instead of the blocked Purchase event. The founder started a word list for titles, the meta description, the claim sentence and the alt text, old text next to new, with photos, products and design untouched. For Europe, the agency kept ads running on traffic goals and broad targeting, because there is no conversion signal to optimise for there. We watched the delivery log for the first P_1 to reach Meta. And we set a date about four weeks out for one review request, with clean data behind it.

There was one idea we refused outright. Someone suggested sending ad traffic to a clean redirect domain that would bounce visitors on to the store. Meta would see one page and the customer another. That is the practice most likely to get an ad account closed, and an ad account is much harder to replace than a domain.

We also told the founder the hard part before it happened, because it is easier to hear early. If a clean review is rejected again, there is nothing more anyone can do on that domain. Meta does not explain the decision and does not negotiate it. The domain keeps working for organic search, Instagram, email and returning customers, which already bring a real share of sales, and Meta ads can keep running without conversion data.

And if it comes to that, there is a last resort with real risks: a separate store on a new domain, with a narrower range, maternity fashion only, while the support products and anything making a claim stay on the original. It only helps if every page is clean before a single ad points at it, with a new pixel and dataset and Health mode on from day one. Meta can still link the two through the same ad account, business portfolio or payment method, so nobody can promise it works, and it is not part of the rescue. It is what you consider after the rescue fails.

Where it stands: the clean-up is under way and the clean signal is going out wherever Meta still accepts one. The ending is not written yet. We will add an update to this thread with what Meta does at the next review, good or bad.

If we had to boil it down: the warning is the deadline, not the block. Most of the leak came from defaults nobody chose. Hashing is not cleaning. The words you cannot see count as much as the ones you can. A review is a re-scan, so clean first and ask once. Where your buyers are decides your strategy. Keep your own count of sales. And never depend on one channel for all of your customers.

If you have been through this, what happened at your second review? And if you are in the quiet weeks right now, with a warning and nothing blocked yet, post what your notice says and we will tell you what we would do first.

For reference, DataCops Health mode sends Meta a fixed list of fields only: the click ID, hashed email and phone, value, currency, IDs and the homepage address, under a neutral event name such as P_1, and the delivery log shows exactly what left. It cannot lift a restriction. Only Meta can.