Answer

What Is LegitScript Certification and Who Needs It?

Reviewed November 3, 20266 min readBy Michael Borgia, MedScale Health

Short answer

LegitScript certification is an independent review by LegitScript, a Portland, Oregon company founded in 2007, that checks a healthcare business against nine published standards so ad platforms and card networks can rely on it. MedScale Health, a paid ads agency for US telehealth brands and clinics, treats it as the first step for any telehealth brand or online pharmacy that wants prescription drug ads on Meta, because Meta requires those advertisers to be actively certified with LegitScript. Since November 2, 2026, businesses offering six HHS-covered peptides can qualify under conditions.

What is LegitScript certification?

LegitScript certification is an independent review in which LegitScript checks a healthcare business against its published standards and then lists the business as certified, so ad platforms and payment companies can rely on that check. MedScale Health, a paid ads agency for US telehealth brands and clinics, prepares and files these applications for telehealth brands, because Meta requires online pharmacies and telehealth providers to be actively certified with LegitScript before they can promote prescription drugs. This page is marketing guidance, not legal advice; check the sources at the end before acting on a rule.

  • LegitScript is a private company, based in Portland, Oregon and founded in 2007.
  • Healthcare certification is for businesses that sell, prescribe, facilitate or process payments for prescription medications online.
  • Meta requires it before online pharmacies and telehealth providers promote prescription drugs, and Microsoft requires it for addiction recovery advertisers.
  • Certification makes a business eligible to apply on each platform. Each platform still applies its own ad policies.
  • Since November 2, 2026, a business offering one of six peptides covered by an HHS policy can qualify when the offering meets that policy's conditions.

Is LegitScript a real company?

LegitScript is a real, private company. Its about page says, "Based in Portland, Oregon, LegitScript was founded in 2007 in response to the proliferation of dangerous counterfeit pharmaceuticals sold on the internet." The same page says Google, Facebook and LinkedIn rely on LegitScript to vet sellers and advertisers in regulated industries such as telemedicine and addiction treatment. LegitScript's certification status page describes the company as "a private certification body and not affiliated with any law enforcement agency." MedScale Health treats an active LegitScript listing as the first requirement for any prescription drug ad plan on Meta.

What does LegitScript healthcare certification check?

LegitScript Healthcare Merchant Certification is intended, in LegitScript's words, for "businesses involved in the online sale, prescribing, facilitation, or payment processing of prescription medications (and certain over-the-counter medications)." Addiction treatment and CBD businesses have their own LegitScript programs. The healthcare program reviews each applicant against nine standards, and MedScale Health gathers the documents for each one before an application is filed.

  • Licensure and business registration, both where medications are prescribed or dispensed and where the patient is.
  • Legal compliance, including not facilitating medications that lack the required regulatory approval.
  • Prior discipline and history, with criminal, regulatory and civil matters from the past ten years disclosed.
  • Affiliates and partners, such as the partner pharmacies that fill prescriptions.
  • Patient services, meaning the website discloses every state or country where care is available.
  • Privacy, including HIPAA compliance for US businesses that handle protected health information.
  • Validity of prescription, so no drug is prescribed or dispensed before a licensed professional provides care.
  • Transparency about the pharmacy, staff, practitioners, drugs, treatments and financial transactions.
  • Advertising, where ads that appear to break a platform's terms of service can be grounds for denial or revocation.

Who needs LegitScript certification to advertise?

Telehealth brands and online pharmacies that want to promote prescription drugs on Meta need it first. Meta's Drugs and Pharmaceuticals policy says "Meta requires online pharmacies and telehealth providers to be actively certified with LegitScript," and that once certified they must request authorization from Meta. Certified advertisers can then target people 18 or older in the countries where they are certified, and the United States is one of three eligible countries. Ads that promote telehealth services generally, without promoting a drug, need no written authorization. MedScale Health runs those service ads first and adds drug-name ads once certification and Meta's authorization are in place.

Other platforms name LegitScript in narrower places. Microsoft Advertising requires advertisers of drug or alcohol addiction services, such as rehab facilities and sober living facilities, to be certified by LegitScript, and requires online pharmacies and telemedicine providers that sell prescription drugs to be preapproved through its own program. TikTok's United States rules ask brick-and-mortar and online pharmacies for proof of certification by NABP, LegitScript or a regional equivalent. LegitScript's own FAQ calls its certification "a necessary part of the approval process for conducting card-not-present transactions with Visa and Mastercard and for advertising on Google and Bing." The overview of which treatments need certification on each platform goes service by service.

Some businesses can't apply at all. LegitScript's FAQ lists in-person-only clinics that do not offer telemedicine prescribing or process card-not-present payments for prescription drugs as generally not eligible, along with supplement-only businesses, medical device businesses and research-use-only chemical businesses, peptides included. Whether an in-person practice needs LegitScript has its own answer.

Does LegitScript certification get every health ad approved?

LegitScript certification does not get every ad approved. LegitScript's FAQ lists eligibility to advertise on platforms such as Google, Meta, Netflix, LinkedIn, TikTok and Microsoft Bing as a benefit, "subject to each platform's advertising policies", and its healthcare page tells businesses that each platform and social network has its own ad policies and requirements. On Meta, a certified telehealth brand still needs Meta's authorization, a disclaimer to consult a licensed health professional or obtain a valid prescription, and copy that clears Meta's personal attributes policy, which bars ads that assert or imply a person's physical or mental health. MedScale checks every ad and landing page against the named platform rule before it is submitted.

How do you check if a website is LegitScript certified?

LegitScript runs a public lookup. Its status page says, "Enter a website to see if it is LegitScript-certified, legitimate, or rogue," and covers websites in healthcare, addiction treatment and CBD. Healthcare certification applies to the root domain, so if example.com is certified, LegitScript's FAQ says shop.example.com and support.example.com are covered under the same certification. The guide on how to verify a LegitScript certification covers what to check before relying on a partner's seal. MedScale Health runs that lookup on a brand's own domain and its pharmacy partners in its LegitScript readiness review.

Can peptide sellers get LegitScript certified?

Peptide sellers can qualify for six peptides since November 2, 2026, under conditions. LegitScript says it "has updated its certification review approach, effective November 2, 2026" to reflect an HHS enforcement discretion policy for 503A compounding of BPC-157 acetate, TB-500 acetate, Epitalon acetate, Semax free base, KPV acetate and MOTS-C acetate. In LegitScript's words, "offering one of these peptides should not, by itself, prevent a merchant from achieving certification when the offering meets the enforcement discretion policy's conditions" and all other certification standards and laws.

The update has limits. 503B outsourcing facilities are not covered, only formulations with a single active ingredient qualify, and LegitScript says "Combinations such as BPC-157 with TB-500 or semaglutide do not meet that requirement." Offering other peptides outside the policy "remains a barrier to certification," and research-use-only peptide businesses stay generally ineligible. LegitScript also says "Advertising platforms and payment providers set their own policies, which may differ from LegitScript's requirements," so MedScale Health checks what Meta allows for peptides before it builds a campaign for a certified peptide clinic.

How does MedScale help a brand get LegitScript certified?

MedScale's LegitScript service starts with eligibility: the business type, the locations served and the scope of care, which is the first step in LegitScript's own process. MedScale then gathers what LegitScript asks for before an application, including business and professional licenses, registration details, DEA information where it applies, a privacy policy, the compliance status of every affiliate and partner pharmacy, and descriptions of the offerings, marketing claims and ads. Service ads that promote telehealth generally can run on Meta while the application is reviewed, and the Meta authorization request follows certification. New telehealth brands can start with MedScale's launch plan, which puts certification ahead of the first prescription drug ad.

Common questions

01Is LegitScript a real company?
Yes. LegitScript is a private company based in Portland, Oregon and founded in 2007, and it describes itself as a private certification body, not affiliated with any law enforcement agency. Its about page says Google, Facebook and LinkedIn rely on it to vet sellers and advertisers.
02Where is LegitScript located?
LegitScript is based in Portland, Oregon, according to its about page, which also says the company was founded in 2007 in response to counterfeit pharmaceuticals sold online. Applications are completed in LegitScript's secure client portal, wherever the business is located.
03Does LegitScript certify peptide businesses?
For six peptides, yes, since November 2, 2026: BPC-157, TB-500, Epitalon, Semax, KPV and MOTS-C, in the forms and routes HHS's policy covers, from qualifying 503A compounders, as single-ingredient products. Other peptides remain a barrier, research-use-only businesses stay ineligible, and ad platforms set their own rules.
04Does LegitScript certification mean every ad gets approved?
No. LegitScript says certification makes a business eligible to advertise on participating platforms subject to each platform's advertising policies. On Meta a certified brand still needs Meta's authorization and copy that passes Meta's other ad standards, which is why MedScale pre-checks each ad.
05Can an in-person clinic get LegitScript certified?
Usually not. LegitScript's FAQ lists in-person-only clinics that do not offer telemedicine prescribing or process card-not-present payments for prescription drugs as generally not eligible, and med spas face the same test. A clinic that adds telemedicine prescribing may become eligible.
06Can MedScale help with LegitScript certification?
Yes. MedScale Health prepares and files LegitScript applications for US telehealth brands, gathers the licenses, partner details and ad materials LegitScript reviews, and files Meta's prescription drug authorization once certification is granted, so the ad plan and the certification move together.

Sources

  1. 01LegitScript: About LegitScript (based in Portland, Oregon, founded in 2007)checked November 3, 2026
  2. 02LegitScript: Healthcare Merchant Certification (certification standards and what you need before you apply)checked November 3, 2026
  3. 03LegitScript: Healthcare Certification FAQs (eligibility, scope, root domains and benefits)checked November 3, 2026
  4. 04LegitScript: See If a Website Is Certifiedchecked November 3, 2026
  5. 05LegitScript: HHS's Peptide Compounding Policy: What Healthcare Businesses Need to Know (November 2, 2026)checked November 3, 2026
  6. 06Meta Advertising Standards: Drugs and Pharmaceuticals (prescription drugs)checked November 3, 2026
  7. 07Meta Advertising Standards: Privacy Violations and Personal Attributeschecked November 3, 2026
  8. 08Microsoft Advertising policy: Healthcare and Pharmaceutical (last updated Oct 5, 2026)checked November 3, 2026
  9. 09TikTok Ads policy: Healthcare and Pharmaceuticals (United States section)checked November 3, 2026

Related answers

Last reviewed November 3, 2026. Platform policies change often; we re-verify every answer quarterly.

Growth audit

See where your growth is leaking.

We audit the ads, the landing pages, the tracking and the compliance posture, then hand you the roadmap. The people writing it have run the same funnel from the inside. You keep it whether or not we work together.

Reviewed
Funnel, tracking, and compliance posture
Discussed
One 30-minute call with the operator on your account
Delivered
A written roadmap within 5 business days