LegitScript certification is a third party approval that Google, Meta, Microsoft, and major payment processors accept as proof that a healthcare business is licensed and operating legally online. You need it if you sell or prescribe prescription drugs online, offer telehealth that leads to a prescription, run an online pharmacy, or advertise addiction treatment; most in person clinics that do not name prescription drugs in their ads do not.
This guide is for owners and marketing leads at TRT and HRT clinics, weight loss programs, men's health practices, telehealth brands, and med spas. You will leave knowing whether your business model needs LegitScript certification, what it costs in 2026, how long it really takes, what the reviewers check, and what to do instead if certification is not worth it for you.
We run Google and Meta campaigns for hormone, wellness, and aesthetic clinics, and our view is simple: some clinics should get certified so they can advertise restricted treatments directly. For clinics that can't, or don't want to make that investment, there is another path, built around benefits and outcomes instead of specific medications. Which one fits depends on what you sell.
Key takeaways
- LegitScript certification is a private approval, not a law. Google and Meta require it for telehealth that prescribes, online pharmacies, and addiction treatment.
- It costs $975 to apply plus $2,150 a year per website (2026 pricing), and about half of applicants are certified within two weeks.
- Most in person clinics that advertise consults and outcomes, not drug names, can advertise without it.
- Certification does not unlock stem cells, PRP, or popular unapproved peptides like BPC-157 and TB-500.
- Approval is step one. Google and Meta each run their own approval before restricted ads can run.
What is LegitScript certification?
LegitScript is a private company that monitors healthcare and other high risk businesses online. Its Healthcare Merchant Certification reviews your licenses, your prescribers and pharmacy, and your website, then keeps monitoring you for as long as you stay certified. LegitScript describes the program against nine certification standards covering licensure, legal compliance, patient privacy, transparency, and advertising practices.
Two points get missed:
- It is not a license or a law. No state or federal agency requires it. It matters because the ad platforms and payment processors require it for certain business models.
- It certifies a website, not a company. Each root domain you want to advertise needs its own application and its own annual fee.
LegitScript runs separate programs for addiction treatment, CBD, and other categories. This guide focuses on healthcare certification, with the addiction treatment numbers included for comparison.
Who needs LegitScript certification?
Under Google's Healthcare and medicines policy, online pharmacies, telemedicine providers that prescribe, and addiction treatment providers in the United States must be certified before their ads will run. Google's prescription drug services policy is where the accepted certifiers are listed; LegitScript is the main route for most clinics and telehealth brands, and pharmacies can also use NABP.
Meta's Drugs and Pharmaceuticals ad standards require online pharmacies and telehealth providers promoting prescription drugs to hold LegitScript certification and receive written permission from Meta. Approved ads can only target people 18 and older in the United States, Canada, and New Zealand.
Here is how that plays out by business model:
| Your business | Google Ads | Meta ads | Do you need LegitScript? |
|---|---|---|---|
| Telehealth that prescribes (TRT, GLP-1, ED, hair loss) | Certification required | Certification plus Meta approval required | Yes |
| Online or mail order pharmacy | Certification required (LegitScript or NABP) | Certification plus Meta approval required | Yes |
| Addiction treatment center or sober living | Certification required | Certification required | Yes, through the addiction treatment program |
| In person clinic that names Rx drugs in ads or keywords (semaglutide, testosterone) | Restricted without certification | Restricted without approval | Usually, if the drug is the offer |
| In person clinic that advertises consults and outcomes, not drug names | Generally allowed within policy | Generally allowed within policy | Usually not |
| Med spa advertising facials, laser, body contouring | Allowed within policy | Allowed within policy | No |
| Regenerative treatments (stem cells, PRP) | Prohibited | Not unlocked by certification | Certification does not help |
| Unapproved peptides (BPC-157, TB-500, retatrutide) | Not advertisable | Not advertisable | Certification does not help, and offering them can jeopardize it |
The clinic rows are where most confusion lives. Google's restricted drug terms policy governs prescription drug names in ads, keywords, and landing pages. In 2025 Google loosened the rule for non promotional use, such as safety warnings and legal notices, but targeting keywords that contain prescription drug terms still requires certification. If "semaglutide" or "testosterone cypionate" is the headline of your offer, you are in certification territory even if patients are seen in person.
GLP-1 advertising is under particular scrutiny. LegitScript reported a 1,200 percent increase in violative and problematic ads for compounded GLP-1 drugs, and platform enforcement has followed.
Who usually does not need it
If your ads sell a consultation, a result, or a service that is not a prescription drug, you can usually advertise without LegitScript. That covers most med spas and many hormone clinics that lead with symptoms and outcomes ("low energy, poor sleep, low drive? Book a men's health consult") rather than drug names.
It also does not help with anything the platforms ban outright. Google's speculative and experimental medical treatment policy prohibits ads for stem cell therapy, other cellular and gene therapies, platelet rich plasma, and similar regenerative treatments. Certification does not unlock those.
Peptide clinics: what LegitScript does and does not cover
Peptides are the fastest growing question in this space. In a September 2026 update, LegitScript said many of the most popular peptides, including retatrutide, BPC-157, TB-500, and cagrilintide, are not currently eligible for compounding, sale, or use under US rules. An FDA advisory committee recommending some of them for the compounding list does not change that until a final rule is published.
For a certified business, LegitScript counts more than selling as a violation:
- Offering, promoting, or advertising an impermissible peptide, even if you never dispense it.
- Routing it through a partner that prescribes or dispenses on your behalf.
- Efficacy or safety claims, dosing recommendations, or calling a substance "clinically proven" without clear disclosures.
Educational content that stays factual and clearly says a substance is unapproved is generally allowed. Content that gives a reader a reason to seek out or use the product is not.
The practical takeaway for a hormone or wellness clinic: certification can cover your prescribing model, but it will not make unapproved peptides advertisable, and offering them can put an existing certification at risk. Build campaigns around the approved treatments and the outcomes patients want.
How much does LegitScript certification cost?
LegitScript's published healthcare pricing for 2026:
- Application fee: $975 per website, nonrefundable whether or not you are approved.
- Annual certification fee: $2,150 per website, charged only after approval.
- Probationary certification: $3,995 per website per year, a tier for applicants that need closer monitoring.
- Expedited review: an additional $2,500 per application to start the review within two business days.
So a single clinic website costs $3,125 in the first year at the standard tier, or $5,625 with expedited review. Three domains cost three times as much.
Addiction treatment has its own pricing, charged per facility: an application fee of $1,395 to $1,595 and an annual fee of $2,550 to $3,095.
The fees are the smaller cost for most clinics. The bigger one is the staff time to gather licenses, fix the website, and answer follow up requests, plus the months of ad spend you lose if you apply before you are ready.
How long does LegitScript certification take?
LegitScript says that on its healthcare certification page about half of applicants are certified in two weeks or less, and 70 to 80 percent in under four weeks. Per its FAQ, an analyst starts reviewing within 10 business days of a complete application, or within two business days with expedited review.
The applications that drag on for months are usually incomplete ones. Each missing license or website problem produces a request for information, and each round trip adds time. Prepare before you pay the fee.
Approval from LegitScript is not the finish line. You still apply to Google for its healthcare certification and go through Meta's onboarding for written permission, so plan for that extra step before launch dates.
LegitScript certification requirements: what gets reviewed
Requirements differ by business model, but for a clinic or telehealth brand expect scrutiny in these areas, drawn from LegitScript's standards and terms and conditions:
- Licensure everywhere you operate. Your business, your prescribers, and your pharmacy must be licensed in the state where care is provided and in every state where patients are located. A telehealth brand serving 30 states needs coverage in all 30.
- Your pharmacy relationship. Who dispenses, whether they are licensed where patients live, and, for compounded drugs, whether they operate legally.
- How patients are evaluated. Reviewers look at how a prescriber evaluates each patient before a prescription is written, which matters most for telehealth.
- Legal and regulatory history. Past actions against the business or its principals come up, and may put you in the probationary tier.
- The website. Accurate claims, clear contact details, a privacy policy, and nothing that promises more than the treatment can deliver.
- Ongoing duties. You must tell LegitScript within 30 days of any change to your licenses or DEA registration, and your site is monitored for as long as you stay certified.
How to get LegitScript certified, step by step
- Confirm you need it. Use the table above. If your ads can sell the consult instead of the drug, you may be able to skip certification entirely.
- Map licenses to service areas. List every state you serve and the license that covers each one, for the business, each prescriber, and the pharmacy.
- Clean up the website before applying. Remove unsupported claims, add contact details and policies, and make sure the site matches what you actually do.
- Apply for each domain on LegitScript's site and pay the $975 application fee per website.
- Answer requests quickly. Response time on your side is the biggest variable in the timeline.
- Pay the annual fee on approval and add the certification seal and lookup link to your site.
- Apply to the platforms. Submit Google's healthcare certification application, complete Meta's onboarding, and only then build campaigns that name prescription treatments.
- Stay compliant. New landing pages, new domains, new states, and new treatments all need to fit your certification.
This is general information, not legal advice. Talk to a healthcare attorney about licensure questions, especially for multi state telehealth.
Is LegitScript certification worth it for your clinic?
It is worth it when the prescription is the product. If patients search for a drug by name, and your business is telehealth, a pharmacy, or a clinic built around a specific medication, certification opens the demand you cannot otherwise reach, and a few thousand dollars a year is small against the patients it lets you reach.
It is often not worth it for an in person hormone, wellness, or aesthetic clinic whose patients are really buying a result: more energy, weight off, better skin. For those clinics we build campaigns around benefits and outcomes that stay within policy, then put the effort into the parts that decide whether a lead becomes a patient: candidacy quizzes, fast and discreet follow-up, and reporting in booked consults rather than clicks.
That is the approach behind our work with Innovation Health, a hormone optimization and wellness clinic serving men and women. They held a 40% lead-to-consult rate for a full year and grew monthly new patients by more than 150% in eight months. The lesson for clinics debating certification: what happens after the click usually moves revenue more than which words you are allowed to put in the ad.
If you run a specialty or hormone clinic or a med spa, decide on certification by business model first, then by how much of your demand actually searches for the drug by name.
Frequently asked questions
Is LegitScript certification required by law?
No. LegitScript is a private company, and no state or federal law requires its certification. It becomes effectively required because Google, Meta, and many payment processors will not let certain healthcare businesses advertise or process payments without it.
How much does LegitScript certification cost?
For healthcare merchants, LegitScript charges a nonrefundable $975 application fee and a $2,150 annual fee per website, or $3,995 a year at the probationary tier. Expedited review adds $2,500. Addiction treatment certification is priced per facility at $1,395 to $1,595 to apply and $2,550 to $3,095 a year.
How long does LegitScript certification take?
LegitScript reports that about half of applicants are certified in two weeks or less and 70 to 80 percent in under four weeks. Incomplete applications take much longer because every missing document triggers another round of questions. Add time after approval for Google and Meta to process their own applications.
Does a med spa need LegitScript certification?
Usually not, if the ads promote services and results rather than prescription drugs by name. A med spa that wants to advertise a prescription weight loss program by drug name, or that sells prescriptions online, is in a different position and will likely need it.
Does LegitScript certification let me advertise any treatment?
No. It lets you advertise the business model and products you were certified for, within each platform's rules. Treatments Google prohibits as speculative or experimental, such as stem cell therapy and PRP, stay prohibited, and your ads still have to avoid misleading health claims.
Can a peptide clinic get LegitScript certified?
A clinic can be certified for its prescribing model, but LegitScript does not allow certified businesses to offer, promote, or advertise peptides that are not currently permissible under US rules, such as BPC-157, TB-500, and retatrutide. Certification will not make those peptides advertisable on Google or Meta.
How do I check if a business is LegitScript certified?
Certified businesses display a LegitScript seal that links to their verification page, and LegitScript offers a public lookup on its website where you can search by domain. If a site shows the seal but the lookup does not confirm it, treat the claim with caution.
Not sure whether certification is worth it for your clinic? Book a call and we will look at your offer, your ads, and your demand, and tell you which path pays back.