LegitScript certification requirements come in two parts. Your business is reviewed against 9 standards: licensure in each patient’s state, legal compliance, prior discipline, affiliates and partners, states served, privacy, valid prescriptions, transparency and advertising. You also accept LegitScript’s Terms and Conditions, which add rules on domains, WHOIS, the seal and notice of changes.
Requirements checked on October 24, 2026, against LegitScript’s standards document (CHM-CE236-CR-01) and its Terms and Conditions (Version September 15, 2026).
Who LegitScript’s telemedicine requirements apply to
LegitScript’s telemedicine requirements apply to businesses that “provide remote clinical services through licensed healthcare professionals,” which covers a GLP-1 telehealth brand that wants prescription drug ads on Meta or Google. A digital health platform doesn’t qualify if it has no “contractual relationship with the medical providers and pharmacies that your website directs users to.”
In a release of September 22, 2026, reported by ppc.land on September 25, LegitScript said it had passed 10,000 certified websites across healthcare, addiction treatment and other regulated industries.
The 9 LegitScript certification standards for a GLP-1 telehealth business
LegitScript’s standards document says a business must meet all 9 standards “to earn and maintain” certification. The table pairs each standard with what a GLP-1 telehealth brand should have ready to show it.
| # | Standard | LegitScript’s wording (excerpt) | What a GLP-1 brand has ready |
|---|---|---|---|
| 1 | Licensure & Business Registration | Licensed in “the jurisdiction in which the patient is located” | Prescriber licenses for every state you serve |
| 2 | Legal Compliance | Must not facilitate medications that “do not hold the necessary authorization or approval” | Licenses to prescribe and dispense; your medication list |
| 3 | Prior Discipline and History | Disclose violations and litigation “at any time over the past ten years” | A disclosure file for principals, key staff and practitioners |
| 4 | Affiliates and Partners | Partner pharmacies “generally required to be LegitScript-certified or accredited by another recognized body” | Pharmacy certification or accreditation; all affiliates and domains |
| 5 | Patient Services | Websites “must clearly disclose all states” where services are available | A state list on the site that matches your licenses |
| 6 | Privacy | US applicants handling PHI “must comply with all applicable HIPAA requirements” | Posted privacy policy; SSL wherever patient, medical or payment data is processed |
| 7 | Validity of Prescription | No prescription “prior to the provision of care by a licensed medical professional” | A clinical workflow where the provider evaluates and decides |
| 8 | Transparency | Practices and offers must be “accurate, transparent, and not misleading” | Accurate details on pharmacy, practitioners, drugs, treatments and charges |
| 9 | Advertising | Ads must be “accurate, transparent, and not misleading to the public in any way” | Current ads, landing pages and claims |
Standard 4 is wider than it looks. LegitScript defines affiliates as anyone with a “commercial and/or professional relationship” with you, and it “may include entities that are promoted on the domain.”
On Standard 3, White Label MD said in LegitScript’s June 19, 2026 Q&A: “What sinks applications usually isn’t the issue itself; it’s the appearance of hiding it.”
Documents to gather before you apply for LegitScript certification
LegitScript’s Healthcare Certification page names six groups of documents to have ready, and its January 2026 step-by-step guide adds two more items. As a checklist for a GLP-1 telehealth brand:
- Current licenses for the business, facilities and staff
- Business registration numbers and documents
- DEA certificate information, if it applies
- A HIPAA-compliant privacy policy
- Compliance status for every affiliate and partner pharmacy
- Current offerings, marketing claims and advertising materials
- The licensure spreadsheet: “Every applicant will need to complete the Corporate Holdings tab”
- A list of every website you own and operate, including ones you won’t certify
Fees per domain are on our LegitScript certification cost page.
Contract requirements in LegitScript’s Terms and Conditions
LegitScript’s Terms and Conditions (Version September 15, 2026) add rules outside the 9 standards, and several catch multi-domain GLP-1 funnels.
- WHOIS: the registration must not use “any privacy service (also known as a proxy service).” Funnel domains registered with default privacy need changing.
- Domains: at application you list “all domain names, URLs, or websites” under your ownership or control.
- Outbound links: your sites must “not link or otherwise refer Internet users to healthcare merchant or advertiser websites” that LegitScript hasn’t approved.
- Pharmacy contact: patients must be able “to access the contact information for the actual dispensing pharmacy.”
- Privacy and SSL: the privacy policy sits on a page users “can easily view and access,” and sensitive data runs over SSL.
- Changes: you “notify LegitScript within thirty (30) days” of a change in licensure, business or regulatory status.
- Seal: no modifying it “in any form including its size,” and “use of the Seal in a static form is not permitted.”
- Requests: “Failure to respond to such requests from LegitScript will be grounds for certification revocation or denial.”
What passes and what fails LegitScript review for GLP-1 programs
A GLP-1 program passes LegitScript review when its licenses, workflow, pharmacy and marketing match what the site claims. Most rows below come from LegitScript’s June 19, 2026 Q&A with White Label MD, which starts with licensure: “The most common gap is geographic.”
| Element | Passes review | Fails review |
|---|---|---|
| Prescriber licensure | Licensed where the patient is “located at the time of the visit” | Licensed only where the clinic sits |
| Intake | A licensed provider evaluates and decides; async review can qualify | A form that produces a prescription “with no genuine provider review” |
| Visit type by state | A synchronous video or phone visit where a state requires one | No “state-by-state logic for when a live visit is required” |
| Partner pharmacy | Certified or accredited, and vetted before you build around it | A pharmacy that “isn’t appropriately licensed and accredited” |
| States on the site | Disclosed and matching reality | Missing, or wider than your licenses |
| Domains and WHOIS | All disclosed; WHOIS accurate, no privacy service | Undisclosed domains; registrations behind a privacy or proxy service |
| Claims | Truthful and substantiated | “Outcome claims that imply guaranteed or typical results” |
| Imagery | Before-and-after images shown with context | “Before-and-after imagery without context” |
| Pricing | Subscription and cancellation terms stated clearly | “Pricing that hides the real subscription terms” |
Standard 2 doesn’t name GLP-1 or compounding. It covers medications without “the necessary authorization or approval from the applicable regulatory body” and those “otherwise considered unapproved by relevant regulatory bodies.”
Requirements that keep applying after approval
LegitScript’s requirements keep applying for the whole certification term, because LegitScript “performs ongoing monitoring throughout a healthcare merchant’s certification period,” per its step-by-step guide. Review and renewal timing is on our how long certification takes page.
- Report a change in licensure, business or regulatory status within 30 days.
- Fix what LegitScript flags. The guide says “Failing to respond or correct violations could result in certification suspension or revocation of your certification.”
- Advertise within each platform’s rules. Under Standard 9, advertising “in apparent violation of the platforms’ terms of service” may be “grounds for certification denial or revocation.” That covers campaigns an agency buys on your behalf as well as your own.
What Meta and Google require on top of LegitScript
Meta requires LegitScript certification for telehealth prescription drug ads, and Google requires it for US telemedicine ads, but each platform then adds its own approval. The full order, from lookup to live ads, is in the LegitScript certification hub, with platform details in Meta’s rules for GLP-1 prescription drug ads and Google Ads telemedicine certification.
FAQ
How do you get LegitScript certified?
LegitScript lists 5 steps: check eligibility, gather documentation, submit in its client portal, expert review, then certification.
How hard is it to get LegitScript certified?
It depends on the gaps in your model. The usual GLP-1 blockers are missing state licenses, questionnaire-only prescribing and an unvetted pharmacy. White Label MD’s advice: vet the pharmacy partner “before you build around them.”
What is LegitScript certification?
LegitScript certification is LegitScript’s review of a healthcare business against its 9 standards. LegitScript says Google, Meta, Microsoft, TikTok, Visa and Mastercard, among others, trust it.
Sources
- LegitScript, Our 9 Certification Standards (CHM-CE236-CR-01) · accessed
- LegitScript, Healthcare Merchant Certification Terms and Conditions (Version September 15, 2026) · accessed
- LegitScript, Healthcare Certification · accessed
- LegitScript, Healthcare Certification: From Application to Approval, step-by-step guide (January 2026) · accessed
- LegitScript blog, What It Really Takes for Weight Loss & Longevity Clinics to Get LegitScript-Certified (Q&A with White Label MD, June 19, 2026) · accessed
- Meta Transparency Center, Drugs and Pharmaceuticals · accessed
- Google Ads policy, Healthcare and medicines · accessed
- ppc.land, Telemedicine applications to ad certifier LegitScript jump 101% in a year (September 25, 2026) · accessed