LegitScript Certification for Advertisers: What Health Brands Need for Meta, Google and TikTok Ads

What LegitScript certification is and which certification programs exist

LegitScript is a third-party certification and monitoring body that ad platforms and card networks rely on to vet merchants in regulated categories. It is not a regulator and not an ad platform: it certifies that a business meets its published standards, then monitors that business for the life of the certificate. The right program depends on your business model, the products or services you offer, and your goals.

• Healthcare Certification — for businesses that sell, prescribe, facilitate or process payments for prescription medications online. In scope: internet, mail-order, brick-and-mortar, compounding and veterinary pharmacies; telemedicine providers whose consultations culminate in a prescription; medical spas; digital health platforms that connect patients with contracted providers and pharmacies; pharmaceutical manufacturers and wholesale drug distributors; and adjacent merchants such as prescription eyewear sellers. Solely supplement, lab-test-only, medical-device-only, insurance and US medical-marijuana-dispensary models are out of scope.
• Addiction Treatment Certification — for drug and alcohol substance use disorder treatment and recovery operators: detox, medication-assisted treatment, inpatient, residential, partial hospitalization, IOP and outpatient programs, SUD counseling and therapy, telemedicine SUD providers, mutual support groups and crisis hotlines. Lead generators, directories and sober living homes are ineligible. The program is open to US and Canadian providers and complements — it does not replace — quality accreditations such as CARF and The Joint Commission.
• CBD Certification — two layers: per-product certification (third-party lab testing, label review, Certificates of Analysis) and per-website certification. Every CBD product sold on a certified website must itself be certified. Ingestible CBD of any kind — including sublingual tinctures — plus CBD supplements, pet products and vapes are ineligible.

Certification is priced and granted per unit of certification: per root domain (Healthcare and CBD Website), per unique facility (Addiction Treatment) or per product (CBD). Subdomains and subpages are generally covered under a certified root domain. Beyond advertising, the certificate also serves payment processing: LegitScript notes processors may require it for high-risk merchant registration (for example, MCC 5122/5912).

When Meta, Google and TikTok require LegitScript certification before health ads can run

Meta. The requirement Meta documents directly: advertisers who wish to run addiction treatment ads targeting people in the United States must be certified with LegitScript and apply to Meta for permission to advertise. Meta recognizes the addiction treatment certificate in the US only; Google recognizes it in the US and Canada. For prescription drug categories, LegitScript's post-certification guidance is to register in your Meta Ads account under Business Settings or Ad Account Settings > Authorizations and Verifications > Prescription Drug Ads — the permission is configured at the Business Portfolio or ad-account level, not on the Page itself — then select your primary classification (Online Pharmacy, Telemedicine, or Pharmaceutical Manufacturer) and provide the certified website URL, not the public verification link. Healthcare businesses must also register as health-related on Meta and meet platform-specific creative requirements. Meta does not publish a review timeline or commit to an outcome for these authorizations in the sources we reviewed, so build buffer into launch planning.

Google. Healthcare and medicines is a restricted industry: you must apply and be approved before advertising prescription drug services, restricted drug terms, pharmaceutical manufacturer content, prescription opioid painkillers, speculative and experimental medical treatments, cell and gene therapies, abortion, US health insurance or hemp-derived CBD. Applications are made at the child ad-account level — not the MCC — with a separate application per location, and for some categories Google requires third-party accreditation first (from LegitScript, NABP or G2). Where each category lands:

• Addiction services (US): LegitScript certification first, then Google's addiction services certification. Sober homes and referral agencies are not LegitScript-eligible and therefore cannot advertise addiction services on Google. Certified US addiction treatment providers are among the narrow exceptions allowed to reference opioid painkillers.
• Online pharmacies (US and Canada, Shopping): accreditation by the LegitScript Healthcare Merchant Certification and Monitoring Program, NABP's VIPPS program or the .pharmacy Verified Websites Program, then Google's online pharmacy application. Google Merchant Center treats unauthorized pharmacies as egregious — suspension upon detection, without prior warning.
• Telemedicine: Google's July 2025 update allows telemedicine providers to promote prescription drug services in the United Kingdom if certified by LegitScript's Healthcare Merchant Certification Program and by Google — and advertisers cannot promote prescription drugs in their ads or landing pages. LegitScript lists the US, Canada, France, Sweden, South Africa, Indonesia, Japan, the Philippines, Australia, New Zealand and the UK among countries where its telemedicine certification is required by platforms.
• Prescription keywords: only advertisers approved by Google may bid on keywords containing prescription drug terms.
• Topical CBD (US): LegitScript CBD certification first (both the website and every product on it), then Google's CBD Ads Certification. Google targeting is limited to California, Colorado and Puerto Rico, and formats like YouTube Masthead are excluded. LegitScript does not certify FDA-approved pharmaceutical CBD, which follows a separate Google application.
• US health insurance: G2RS certification, not LegitScript.
• Cell and gene therapies (US): Google allows promotion only of FDA licensed or approved therapies by entities holding the relevant FDA license or approval.

Already certified under a Google policy and need it on additional managed accounts under the same MCC? Apply for Manager Account Certification — the closest thing Google offers to portability across an agency's account structure.

TikTok. LegitScript lists TikTok among the platforms that require its approval to run healthcare ads. Its guidance: complete TikTok's registration process (logging into your business account is likely necessary), provide your public verification link, and review TikTok's Healthcare & Pharmaceuticals Ads Policy. Note the evidence base here is LegitScript's own documentation — TikTok's policy pages were not among the sources reviewed for this guide, so confirm current requirements with TikTok directly before launch.

Where the restriction attaches. Certification belongs to the business and its certified domain or facility — not to a person, an agency seat or a single ad account. Even the addiction treatment Individual Practitioners pricing tier certifies the practice's website, not an individual. Meta permissions attach at the Business Portfolio or ad-account level; Google certifications attach per child ad account and can extend to managed accounts under the same MCC. Agencies cannot inherit a client's status: Google asks agencies applying on behalf of an advertiser to document their relationship with the advertiser or license holder, and Meta's authorization runs through the advertiser's own assets.

The application: business, licensing and website documents LegitScript reviews

Applications run through LegitScript's client portal (certification.legitscript.com): create an account, select the program that matches your business model, pay the nonrefundable application fee, then complete the questionnaire. Progress saves automatically; questions that do not apply can be answered N/A, and a blank document can be uploaded where a required file does not apply. Once submitted, Client Relations screens the application within the first two business days, then it joins the analyst queue. Reviews are collaborative — missing items trigger analyst requests rather than automatic denial, and remediating areas of minor noncompliance during the process is common.

What analysts evaluate: licensure, business registration, website content, affiliates, privacy policies, patient practices (services and products), and promotional activity. Prepare:

• Business registration and corporate holdings — registration numbers plus the Corporate Holdings tab of the licensure spreadsheet (required for every healthcare applicant).
• Licensure — all current licenses for the business, facilities and staff; DEA certificate information or country equivalent where controlled substances are involved; the telemedicine compliance questionnaire where applicable.
• Practitioner and disciplinary history — prior criminal, regulatory or civil violations and any litigation from the past ten years (healthcare) involving the applicant, principals, key staff and associated practitioners, with remediation plans.
• Website disclosures — clear disclosure of every state, province or country served; all domains you own, certified or not; a HIPAA-compliant or region-appropriate privacy policy; and prescribing practices that dispense only on a valid prescription from an authorized prescriber.
• Partners — partner pharmacies and other organizations essential to the continuum of care are generally required to be LegitScript-certified or accredited by another recognized body. Verify partner status via LegitScript's public website-status lookup before applying (limited to five free lookups per week per IP).
• Policies and SOPs — written procedures for intake, treatment protocols, relapse prevention, quality assurance, batch testing and compounding where applicable.
• Pre-launch sites — if the website is not live, submit wireframes plus a go-live timeline; approval typically lands as Preliminary Certification until the site is live and a final review clears.

In parallel, prep the platform applications. Google asks for your Ads customer ID and the certified domain, requires the site to be fully functional and globally accessible, and asks agencies to document their relationship with the advertiser or license holder. Budget for per-account, per-location reviews in multi-market rollouts.

Cost, review time and keeping certification current

Published pricing. Healthcare Certification: a $975 nonrefundable application fee per website, plus a $2,150 annual certification fee per website due only after approval. Probationary certification — granted where a business meets all standards but warrants heightened monitoring — runs $3,995 per website per year. There is currently no alternative nonprofit price for healthcare. Addiction Treatment Certification is priced per unique facility: $1,595 application plus $3,095 annual per facility for one to nine facilities, $1,495 plus $2,775 for 10–24, and enterprise pricing above that; an Individual Practitioners tier for solo practices runs $535 application plus $1,070 annual. Registered nonprofits under $150k (per the latest IRS Form 990 or CRA T3010) can apply for a one-year waiver of the annual fee — the application fee still applies. CBD certification is priced per product and per website. Google's own policy notes that LegitScript charges a fee for processing and monitoring applicants and that fee waivers may be available in certain circumstances. Expedited Processing adds $2,500 per application.

Review time. LegitScript does not publish a certification timeline — review times vary with application complexity, completeness, responsiveness and volume. Screening lands within the first two business days; Expedited Processing starts the review within two business days after screening but does not shorten the review itself; Client Relations replies in roughly two business days. Google's platform certification and Meta's authorization add their own, similarly undocumented review times — sequence all three into launch plans instead of promising stakeholders a date.

Keeping it current. Certification is valid for one year from the date of certification. LegitScript sends renewal notice roughly 60 days before expiry; the renewal includes a short questionnaire covering changes to owners, licenses, websites, products or services; the annual fee charges automatically on the renewal date; and renewals are usually faster than the initial application for businesses in good standing. LegitScript monitors certificants throughout the year — surfaced noncompliance requires remediation, and unaddressed issues can suspend or revoke the certificate.

Ownership, billing and offboarding. The certificate follows the root domain (healthcare, CBD website), the facility (addiction treatment) or the product (CBD); subdomains are generally covered, but each new root domain needs its own application and fees. Account contacts can be added or changed by emailing [email protected], and a single payment cannot be split across payment methods. Application fees are nonrefundable once review begins; annual fees are nonrefundable, and canceling by written request ends certification status immediately — treat that as an offboarding event that also requires pulling platform registrations that relied on the certificate. Notify LegitScript of changes to services, ownership, locations or websites, and within 30 days of any staff member becoming subject to disciplinary action.

What certification does not cover: platform ad review, personal-attributes rules and landing pages

LegitScript's own framing: certification is the driver's license, not the road rules. Every ad still passes the platform's own review, and automated systems flag health-related ads on keywords and content signals — even well-crafted, compliant ads may be caught at some point in a campaign's lifetime. LegitScript states plainly that certification does not shield ads from rejection or account penalties, and that it cannot predict, interpret, modify or appeal platform decisions. Ad eligibility, disapprovals, ad-copy and landing-page requirements, account restrictions and policy interpretation all sit with the platform.

What still applies after the seal is granted:

• Platform ad review and creative rules. Meta requires health-related businesses to register as such and meet platform-specific creative requirements; Meta's Advertising Standards — including its personal-attributes rules restricting ads that imply things about a person's health or other attributes — are interpreted by Meta alone, and certification has no bearing on them (check Meta's current standards directly). Google applies different policies depending on whether you are a telemedicine provider, online pharmacy, pharmaceutical manufacturer or addiction services provider, and its prescription opioid painkiller policy is egregious-tier: suspension upon detection, without prior warning.
• Claims and content rules. The most common substantive rejection reasons after certification are unsubstantiated claims, missing disclosures, mentions of restricted drug names, and before-and-after imagery. On GLP-1s, LegitScript's webinar panel cautioned that compounded versions may not be marketed as replacements for branded products and that specific outcome claims need clinical-trial substantiation.
• Landing pages. Google's prescription drug services policy extends to destinations: landing pages that link or refer to content appearing to facilitate online prescribing, dispensing or sale of medicines can disapprove the ad, and UK telemedicine advertisers may not promote prescription drugs in ads or landing pages at all. A campaign mixing prescription and OTC products is subject to the requirements of its most regulated product — separate campaigns, landing pages and, where possible, accounts.
• Payment processing. Certification can support Visa/Mastercard high-risk registration (e.g., MCC 5122/5912), but that is a payments benefit; it says nothing about ad decisions, which platforms make independently.

None of this makes certification optional where platforms require it. It means certified teams still need compliant creative, clean destination pages, organized documentation for disputes and an escalation path — and no provider, agency account included, can turn platform ad review into a formality or shield an account from enforcement.