Direct-to-consumer lab testing lets people order blood work and other tests without first booking a doctor visit. Some services sell tests online and send customers to a patient service center for a draw, others mail a collection kit, and many arrange for a clinician to review and order the test where state law requires it. Customers usually compare a few services on price, convenience and trust, then pick the one whose website answers their questions best. Kits mailed to online orders also fall under the FTC mail order rule, which covers shipping promises, delay notices and refunds.
That website has to do more than sell. Federal lab rules shape who can order a test and who can receive the result, state law fills in the details, and health claims about what a test reveals are held to the same standard as any other health claim. This guide covers each of those, then lists marketing ideas that work inside them. If your service draws blood at home, see our guide to mobile phlebotomy marketing. For tests that claim to guide medicine choice, see pharmacogenomic testing marketing.
This is general information, not legal or medical advice. Sources cited were checked on October 29, 2026: 42 CFR 493.2, 493.3, 493.1241 and 493.1291 (CLIA laboratory requirements), the FDA final rule Medical Devices; Laboratory Developed Tests; Implementation of Vacatur (Federal Register document 2025-18239, published September 19, 2025), the FTC Health Products Compliance Guidance, Section 5 of the FTC Act (15 U.S.C. 45), 16 CFR 255.2, 16 CFR Part 465, the FTC Health Breach Notification Rule (16 CFR Part 318) and 45 CFR 164.508 (HIPAA). State laws on direct access testing differ widely and change. Have a health care attorney review your marketing, and have your medical director review clinical content.
Who may order a test and who may get the result
The CLIA rules for clinical laboratories are the starting point. Under 42 CFR 493.1241(a), the laboratory must have a written or electronic request for patient testing from an authorized person. 42 CFR 493.2 defines an authorized person as an individual authorized under State law to order tests or receive test results, or both.
So whether a consumer may order a test directly, and which tests, is a question of state law, not of the lab or the marketer. State rules differ: a state can allow consumers to order certain tests themselves or require a licensed clinician to order, and the rules can differ by test. Results follow the same logic: under 42 CFR 493.1291(f), test results must be released only to authorized persons and, if applicable, the persons responsible for using the results and the laboratory that requested the test, and 493.1291(l) separately lets a laboratory give patients access to their completed test reports on request.
For marketing, that means:
- Do not say no doctor needed or order any test yourself unless that is true in every state where the page is shown, for every test it covers. Say which states you serve and how ordering works in each.
- If a clinician reviews and orders tests, say so plainly, name who they are, and explain what their role is and is not. Do not imply an ongoing doctor relationship you do not provide.
- Explain how results are delivered and who to contact with questions, including what happens when a result needs prompt follow-up.
- Keep a short list of excluded states and tests, and make sure ads, landing pages and checkout all use it.
Describe the lab and its certificate accurately
Under 42 CFR 493.3(a), a laboratory is cited as out of compliance with the CLIA statute unless it holds a current certificate from HHS that applies to the category of examinations it performs, or is CLIA-exempt. Certificates come in several types, including a certificate of waiver, a certificate of compliance and a certificate of accreditation, and they are not interchangeable.
Many direct-to-consumer brands do not run their own lab; they sell tests that a partner laboratory performs. If that is your model, say so, and name the performing lab if your agreement allows it. Phrases such as CLIA certified lab or performed in a certified lab are only accurate if the lab that actually runs each test holds the right certificate for that test. Avoid wording that suggests government approval of your service, your results or your brand.
The FDA laboratory developed test rule: current status
Many lab tests are designed and run within a single laboratory, often called laboratory developed tests. In May 2024, FDA published a final rule that amended 21 CFR 809.3(a) to treat these tests as devices when the manufacturer is a laboratory. On March 31, 2025, the United States District Court for the Eastern District of Texas vacated that rule in American Clinical Laboratory Association v. FDA. FDA then issued a final rule, published September 19, 2025, that removed the added words and reverted the regulation to its earlier text to reflect the court order.
Two practical points follow. First, do not tell customers that a laboratory developed test is FDA approved, cleared or reviewed unless the specific test actually went through FDA review. Second, this area has changed several times in a few years, so check its status again before you publish claims about FDA oversight, and date the page.
Claims about what a test can tell people
Section 5 of the FTC Act, 15 U.S.C. 45, prohibits deceptive acts or practices. The FTC Health Products Compliance Guidance says claims about the health benefits of health-related products and services require competent and reliable scientific evidence, and that advertisers are responsible for implied claims as well as express ones.
For lab testing, the risky wording is usually about what a result means: catch disease early, know your risk, find the root cause, optimize your hormones, or a test panel sold as a way to rule out a condition. Each of those is a claim about health benefit, and some imply that a test can replace a clinician’s evaluation. Describe what is measured, what a result can and cannot show, and when to see a clinician. If you publish accuracy figures, they must be substantiated for the specific test and lab, and stated with the conditions that apply. If you cannot support a number, leave it out.
Panels marketed around a condition or a goal, such as fertility, menopause, weight or energy, deserve particular care. Our guide to integrative medicine marketing claims covers how claim substantiation works for wellness wording, and our guide to weight loss clinic marketing covers weight-related claims.
Customer stories and reviews
Under the Endorsement Guides, 16 CFR 255.2(b), an ad that tells one customer’s experience on a key point, such as a test that found a problem their doctor missed, is likely to be read as showing what customers will generally experience. Without substantiation that it is representative, the ad should clearly disclose the generally expected results. The FTC rule on consumer reviews and testimonials, 16 CFR Part 465, prohibits fake reviews, and section 465.4 prohibits incentives conditioned on reviews expressing a particular sentiment. Ask every customer for honest feedback, with nothing tied to a positive review.
If your service is a HIPAA covered entity, using a customer’s health information in marketing generally requires their written authorization under 45 CFR 164.508; see our guide to HIPAA marketing rules.
Results privacy, apps and tracking
Lab results are among the most sensitive data a health business holds, and direct-to-consumer services often deliver them through a website account or an app. Whether HIPAA applies depends on whether the business is a covered entity or a business associate. If it is not, the FTC Health Breach Notification Rule, 16 CFR Part 318, may apply to apps and services that hold consumers’ health records; our guide to the FTC Health Breach Notification Rule explains who it covers.
Either way, keep test names, results and order details away from advertising platforms. Product pages, cart contents and checkout confirmations can reveal which test someone bought, so review what your tracking tags collect on those pages; see our guide to tracking pixels on practice websites.
Direct-to-consumer lab marketing ideas that work inside the rules
- A plain how it works page. Ordering, who reviews the order, where and how the sample is collected, turnaround, how results arrive and who to call with questions, with the states you serve.
- One page per test or panel. What is measured, who might consider it, how to prepare, what the result can and cannot tell them, and when to see a clinician, reviewed and dated by your medical director.
- Clear pricing. The full price, what it includes, any draw or clinician fees, and whether insurance is accepted. Our medical website design page explains how we build service and pricing pages that answer these questions.
- Search pages for real questions. Topics such as what a fasting blood test involves or how to read a lab report, written with your clinical team; see our healthcare SEO page for how we plan them.
- Fast answers to logistics questions. Staff or an AI front desk can answer questions about orders, draw sites and results timing, and pass clinical questions to your team.
- A results privacy page in plain words. Who sees results, what you share and with whom, and how customers can get their reports.
If your service offers virtual visits to discuss results, our guide to telehealth marketing for practices covers how to describe virtual care accurately.
Can we say customers can order lab tests without a doctor?
Only where it is true. Under 42 CFR 493.1241 and 493.2, a lab needs a request from a person authorized under state law to order tests, and state rules differ. Say which states and tests allow direct ordering and how ordering works elsewhere.
Can we call our tests FDA approved?
Only if the specific test went through FDA review. The FDA rule that would have treated laboratory developed tests as devices was vacated in March 2025, and FDA reverted 21 CFR 809.3 in September 2025, so most such tests have no FDA review to point to.
Can we advertise that our tests are CLIA certified?
Only if the lab that runs each test holds a current CLIA certificate that covers it. 42 CFR 493.3 ties compliance to a certificate applicable to the category of examinations performed. If a partner lab runs the tests, say so.
Can we publish a customer story about a test that found a problem?
Be careful. Under 16 CFR 255.2(b), one customer’s experience is likely to be read as typical unless you can substantiate it or disclose what customers generally experience, and health benefit claims need competent and reliable scientific evidence.
Can we use ad pixels on test product pages?
Review them first. Product, cart and confirmation pages can reveal which test someone bought. Depending on your status, HIPAA or the FTC Health Breach Notification Rule may apply to sharing that information.
Sources
- 42 CFR 493.2: Definitions (authorized person)
- 42 CFR 493.3: Applicability
- 42 CFR 493.1241: Standard; Test request
- 42 CFR 493.1291: Standard; Test report
- FDA: Medical Devices; Laboratory Developed Tests; Implementation of Vacatur (Federal Register, September 19, 2025)
- FTC: Health Products Compliance Guidance (December 2022)
- 15 U.S.C. 45: Unfair methods of competition and unfair or deceptive acts or practices
- 16 CFR 255.2: Consumer endorsements
- 16 CFR Part 465: Use of consumer reviews and testimonials
- 16 CFR Part 318: Health Breach Notification Rule
- 45 CFR 164.508: Uses and disclosures for which an authorization is required