Online pharmacy advertising rules: Ryan Haight disclosures, state licenses and ad platform gates

An online pharmacy or a pharmacy that adds mail order, delivery or remote dispensing faces a different set of advertising rules from a pharmacy that only serves walk-in customers. Federal law has its own definition of an online pharmacy for controlled substances, a list of facts that must appear on the homepage, and a criminal provision on Internet advertising. States license pharmacies one by one. Google and Meta will not run prescription drug ads for a pharmacy until it has passed their certification steps. This guide sets out what each of those sources says and what it means for the website, the ads and the copy. For products you ship to online or phone orders, see also our guide to the FTC mail order rule on shipping promises and refunds.

Two neighboring topics have their own guides and are not repeated here. Rewards, copay waivers, refill reminders and local search for a neighborhood pharmacy are covered in independent pharmacy marketing. Compounded drugs, 503A and 503B, and the FDA warnings on compounded copies are covered in compounding pharmacy marketing. Prescribing controlled substances by telehealth, and the temporary federal flexibilities, are covered in telehealth marketing for practices. How FDA and FTC rules apply to a practice advertising a treatment it prescribes is in our guide to advertising a prescription treatment. For not-insurance wording and free card claims, see prescription discount card marketing.

Who counts as an online pharmacy under federal law

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 added the online pharmacy sections to the Controlled Substances Act. Its definition, at 21 U.S.C. 802(52), is about controlled substances only. An online pharmacy is “a person, entity, or Internet site, whether in the United States or abroad, that knowingly or intentionally delivers, distributes, or dispenses, or offers or attempts to deliver, distribute, or dispense, a controlled substance by means of the Internet.” The word “offers” matters for marketing: a site can fall inside the definition by offering, not only by shipping.

The same paragraph lists exclusions. Among them are “mere advertisements that do not attempt to facilitate an actual transaction involving a controlled substance,” and a registered pharmacy whose Internet dispensing of controlled substances consists solely of refilling schedule III, IV or V prescriptions, or filling new schedule III, IV or V prescriptions under the narrow conditions in 802(56). Those conditions include that the pharmacy has previously dispensed a controlled substance to the patient other than by means of the Internet, and that the original prescriber is contacted and authorizes the new prescription. Whether your website fits an exclusion is a legal question about how the site works, not about what the marketing calls it.

If your pharmacy does not dispense controlled substances through its website at all, these federal sections do not apply to the site, but state pharmacy law and the ad platform rules below still do.

What the homepage must show

Under 21 U.S.C. 831(a) and 21 CFR 1304.45(a), an online pharmacy must display, at all times and in a visible and clear manner on its homepage, a statement that it complies with section 831. The DEA rule adds that the statement must include the pharmacy’s name as it appears on its DEA certificate of registration. Federal law defines the homepage, in 802(53), as “the opening or main page or screen of the website.”

Section 831(c) and 21 CFR 1304.45(b) then list information that must appear on the homepage or on a page directly linked from it, with the link itself visible and clear. For each pharmacy that dispenses controlled substances through the site, the list is:

• The pharmacy’s name and address as they appear on its DEA certificate of registration.
• Its telephone number and email address.
• The name, professional degree and states of licensure of the pharmacist-in-charge, and a telephone number at which they can be reached.
• A list of the states in which the pharmacy is licensed to dispense controlled substances.
• A certification that it holds a DEA registration modified to allow dispensing controlled substances by means of the Internet.
• The name, address, telephone number, professional degree and states of licensure, with state license number, of any practitioner who has a contractual relationship to provide medical evaluations or issue controlled substance prescriptions through referrals from the website.
• A required statement whose exact words are set in 21 CFR 1304.45(b)(7).

Once the pharmacy has notified DEA, 21 CFR 1304.40(d) requires a declaration on the homepage in a set form: “In accordance with the Controlled Substances Act and the DEA regulations, this online pharmacy has made the notifications to the DEA Administrator required by 21 U.S.C. 831 and 21 CFR 1304.40.” Under 1304.40(a), the notification goes to DEA and to the state boards of pharmacy in the states where the pharmacy offers controlled substances, 30 days before it starts.

For a web team, that means the homepage template carries the compliance statement and declaration on every version of the page, the footer or a visible homepage link leads to the disclosure page, and nobody removes or shortens that block during a redesign. Paste the regulatory text exactly as your attorney approves it. Do not paraphrase it to fit a design.

Valid prescriptions and the in-person evaluation

Section 829(e) says no controlled substance that is a prescription drug may be delivered, distributed or dispensed by means of the Internet without a valid prescription. A valid prescription is one issued for a legitimate medical purpose in the usual course of professional practice by a practitioner who has conducted at least one in-person medical evaluation of the patient, or by a covering practitioner as the statute defines that term. The statute also says one in-person evaluation does not by itself show the prescription was legitimate. Section 829(e)(3) excludes practitioners engaged in the practice of telemedicine as the Act defines it, and the current temporary DEA telemedicine flexibilities are explained in our telehealth guide.

For advertising, the plain consequence is this. Copy that promises a controlled medication without any evaluation, or that frames an online questionnaire as the same thing as a prescriber’s evaluation, describes something the statute does not allow. Describe the steps as they actually happen: who evaluates the patient, how, and that a prescriber decides whether a prescription is appropriate.

Internet advertising of controlled substances

21 U.S.C. 843(c)(2)(A) makes it unlawful to knowingly or intentionally use the Internet, or cause it to be used, to advertise the sale of, or to offer to sell, distribute or dispense, a controlled substance where that is not authorized by the Act. The statute gives as an example knowingly or intentionally placing an Internet advertisement that refers or directs buyers to Internet sellers of controlled substances who are not registered with the required modification. Under 843(d)(1), a violation can carry up to 4 years in prison, a fine, or both.

Section 843(c)(2)(C) says the prohibition does not apply to material that merely advertises distribution by nonpractitioners as their registration allows, or that “merely advocates the use of a controlled substance or includes pricing information without attempting to facilitate an actual transaction.” That line separates general information pages from an ad or page that moves a buyer toward a controlled substance sale. The statute’s example is about placing ads, not only selling, so have counsel review before any agency, affiliate or partner places ads that point buyers to a seller.

State licenses and telepharmacy

Section 831(b) requires an online pharmacy to comply with the pharmacy licensure laws of each state from which it ships controlled substances and each state to which it ships or offers to ship them, as each state decides. For other prescription drugs, state pharmacy law sets the licensing rules. Nonresident pharmacy licenses, telepharmacy, remote dispensing sites, remote order entry and the supervision and signage rules that go with them are set state by state by the board of pharmacy.

Marketing follows the licenses. List the states where you are licensed, and keep that list the same on the website, in the disclosure block, in ad location settings and in any directory listing. Do not target ads, send mail or run social campaigns into a state where you cannot lawfully fill or ship. If a telepharmacy site has its own name or storefront, check what your state requires on its signage and in its listings before you print or publish anything.

Google Ads: certification before prescription drug ads

Google’s Prescription drug services policy says Google “restricts the promotion of services related to the online prescribing, dispensing, and sale of prescription drugs” and names online pharmacies and telemedicine providers among the businesses it covers. Advertisers must be certified by Google to serve these ads, and must be approved before bidding on keywords that contain prescription drug terms. The policy also says Google “errs on the side of caution” for landing pages that appear to facilitate online prescribing, dispensing or sale.

For the United States, the location section of Google’s Healthcare and medicines policy, as published when we checked it, allows online pharmacies that hold one of the third-party accreditations it lists, and then requires Google’s own healthcare certification on top. We do not name the accrediting bodies here; read the current list on Google’s page, because it changes. The same policy treats unauthorized pharmacies as an egregious violation: offering prescription drugs without a prescription is not allowed, and targeting locations where you are not licensed is not allowed. Google’s general rules for pharmacy ads are also summarized in our independent pharmacy guide and in healthcare ad policy basics.

In practice: apply for the category that matches the business model, keep prescription drug terms out of ads, keywords and landing pages until approval covers them, and run location targeting only to licensed states.

Meta: authorization, age and country limits

Meta’s Drugs and Pharmaceuticals ad standard, as published when we checked it, requires online pharmacies and telehealth providers that promote prescription drugs to be actively certified by a third-party certification program that Meta names in the standard, and then to request authorization from Meta. Ads may only target people 18 or older, only in eligible countries (the standard lists the United States, Canada and New Zealand), and only in countries where the advertiser is certified. The standard says advertisers do not need written authorization for ads that educate, advocate or give public service announcements about prescription drugs, or that promote telehealth services generally.

That gives two kinds of campaign. A general campaign about the pharmacy’s service, such as delivery or speaking with a pharmacist, can run without prescription drug authorization if it names no prescription drug. A campaign that names or sells prescription drugs needs the certification and the authorization first, and its audience settings must match the age and country limits.

What patients are told to check

FDA’s BeSafeRx campaign tells consumers how to judge an online pharmacy. Its page on choosing one, content current as of September 21, 2020, lists safe signs: the pharmacy requires a doctor’s prescription, provides a physical address and telephone number in the United States, has a licensed pharmacist on staff to answer questions, and is licensed with a state board of pharmacy. Its warning signs include not requiring a prescription, offering “deep discounts or prices that seem too good to be true,” and not providing “clear written protections of your personal and financial information.”

A legitimate pharmacy can use that list as a website brief. Put the address, the phone number, the pharmacist contact route and the state license list where a patient looks for them. Write a clear privacy notice. Avoid discount language that reads like the warning sign FDA describes. FDA also points consumers to a way to look up state-licensed online pharmacies, so the license details on your site should match what a patient finds there.

Claims, prices and comparisons

Under 15 U.S.C. 45 and 52, ads for drugs must not be false or misleading. Price claims, savings claims, delivery time promises and comparisons with other pharmacies need proof before they run. Section 843(c)(2)(C)(ii) allows pricing information for controlled substances only where it does not attempt to facilitate an actual transaction, so a price list that links straight to a checkout for a controlled substance is a different thing from a general price page. For cash price pages in general, see advertising cash prices.

Illustration: two homepages

Illustration: an online pharmacy that fills prescriptions for controlled substances redesigns its homepage. The new design moves the compliance statement and the DEA declaration into a collapsed footer accordion, and links the disclosure page from a submenu. The federal text asks for a visible and clear homepage display and a visible and clear link, so the team puts the statement, the declaration and the disclosure link back in plain view on the homepage, on desktop and mobile, and adds a check to the release list so the block survives the next redesign.

Illustration: a pharmacy licensed in four states starts a delivery campaign on Meta and Google. The first draft names two prescription drugs, targets a national audience and says “no doctor visit needed.” The revised campaign names no drugs, targets the four licensed states, describes how a prescriber evaluates the patient, and waits for Google certification before any prescription drug terms appear.

Checklist

• Decide with your attorney whether your site is an online pharmacy under 21 U.S.C. 802(52) or fits an exclusion.
• If it is, keep the 831 compliance statement, the 1304.40(d) declaration and the 1304.45 disclosure link visible on the homepage at all times.
• Keep the disclosure page current: pharmacist-in-charge, contracted practitioners, states licensed.
• Describe the evaluation and prescription steps as they happen; no promises of a controlled medication without an evaluation.
• List licensed states the same way on the website, in ads and in listings, and target only those states.
• Check state board rules for telepharmacy and remote dispensing signage and names before publishing.
• Google: get the third-party accreditation Google requires, then Google certification, before prescription drug ads or keywords.
• Meta: certification and Meta authorization before naming prescription drugs; 18+ and eligible, certified countries only.
• Make the FDA safe signs easy to find: U.S. address, phone, pharmacist access, state license, privacy notice.
• Hold proof for every price, savings, speed and comparison claim before it runs.

How we help

We build websites, local search, Google Ads and AI front desk tools for independent practices and health businesses. For a pharmacy, we can build a website with the disclosure block your attorney approves fixed in the homepage template, set ad locations to your licensed states, and keep prescription drug terms out of campaigns until certification covers them. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We do not sell lead lists and we do not pay for referrals. For the wider rules, see our healthcare marketing rules hub.

Sources

• 21 U.S.C. 801 and notes: short title of Public Law 110-425, the Ryan Haight Online Pharmacy Consumer Protection Act of 2008
• 21 U.S.C. 802: Definitions, paragraphs (50) to (56), including online pharmacy and homepage
• 21 U.S.C. 829(e): Controlled substances dispensed by means of the Internet
• 21 U.S.C. 831: Additional requirements relating to online pharmacies and telemedicine
• 21 U.S.C. 843(c)(2) and (d): Internet advertising of controlled substances and penalties
• 21 CFR 1304.40: Notification by online pharmacies
• 21 CFR 1304.45: Internet Web site disclosure requirements
• FDA: BeSafeRx, Your Source for Online Pharmacy Information (content current as of September 21, 2020)
• FDA: BeSafeRx, Considering an Online Pharmacy? (content current as of September 21, 2020)
• Google Ads: Prescription drug services policy
• Google Ads: Healthcare and medicines policy, including location specifics and unauthorized pharmacies
• Meta Advertising Standards: Drugs and Pharmaceuticals
• 15 U.S.C. 45: Unfair or deceptive acts or practices
• 15 U.S.C. 52: Dissemination of false advertisements

More in Health companies, vendors and employers