FDA Warning Letters to Telehealth: Marketing Lessons

The FDA issued 30 warning letters to telehealth companies on 3 March 2026 and a further 25 during the week of 15 June 2026, all concerning promotional claims about compounded GLP-1 products. The agency's core objection was consistent across the letters: marketing that presents a compounded formulation as equivalent to an FDA-approved drug, omits or minimizes risk information, or implies FDA endorsement that does not exist. The lesson for any telehealth advertiser is that the promotional page and the ad creative are now regulated surfaces, reviewed as carefully as the prescribing itself. Curve is the HIPAA-compliant tracking and analytics platform that lets telehealth marketers measure and optimize these campaigns without exposing patient data, with a signed Business Associate Agreement on every plan.

What the FDA actually objected to

Reading across the two waves, the objections cluster into a small number of repeating patterns. None are exotic. All are things a growth team does without thinking.

Equivalence claims

The most common problem. Compounded semaglutide and tirzepatide are not FDA-approved drugs. They are prepared by compounding pharmacies and have not been through the approval process that establishes safety and efficacy for a specific indication. Marketing that describes a compounded product as "the same as" a brand-name drug, or uses the brand name to describe what the patient is receiving, asserts an equivalence the FDA has not granted.

This includes softer forms. Describing a compounded product as "generic Ozempic" is an equivalence claim. So is a comparison table implying identical active ingredients and outcomes. So is using the approved drug's clinical trial results to support what your compounded product will do.

Missing or buried risk information

Promotional communications about prescription drugs are expected to present benefit and risk with reasonable balance. A landing page listing average weight loss in large type, with side effects in a small footer or behind a collapsed accordion, does not achieve that. Neither does an ad that names the benefit while the risk information exists only on a page the viewer may never reach.

Implied FDA endorsement

Language suggesting FDA approval, clearance, or oversight where none applies. This shows up as claims that ingredients are "FDA-approved" when the approval attaches to a different finished product, references to FDA-registered facilities implying product approval, and trust badges that blur registration with approval. Facility registration is not product approval, and the FDA treats conflating them as misleading.

Unsubstantiated superiority and outcome claims

Specific weight-loss figures without adequate substantiation for the actual product being sold. Testimonials presenting atypical results as expected. Claims about speed, ease, or comfort that go beyond available evidence.

Why this escalated in 2026

The compounded GLP-1 market grew during a period when the approved drugs were in shortage, which created a regulatory allowance for compounding that would not otherwise exist. As supply normalized, the justification narrowed, and the FDA turned attention to how these products were being promoted.

The agency also published dedicated guidance pages for telehealth companies and for compounded GLP-1 products specifically, which removes the ambiguity defense. Advertisers can no longer argue the expectations were unclear.

Ad platforms moved in parallel. Meta rejects branded pharmaceutical weight-loss terms and most before-and-after weight-loss imagery, and requires prior authorization for prescription drug advertising, admitting only pharmaceutical manufacturers, online pharmacies, and telehealth providers. The practical result is that a claim can be rejected by the platform before the FDA ever sees it, and platform rejection is now an early warning signal worth treating seriously.

A review pass for your own funnel

Work through the whole path, not just the ad. The FDA looks at promotional communications broadly, which includes the landing page, the quiz, the email sequence, and affiliate content produced on your behalf.

1. Search your copy for brand names. Every use of an approved drug's brand name to describe a compounded product is a candidate equivalence claim.
2. Find every numeric outcome claim. Ask what substantiates it for the product you actually dispense, not for the approved drug.
3. Check risk balance on the page as rendered. Not in the source, not behind a click. What does someone scrolling on a phone actually see.
4. Audit trust signals. Any badge or phrase implying FDA approval where only registration applies.
5. Review testimonials for typicality. Whether presented results are represented as ordinary.
6. Read your quiz. Funnel questions frequently contain claims in their framing.
7. Audit affiliates and creators. You are responsible for promotion made on your behalf, and creator copy is where the loosest claims live.

If a letter arrives

A warning letter names specific communications and specific claims, and it expects a written response, typically within 15 working days. That window is short enough that the work has to start immediately.

A reasonable sequence: preserve everything first, including the live pages, ad creative, and any scheduled emails, because you will need to show what was running and when. Take down or correct the identified material rather than quietly editing it, and record what changed. Then widen the review, because the agency named examples rather than producing an exhaustive list, and a response that fixes only the cited pages while leaving identical claims elsewhere invites a follow-up.

Bring counsel in before responding. The response becomes part of the record, and language that concedes more than intended, or that promises changes you cannot deliver, creates problems later. Warning letters are also published, so competitors, partners, payment processors, and ad platform policy teams may see them. Several telehealth companies have found that the commercial consequences of publication arrived faster than any regulatory consequence.

State-level exposure runs alongside the federal question. State pharmacy boards regulate prescribing and dispensing within their borders, and state attorneys general have their own consumer protection authority over misleading health claims. A single national campaign can therefore create obligations in several jurisdictions at once, which is why multi-state telehealth advertisers usually need a claims review process rather than ad hoc legal checks.

The measurement problem underneath

Here is the part most compliance discussions skip. Fixing your claims requires knowing which creative and which landing page variants actually drive outcomes, so you can remove the aggressive ones without destroying the funnel. That requires measurement. And measurement is exactly where telehealth advertisers create a second, separate legal exposure.

A standard Meta Pixel or Google tag on a GLP-1 funnel sends the page URL to the ad platform. On these funnels the URL routinely names the medication. It sends quiz completions with the answers attached if the form is instrumented naively. It sends a persistent browser identifier that ties the whole sequence to one person.

Meta and Google do not sign BAAs for their advertising products. Every one of those calls discloses an identifiable person's interest in a specific treatment to a vendor with no BAA. This is the mechanism behind healthcare pixel litigation that has produced more than $100 million in settlements, and it is entirely separate from the FDA question. A telehealth company can fix every claim in its funnel and still be carrying this exposure.

How Curve fits

Curve is HIPAA-compliant ad tracking, attribution, and analytics built for healthcare. It replaces client-side pixels with a server-side path, which gives you a place to decide what leaves before anything does.

• Server-side collection. The Curve script installs in place of the Meta Pixel and Google tag. Events reach Curve's US-hosted infrastructure rather than going straight to ad platforms.
• Per-destination field mapping. Only fields you explicitly map forward. Page URLs naming a medication, quiz answers, and free-text fields stay behind by default.
• Hashed identifiers. Email, phone, and name are SHA-256 hashed to each platform's conversion API requirements.
• Neutral event aliases. The ad platform receives a neutral conversion name rather than one identifying the treatment, so the medication never appears in the platform interface.
• Bridge tokens. Attribution survives the jump from your marketing site into a separate intake or booking experience, which is where telehealth funnels usually lose the chain.
• PHI-pattern detection. Payloads are flagged when they contain PHI-shaped values such as SSNs, MRN-style identifiers, or long numeric sequences, which is how you find out that a quiz field changed three weeks ago.

Clean conversions forward server-side to Meta CAPI, Google Ads Enhanced Conversions, TikTok Events API, Microsoft, and LinkedIn. Offline conversion uploads with click ID matching let you feed genuine downstream outcomes back, so you optimize toward patients who start treatment rather than people who complete quizzes. A signed BAA comes with every plan.

For related reading, see our coverage of compounding pharmacy GLP-1 advertising restrictions and GLP-1 advertising policy updates across Google and Meta.

Frequently asked questions

Does a warning letter mean enforcement is coming?

A warning letter is a formal notice that the FDA believes a violation exists and expects correction, typically within 15 working days. It is not itself a penalty, but ignoring one escalates matters toward injunction, seizure, or civil penalties. Treat it as a deadline.

We only mention the compounded product generically. Are we safe?

Safer, but generic naming does not cure an equivalence claim made elsewhere on the page, an unsubstantiated outcome figure, or missing risk balance. Review the whole communication rather than one term.

Are we responsible for what affiliates say?

Generally yes. Promotion made on your behalf is attributed to you, and affiliate and creator copy is consistently the loosest in the funnel. Supply approved language and audit what actually ships.

Meta rejected our ad. Does that mean it violates FDA rules?

Not necessarily, since the two regimes are separate and platform policy is often stricter in some areas and looser in others. But a rejection is a useful signal that your claim is aggressive, and it is worth reviewing against FDA expectations rather than simply rewording until it passes.

Can we show before and after photos?

Meta rejects most before-and-after weight-loss imagery outright. Beyond platform policy, such images function as outcome claims and carry the same substantiation and typicality expectations as written claims.

How do we measure funnel performance without sending PHI?

Keep clinical content in systems whose vendors have signed BAAs, and send ad platforms only a neutral, hashed, matched conversion signal. That is precisely what Curve's server-side path with per-destination field mapping is built to do.

Where to start

Two exposures run in parallel for telehealth advertisers in 2026. The FDA is looking at what you claim. Plaintiffs' firms are looking at what your pixels transmit. The first requires a copy review; the second requires an architecture change.

Curve handles the second. Server-side collection, per-destination field mapping, hashed identifiers, neutral event aliases, and bridge-token attribution let you measure GLP-1 funnels properly without disclosing who is interested in what, with a signed BAA on every plan. Run our free compliance scanner against your funnel, or visit curvecompliance.com to talk it through.

Reviewed August 2026. This is general information, not legal or regulatory advice. FDA positions and platform policies change; consult qualified counsel about your specific promotional materials.