On this page
BPC-157 is not FDA-approved, but on October 30, 2026 HHS said it “does not intend to take enforcement action against a State-licensed pharmacy, Federal facility, or licensed physician compounding a drug product using a peptide bulk drug substance found in Appendix A,” a list of six peptides that starts with BPC-157 (Federal Register; HHS policy). That is an interim enforcement policy for compounding under section 503A, not an FDA approval, and it does not change the advertising rules that Meta, Google and LegitScript publish. Curve Compliance, which helps peptide and hormone clinics measure consult bookings without sending health data to ad platforms, checked every source below on November 2, 2026.
Book a call. Running ads for a peptide or hormone clinic? Curve Compliance sends consult bookings to Meta, Google Ads and other ad platforms from its own servers, with neutral event names and a fixed list of fields, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What HHS published on October 30, 2026
The Federal Register notice is a notice of availability from the Office of the Secretary, RIN 0910-ZD94, Docket No. HHS-OASH-2026-0496. It describes HHS's “enforcement policy regarding the use of certain peptide bulk drug substances in compounding pursuant to section 503A” while the 503A bulks list “is developed through rulemaking.” The notice calls the document a draft, says it “does not establish any rights for any person and is not binding on HHS or the public,” and adds: “FDA's future rulemakings may propose adding some or all of these peptides to the 503A bulks list based on the available evidence” (Federal Register).
The notice also tells readers to “Use the HHS website listed in the previous sentence to find the most current version of the policy,” so check the PDF again before you change anything (Federal Register).
Comment window. The notice says “Written comments can be submitted until 2 weeks after date of publication in the Federal Register via regulations.gov on Docket No. HHS-OASH-2026-0496” (Federal Register). Regulations.gov lists the comment period on that docket as ending November 13, 2026, at 11:59 p.m. Eastern (Regulations.gov).
The six peptides and HHS's conditions
Appendix A of the policy lists six peptide bulk drug substances: BPC-157, Epitalon, KPV, MOTS-c, Semax and TB-500. HHS lists ten conditions and says it does not intend to take action only “when all of the following circumstances are present” (HHS policy). In HHS's words:
| Condition | What the HHS policy says |
|---|---|
| On the list | “The peptide bulk drug substance appears in Appendix A to this policy.” |
| Identity and route | “The peptide bulk drug substance has the identity and limitations in route of administration described in Appendix B.” |
| Registered source | “The bulk drug substance is from a facility registered under section 510” and is “characterized and identified in a valid certificate of analysis (COA)” |
| Original manufacturer | The original manufacturer “is registered with FDA under section 510, is in compliance with CGMP and other FD&C requirements,” and its location “is listed on the COA provided to the 503A compounder” |
| Reporting | Serious adverse events and product quality issues go to “MedWatch Safety Information and Adverse Event Reporting Program” |
| Labeling | “This is a compounded drug product. Not for resale.” |
| One ingredient | “The compounded drug product contains only a single Active Pharmaceutical Ingredient (API) listed in Appendix A.” |
| Oral forms | “the compounder is expected to maintain documentation confirming that the specific formulation provided to a patient achieves an adequate level of oral bioavailability in humans” |
| Device | “The only drug delivery device co-packaged or containing the compounded drug is an FDA 510(k)-cleared syringe.” |
| Other FD&C Act rules | Compounding must comply with “all other applicable requirements of the FD&C Act,” including that the drug “not be compounded under insanitary conditions” and “section 503A's (21 U.S.C. 353a) patient specific prescription requirement” |
The conditions bind the compounder: the pharmacy, federal facility or physician that compounds the drug. A clinic that advertises consults still depends on its pharmacy partner meeting each of them (HHS policy).
What did not change
- FDA approval. HHS says “Compounded drugs are not FDA-approved, which means FDA does not review their safety, effectiveness, or quality before they are marketed” (HHS policy; Federal Register).
- The 503A bulks list. The six peptides are not added to FDA's 503A bulks list; the notice says FDA's future rulemakings “may propose” adding them (Federal Register).
- The policy can change. “HHS may revisit application of this interim policy (in whole or in part) if, among other things, a safety signal or product quality issue arises” (HHS policy).
- FDA's category 2 history. HHS says “BPC-157 (free base) and BPC-157 acetate were in Category 2 from September 2023 until April 22, 2026,” that CDER “recommended against listing either form,” and that the advisory committee “voted in favor of inclusion” (HHS policy). FDA's category 2 page now lists all six under a heading it explains as: “This list of bulk drug substances previously in category 2 of the interim policies were withdrawn by the nominators.” For BPC-157 that page still says: “FDA has identified no, or only limited, safety-related information for the proposed routes of administration” (FDA).
How this applies to your clinic depends on your state, your pharmacy partner and your offer, so talk to your counsel before you change what you sell or say.
Ad platforms run their own review
None of the Google, Meta or LegitScript pages below mentions the HHS policy, as of November 2, 2026. Each one decides peptide ads by its own words:
| Reviewer | What its own page says | What it means for peptide ads |
|---|---|---|
| Google Ads | “Google doesn't allow the promotion of certain products, regardless of any claims of legality,” including “Products that have been subject to any government or regulatory action or warning” and “Non-government approved products that are marketed in a way that implies that they're safe or effective for use in preventing, curing, or treating a particular disease or ailment” (Google) | Google's list of examples says “This is not an exhaustive list,” and none of the six peptides is on it (Google list). Google says to “refer to LegitScript” for more. See Google unapproved substances. |
| Meta | “Advertisers can't run ads that promote the sale or use of illicit or recreational drugs, or other unsafe substances, products or supplements, as determined by Meta at its sole discretion.” For prescription drugs, “Meta requires online pharmacies and telehealth providers to be actively certified with LegitScript” (Meta) | Prescription drug ads must also “Only target people in eligible countries (United States, Canada or New Zealand)” and “Only target people 18 years or older.” Ads that “Promote telehealth services generally” need no written authorization (Meta). See Meta peptide ad rejections. |
| LegitScript | Certified businesses “must not facilitate the prescribing or dispensing of medications that do not hold the necessary authorization or approval from the applicable regulatory body in that jurisdiction or medications that are otherwise considered unapproved by relevant regulatory bodies” (LegitScript standards) | Its transparency standard adds: “This includes claims that a product or service has purported benefits that have not been supported by a regulatory body, such as the FTC, FDA, etc.” See LegitScript certification for healthcare ads. |
On September 22, 2026, before HHS's notice, LegitScript wrote that “LegitScript's Certification Standards are built on applicable laws and regulations, not on where the industry hopes those regulations might be headed,” and that if FDA moves toward formal rulemaking, “LegitScript will evaluate those changes closely and update our certification review processes accordingly” (LegitScript). If you hold or need LegitScript certification, ask LegitScript how it reads the HHS policy before you add a peptide offer. For a side-by-side view of every network, see healthcare advertising rules by platform.
Copy and landing pages after the HHS policy
- Never call a compounded peptide FDA-approved. HHS says compounded drugs are not, and LegitScript lists “Implying or stating that a substance is FDA-approved or otherwise legally permitted for compounding” among the signs that content has turned promotional (LegitScript).
- Don't present the policy as an approval. It is an interim policy that HHS says is not binding and may revisit. A headline like "now legal" overstates it.
- Leave out treatment claims. Google, Meta and LegitScript each restrict claims that a product prevents, cures or treats a condition. Describe the service instead: a consultation with a licensed clinician who decides what is appropriate.
For page-level examples, see peptide and hormone clinic ad boundaries and which peptide treatment pages book consults. Longevity clinics face the same questions; see longevity clinic ads disapproved.
Measuring peptide consults without sending health data
A browser pixel on a BPC-157 page can send that page address, and the interest it reveals, to an ad platform. Measure the booking, not the substance: send one neutral event per booked consult, keep substance and condition names out of event names and URLs that reach ad platforms, and check what each platform received. If conversions dropped after a policy flag, see peptide therapy ads when conversions stop arriving and what to measure weekly.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names such as a booked consult, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted.
When a patient leaves your site to book in IntakeQ, Calendly, Acuity, Jane App or another scheduler, Curve keeps the ad attribution and credits the booking to the original click. When a platform flags something, Curve's team reviews what your site sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. For more of this month's changes, see health marketing compliance news for November 2026.
Sources, checked November 2, 2026: Federal Register 2026-22192; HHS Enforcement Discretion Policy (PDF); Regulations.gov docket HHS-OASH-2026-0496; FDA category 2 page and 503A bulk drug substances; Google Unapproved substances and unapproved pharmaceuticals list; Meta Drugs and Pharmaceuticals; LegitScript Healthcare Certification standards and The Peptide Boom (September 22, 2026).
Frequently Asked Questions
Is BPC-157 legal in 2026?
BPC-157 is not FDA-approved, but since October 30, 2026 HHS says it does not intend to take enforcement action against state-licensed pharmacies, federal facilities or licensed physicians that compound it under section 503A when every condition in its interim policy is met (Federal Register; HHS). Ad platforms still apply their own rules.
Which peptides does the HHS policy cover?
Six, listed in Appendix A: BPC-157, Epitalon, KPV, MOTS-c, Semax and TB-500 (HHS policy).
Does the HHS policy mean Google or Meta will approve peptide ads?
No. Google bars certain products “regardless of any claims of legality” (Google), and Meta decides which substances are unsafe “at its sole discretion” and “requires online pharmacies and telehealth providers to be actively certified with LegitScript” (Meta). Neither page mentions the HHS policy as of November 2, 2026.
Can a clinic say a compounded peptide is FDA-approved?
No. HHS says “Compounded drugs are not FDA-approved” (HHS policy), and LegitScript treats implying FDA approval as promotional content (LegitScript).
How long can I comment on the HHS peptide policy?
The notice allows comments “until 2 weeks after date of publication” (Federal Register), and Regulations.gov lists the period as ending November 13, 2026, at 11:59 p.m. Eastern (docket HHS-OASH-2026-0496).
Is BPC-157 still in FDA category 2?
No. HHS says it was in Category 2 “from September 2023 until April 22, 2026” (HHS policy), and FDA's page lists it among substances “previously in category 2” that “were withdrawn by the nominators” (FDA).
How do I track peptide consult bookings without sending health data to ad platforms?
Send one neutral booked-consult event server-side with a fixed list of fields, and keep substance names out of event names and URLs. Curve Compliance does this for you, strips PHI before data reaches an ad platform and signs a BAA on every plan.
Talk to Curve Compliance
Book a call. Want peptide consult bookings measured without health data reaching Meta or Google? Curve Compliance sends conversions server-side with neutral event names, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.