LegitScript Certification: Who Needs It to Run Health Ads

LegitScript certification is an independent compliance review that ad platforms use to vet health advertisers: in the United States, Google requires it for telemedicine and addiction services ads, Meta for prescription drug ads from online pharmacies and telehealth providers and for addiction treatment ads, and Microsoft for addiction recovery ads (Google; Meta prescription drugs; Meta addiction treatment; Microsoft). Most platforms add their own approval step on top. Certification does not change the HIPAA rules for what your site sends those platforms. That is where Curve Compliance helps: server-side conversion tracking that strips PHI before data reaches an ad platform, under a BAA Curve signs on every plan.

Book a call. Certified, or about to run ads? Have Curve's team review what your website sends to Meta, Google and TikTok with you. Book a call with Curve Compliance.

Which ad platforms require LegitScript certification

Each platform's US rules first, then its policy text.

Platform	What needs LegitScript (US)	Extra platform step	Source
Google Ads	Telemedicine; addiction services; online pharmacies (or NABP)	Google healthcare certification	Healthcare and medicines
Meta	Prescription drug ads from online pharmacies and telehealth providers; addiction treatment; CBD products	Meta authorization or written permission; ages 18 and older	Drugs and Pharmaceuticals; Addiction Treatment
Microsoft Advertising	Addiction recovery ads and landing pages; online pharmacies (or NABP)	Preapproval for pharmacies and for telemedicine that sells prescription drugs; no addiction lead generation ads; ages 18 and older	Healthcare and Pharmaceutical
TikTok	Pharmacies (or NABP); CBD products	FDA or other regulator approval and ages 18 and older for prescription medicine ads	Healthcare and Pharmaceuticals
LinkedIn	Pharmacy and telehealth services (or NABP)	Prior authorization; healthcare professional audiences only	Healthcare ads policy

Google Ads

Google's Healthcare and medicines policy says, for the United States: "Google allows telemedicine providers if they're accredited by LegitScript's Healthcare Merchant Certification Program, which offers telemedicine certification to websites that provide virtual healthcare services and facilitate prescribing." Online pharmacies can use LegitScript or NABP. For rehab: "In order to advertise for recovery-oriented drug and alcohol addiction services, you must be certified as an addiction services provider by the LegitScript Certification program." Both rules add: "Advertisers must also be certified with Google."

Addiction services that are not eligible for LegitScript certification "are not allowed to advertise for drug and alcohol addiction services on Google" (Google), and LegitScript lists lead generation websites as generally not eligible (LegitScript FAQ). Curve's rehab guides cover certification and campaign launch and managing certified campaigns. GLP-1 programs should read GLP-1 ad disapproved: certificate required.

Meta

Meta's Drugs and Pharmaceuticals policy says: "Meta requires online pharmacies and telehealth providers to be actively certified with LegitScript. Once they have a LegitScript certification, they must request authorization from Meta by following these steps." Authorized ads must "Only target people 18 years or older" in the United States, Canada or New Zealand. Ads that "Promote telehealth services generally" need no authorization. For a rejected drug ad, see Meta rejected your prescription drug ad.

For rehab, Meta allows ads "in the United States as long as they're certified with LegitScript and have written permission from Meta," covering treatment, hotlines and support groups (Meta). See Meta addiction treatment ad rejected.

Microsoft Advertising

Microsoft's Healthcare and Pharmaceutical policy says: "Online pharmacies, telemedicine providers that sell prescription drugs, and prescription drug manufacturers must be preapproved in order to serve ads on the Microsoft Advertising network." Its US rules add that online pharmacies "must be accredited by the National Association Boards of Pharmacy (NABP) or LegitScript." Addiction recovery ads run only in the United States. Providers "must be certified by Legitscript", "Landing pages and any URLs utilized in the ad must be certified", and "Lead generation ads are not allowed." See Microsoft disapproved your telehealth ads.

TikTok and LinkedIn

TikTok's US healthcare rules say pharmacy ads need "proof of certification by a third-party licensing organization, such as the National Association of Boards of Pharmacy (NABP) or LegitScript, or regional equivalent", and CBD ads need "proof of certification by LegitScript". LinkedIn's healthcare ads policy requires prior authorization and says "Ads must originate from LegitScript-certified or NABP-accredited advertisers." It adds: "Pharmacy and telehealth service ads may not be targeted at consumers or a general audience." See LinkedIn rejected your telehealth ad.

What LegitScript certification is

Meta calls LegitScript "an independent provider of certification services" and says it "operates independently of Meta" (Meta). Its healthcare program "includes telemedicine and telehealth providers, and it's required by many major credit cards and internet platforms" (LegitScript). Certification is ongoing: "Ongoing monitoring helps ensure you stay compliant with our certification standards and internet platform ad policies" (LegitScript). Anyone can enter a website on LegitScript's site to "see if it is certified by LegitScript" (lookup).

LegitScript's programs, and who it says recognizes each:

Program	Who it is for	Recognized by, per LegitScript
Healthcare (Healthcare Merchant Certification)	Pharmacies, telemedicine providers, medical spas, digital health platforms, pharmaceutical manufacturers	Google, Meta, Microsoft, TikTok, LinkedIn, Netflix, Nextdoor, Yahoo, Visa, Mastercard (LegitScript)
Addiction Treatment	Licensed substance use disorder treatment in the US or Canada, in person or by telehealth; support groups; crisis hotlines	Google, Meta, Microsoft, Nextdoor (LegitScript)
CBD	Eligible hemp-derived CBD products and the sites selling them	Google, Meta (LegitScript)
Enterprise	Large or multi-site groups; "Both paths lead to the same certification."	Same as the program (LegitScript FAQ)

If your site mentions substance use disorder treatment, ad platforms may apply their addiction policies, and LegitScript says "In these cases, we generally recommend Addiction Treatment Certification." (LegitScript FAQ). It lists in-person-only clinics with no telemedicine prescribing or online payments for prescription drugs, sober living homes and lead generation websites as generally not eligible (healthcare FAQ; addiction FAQ).

How the application works

LegitScript lists five steps (healthcare; addiction treatment):

1. Check your eligibility: "Confirm your location, business type, and scope of services."
2. Gather documentation: "Prepare required business licenses, clinical policies, ownership info."
3. Submit your application: "Complete the application in our secure client portal."
4. Expert review: "Our team verifies your business meets all Certification Standards."
5. Get certified, then keep the certification current.

Have licenses, registration details, any DEA certificate information, a privacy policy, partner pharmacy details and your ad materials ready. Addiction programs add facility records and every domain they own. The review checks nine healthcare or sixteen addiction standards (healthcare; addiction).

Three standards matter for marketers. Healthcare sites must "clearly disclose all states, territories, provinces, and/or countries in which applicants' services are available," and addiction sites must "conspicuously disclose the physical address of the facility/ies where services are rendered." Advertising "in apparent violation of the platforms' terms of service" can count against an applicant (LegitScript; LegitScript).

Then apply to each platform. Google wants applications at "the child account level, not the MCC (Manager Account) level", with your customer ID and certified domain (Google). On Meta, open Authorizations and verifications in Meta Business Suite, choose Verify using LegitScript and enter the certified URL (Meta). Microsoft starts with its Pharmacy and Telemedicine advertiser program form (Microsoft).

What LegitScript certification does not change

Certification makes you eligible to apply; the platforms still decide. LegitScript says "LegitScript cannot predict, interpret, modify, or appeal advertising decisions made by advertising platforms." (LegitScript FAQ). Under most Google healthcare policies, ads from a properly certified domain still run as Eligible (limited) (Google), and the age, country, audience and ad format rules above still apply. Lapses count too: Meta says "To maintain your authorization to run prescription drug ads, you must maintain an active LegitScript Certification." (Meta).

Nor does it change privacy law. LegitScript's own standard says "US-based applicants who collect, store, or transmit Protected Health Information (PHI) must comply with all applicable HIPAA requirements." (LegitScript). HHS says "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI." (HHS bulletin). The same page notes a June 20, 2024 court order that vacated a separate part, on IP addresses and public pages. Curve's BAA Directory lists Meta, Google Ads, Microsoft Advertising and TikTok as not signing one (which ad platforms sign a BAA).

Platform data rules stay too. Meta's prohibited information includes "Physical locations that identify a health condition, or places of treatment and counseling," and Microsoft requires "Not targeting consumers based on sensitive health information" (Microsoft). Sending the same data server-side does not change that (here is why). For which rules apply to you, including 42 CFR Part 2, talk to your counsel.

How Curve Compliance helps

Certification makes you eligible to advertise. Knowing which ads bring in patients is a separate job, and for a certified telehealth brand, pharmacy or treatment program it is where the HIPAA risk sits. Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Google Ads, Meta Conversions API, Microsoft Advertising, TikTok and LinkedIn. Each platform gets only a fixed list of fields under neutral event names, so the event does not name the medication or the substance. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Contact identifiers are off by default on Meta, Google Ads and TikTok.

Curve keeps attribution when a patient books in tools such as IntakeQ, Calendly or Jane App, and credits admissions or orders from your CRM or EHR to the original ad click. Event Logs show what Curve sent to each platform and what it accepted, and Campaign Reporting puts Meta and Google Ads spend next to those conversions. The free website scan lists the pixels and trackers on a page. Curve signs a BAA on every plan, is SOC 2 Type II, and its team does the setup, typically live in about a week. Certification and ad approval stay with LegitScript and each platform. See Curve for telehealth, online pharmacies and addiction treatment centers.

Sources, checked October 26, 2026: LegitScript certification, healthcare, telemedicine, addiction treatment, CBD, FAQ, healthcare FAQ and addiction FAQ; Google Ads Healthcare and medicines, Prescription drug services and Addiction services; Meta Drugs and Pharmaceuticals, Prescription Drugs help, Addiction Treatment and prohibited information; Microsoft Advertising Healthcare and Pharmaceutical; TikTok Healthcare and Pharmaceuticals; LinkedIn healthcare ads policy; HHS online tracking bulletin.

Frequently Asked Questions

What is LegitScript certification?

It is an independent compliance review by LegitScript that Google, Meta, Microsoft and other ad platforms use to vet online pharmacies, telehealth providers and addiction treatment programs before they can run certain health ads (LegitScript; Google; Meta; Microsoft). Most platforms add their own approval step.

Do telehealth companies need LegitScript to run Google ads?

In the United States, yes, if they facilitate prescribing. Google allows telemedicine providers "if they're accredited by LegitScript's Healthcare Merchant Certification Program," and "Advertisers must also be certified with Google." (Google).

Do GLP-1 clinics need LegitScript certification?

Usually, if they prescribe online. Meta's telehealth definition covers "the prescription of pharmaceutical products for consumers via telecommunications and digital communication technologies," and Google's US rules require LegitScript for telemedicine (Meta; Google). See GLP-1 ad disapproved: certificate required.

Does Meta accept LegitScript for addiction treatment ads?

Yes. Meta requires it, plus written permission from Meta, for addiction treatment ads aimed at people in the United States (Meta). If Meta rejected yours, see Meta addiction treatment ad rejected.

Can addiction treatment centers run lead ads on Microsoft?

No. Microsoft's addiction recovery rules say "Lead generation ads are not allowed," require LegitScript certification for the provider and for "Landing pages and any URLs utilized in the ad," and allow these ads only in the United States (Microsoft).

Is LegitScript the same as Google's healthcare certification?

No. LegitScript certifies your business, and Google certification is a separate application to Google. Google says "For some certifications, you may need to obtain third-party accreditation first (for example, from LegitScript, NABP, or G2)." (Google).

How long does LegitScript certification take?

LegitScript does not estimate one: "Every application is different, so we're unable to provide an estimated certification timeline." Complete applications and quick replies to its analysts help (LegitScript FAQ).

Does LegitScript certification change what tracking I can use?

No. HIPAA and each platform's data rules still govern what your site sends (HHS; Meta). Curve Compliance sends conversions server-side and strips PHI before data reaches an ad platform, under a BAA signed on every plan.

Talk to Curve Compliance

Book a call. See how Curve Compliance would send your Google, Meta, Microsoft, TikTok and LinkedIn conversions server-side, with PHI stripped before data reaches an ad platform and a BAA signed on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve Compliance.