Why LegitScript Certification Is the Key to Med Spa Advertising in 2026

Advertising a Med Spa Got Harder, on Purpose

A few years ago, running a Google or Meta ad for weight-loss injections, hormone therapy or prescription skincare was mostly a matter of picking the right audience and writing decent copy. That is no longer true. Google and Meta now require third-party certification before they will run ads for online pharmacies and telehealth providers, which is where GLP-1 weight-loss programs, hormone therapy and other prescription services delivered by telehealth land. The rules sit in each platform's own policies, they change, and they apply to how you prescribe and take payment, not just to what you advertise.

The certification those platforms point to is LegitScript. If your clinic prescribes by telehealth, advertises prescription services on those platforms and has not been certified, your ads may be rejected outright or your ad account may be put at risk. For some clinics that is the real reason a campaign "isn't working," and it has nothing to do with targeting or budget.

What LegitScript Certification Actually Is

LegitScript is an independent certification and monitoring company that platforms such as Google and Meta rely on to vet businesses that advertise regulated healthcare products and services. It is not a government agency and it does not replace your state license, but it functions as the checkpoint the ad platforms trust instead of trying to verify healthcare compliance themselves at scale.

Certification means LegitScript has reviewed your business — its licensing, its ownership structure, the way it markets regulated products — and confirmed it meets a defined set of standards. Once certified, your ad accounts are cleared to run campaigns for the categories the certification covers, and the certification itself is monitored on an ongoing basis rather than granted once and forgotten.

Why Google and Meta Require It in the First Place

• Illegal online pharmacies: the certification exists largely because unregulated actors used paid ads to sell prescription drugs with no licensing and no oversight — the platforms needed a scalable way to screen that out.
• Patient safety, not just platform liability: a business advertising a GLP-1 program or hormone therapy without real medical oversight behind it is a patient-safety problem before it is an advertising-policy problem.
• Consistent enforcement across millions of advertisers: neither Google nor Meta has the staff to individually verify every healthcare advertiser's licensing and clinical structure — outsourcing that check to LegitScript is how they enforce it at scale.

What Happens If You Skip It

Running ads that a platform gates behind LegitScript certification, without it, may not bring a warning first. Ads get disapproved on submission, or a live campaign gets pulled mid-flight once the platform's systems flag the category. Repeated attempts to run uncertified ads in these categories are one of the more common ways clinics end up with a suspended ad account entirely — which does not just cost the campaign, it can take down every other campaign running on that account, including the ones that were never gated in the first place.

For a telehealth-driven clinic where GLP-1 or hormone therapy is a meaningful part of the patient pipeline, losing the ability to advertise those services — or losing the ad account outright while the appeal process plays out — is a real, immediate revenue problem, not a compliance technicality.

What LegitScript Actually Checks

The review is not a formality. LegitScript looks at the same underlying structure a state medical board would: is the business actually licensed to do what it advertises, is there a real physician relationship behind the prescribing, and is the clinical oversight documented rather than assumed.

• Business and facility licensing: the entity advertising has to hold the licenses its state actually requires for the services being promoted — not just a general business license.
• Medical director and prescribing structure: a documented, licensed physician relationship behind any service that involves a prescription — the same relationship your standing orders and protocols already have to establish.
• Advertising content itself: claims about outcomes, safety and what a product treats have to match what is actually approved and true, not marketing language that overstates the medicine.
• Ongoing compliance, not a one-time check: LegitScript monitors certified businesses on a recurring basis, so a clinic that lets its licensing or oversight lapse after certification can lose it just as easily as one that never had it.

Getting Certified Is Easier When the Compliance Work Is Already Done

The reason LegitScript certification catches clinics off guard is usually not that the underlying compliance is missing — it is that the paperwork proving it does not exist yet, or exists in a form nobody can produce quickly. A clinic that already has a licensed medical director actively signing standing orders, a documented PC/MSO structure, and protocols written for its actual service menu is most of the way to a LegitScript application before it even starts. A clinic assembling that proof for the first time, under a certification deadline, is doing weeks of work that should have already been done.

This is part of why MedGrid bundles LegitScript certification as an add-on rather than treating it as a separate vendor relationship: the entity structure, the medical director connection and the protocol file it depends on already live in your account, so the application is largely a matter of packaging documentation that already exists rather than producing it from scratch.

The Practical Takeaway

If you prescribe by telehealth or take card-not-present payments for prescription medication, and you want to advertise on Google or Meta, plan on LegitScript certification, and plan the timeline, because LegitScript publishes none and a missing document can add weeks. If you only treat patients in person, you are generally not eligible and generally do not need it. Either way, nobody can guarantee certification or ad approval, so build the file first and confirm your scope with LegitScript before you pay for anything. For a fuller walk-through, see our LegitScript page.

Talk to us about adding LegitScript certification to your membership — see the add-ons section on the pricing page for what is included.