In September, CBS News took a hard look at LegitScript, the company most telehealth founders know as the badge they have to earn before they can run ads or take card payments. The reporting found that businesses selling retatrutide, Eli Lilly's experimental weight loss drug that cannot legally be sold commercially, were promoting it on social media while displaying LegitScript certification, and that the certification was part of what let them do it (CBS News on X).
If you have ever been through LegitScript certification, you know how much it asks of you, which is exactly why this story is worth paying attention to.
What CBS found
CBS published its investigation on September 16, 2026. According to an analysis of the reporting, reporters identified more than 80 businesses that appeared to be breaking LegitScript's own rules while showing off its seal, and at least 35 of them displayed the seal on the same page as a product LegitScript does not allow (The Peptide Desk). Retatrutide was the headline product, but many of the same pages also sold other peptides that LegitScript prohibits, like BPC-157.
The pattern is one most of us in this industry have seen play out: a company gets certified with a clean product list, unlocks advertising and payments, and then adds the products that sell once the review is behind it. The American Med Spa Association summed up the concern as unauthorized sellers getting into ad channels that are supposed to screen for compliance (AmSpa).
The timing did not help either, since LegitScript announced on the very same day that it had passed 10,000 certified websites (PPC Land).
How LegitScript responded
LegitScript's CEO, Scott Roth, told CBS that the companies flagged in the story are a very small share of its customers and had all already been flagged through its own monitoring. He also said that LegitScript's policy is not to revoke certification immediately in every case (The Peptide Desk).
Having worked as a state regulator, I understand that answer, because giving a company a window to fix a finding is how most oversight works. The problem is that a public seal is not a private finding. While LegitScript works with a business behind the scenes, the badge on that business's website keeps telling patients, ad platforms, and payment processors that it has been vetted, and in the meantime the ads keep running.
Why LegitScript has this much power
LegitScript is a private company, but it has landed some very large contracts with some very large businesses to handle their vendor due diligence and compliance oversight, and two of the biggest for our industry are Meta and Stripe. Meta requires online pharmacies and telehealth providers to hold LegitScript certification before running prescription drug ads (Meta ad standards), and LegitScript says Google, Microsoft, TikTok, card networks, and payment companies rely on it in the same way (LegitScript).
That makes LegitScript a gatekeeper in a very practical sense. As anyone in this industry knows, you have to run ads to be competitive, and you have to be able to collect electronic payments to stay in business, so when one company sits in front of both, its review carries a lot more weight than a badge in your website footer would suggest.
This is also what makes the CBS story so interesting from a compliance point of view. Meta and Stripe did not build their own teams to check every telehealth company's licenses, pharmacy partners, and product lists. They outsourced that diligence, which is a reasonable decision at their scale, but outsourcing the work does not outsource the accountability. When certified sellers end up in a national news investigation, people ask how LegitScript missed it, and they also ask why the platforms ran the ads and processed the payments.
Certification is something you maintain, not a checkbox
I think a lot of companies treat LegitScript as a checkbox, something you get through once so the ads turn on, when really it is an ongoing obligation that you have to maintain. Your certification is a snapshot of how your business looked on the day it was reviewed, and every new product, pharmacy partner, state, or landing page after that is a change LegitScript expects to know about.
After a story like this, I would expect the scrutiny to roll downhill. That likely means tighter monitoring, faster flags, more frequent requests to update your application, and much closer review of anything peptide or GLP-1 related, which means compliant companies will feel it too, not only the ones that got caught.
The same lesson applies to your own vendors. Your pharmacy, your clinical network, your lab, and your marketing agency are all forms of outsourced compliance, and each of them carries your name when something goes wrong. A certification, a compliance page, or a signed BAA tells you someone checked at one point in time, but it does not tell you what that vendor is doing today.
What to do now
- Compare what LegitScript approved to what is actually live on your site, in your checkout, and in any partner storefronts, and pull anything investigational, labeled research use only, or on LegitScript's prohibited list.
- Update LegitScript before you add products, pharmacy partners, states, or domains, not after.
- If partners sell through your platform or display your certification, review their catalogs on a schedule and document what you find.
- Recheck your own vendors' licenses, products, and marketing on a recurring basis, and keep a record of each check.
Related reading and how Camino helps
We have covered the basics of what LegitScript certification is and how to get certified, along with the retatrutide enforcement picture and Eli Lilly's lawsuits against sellers. Camino helps telehealth and digital health companies get through LegitScript certification and keep it in good standing, including catalog reviews, vendor due diligence, and partner audits. If you want a second set of eyes, reach out and we will walk you through it.
References
- CBS News on X: LegitScript and retatrutide sellers
- The Peptide Desk: Is LegitScript... Legit?
- American Med Spa Association: CBS News investigation raises concerns about unapproved retatrutide sales
- PPC Land: LegitScript tops 10,000 certified websites
- Meta: Drugs and pharmaceuticals ad standards
- LegitScript: Certification
This post is for general information only and is not legal advice. Camino Strategy Group is not a law firm, so consult a licensed attorney about your specific situation.