Narrow, real, certification-gated
Topical CBD runs with LegitScript certification and written approval. GLP-1 telehealth runs when it manages weight instead of curing it. Both need clean audience naming.
What LegitScript certification is, what it costs, how long it takes, and why Meta and Google require it before CBD or telehealth brands can run ads.
The short answer
LegitScript certification is a third-party review that confirms a CBD, telehealth or healthcare merchant meets legal and safety standards. Google requires it before topical CBD or healthcare ads can run, and Meta requires it plus its own written approval for CBD. It covers product sourcing, lab testing, website claims and licensing, with an application fee and an annual renewal.
Key takeaways
Most CBD and telehealth brands hear the word LegitScript for the first time inside a rejection notice. By then a quarter has gone. This page is the version you read before that happens: what the certification checks, what it costs, how long it takes, and what changes on Meta and Google once you hold it.
QuickAds is not LegitScript and does not certify anyone. We prepare the application pack for clients because it is the gate in front of every paid channel we run for them. Confirm current fees and timelines on LegitScript's own site before you budget.
LegitScript certification is an independent review that verifies a merchant in a regulated category (CBD and hemp, telehealth, online pharmacies, addiction treatment, and others) operates legally and transparently. Ad platforms and payment processors use it as a trust signal because they do not want to audit every merchant themselves. Google's healthcare and medicines policy names LegitScript certification as a requirement for certain healthcare advertisers, and Meta requires it before it will consider a CBD advertiser for written approval.
For a CBD brand, the review confirms the product is hemp-derived rather than marijuana-derived, that every product category has a Certificate of Analysis from an accredited lab, that THC is within the legal threshold, and that the website makes no drug or disease claims. For a telehealth company, the healthcare merchant review looks at prescriber licensing, pharmacy relationships and how prescriptions are issued.
What it is not: a legal opinion, an FDA approval, or a guarantee your ads will be approved. It removes one specific objection the platforms raise. The claims review on every ad still happens afterwards.
Google allows topical CBD advertising only from LegitScript-certified advertisers, and only in California, Colorado and Puerto Rico. Ingestible CBD is not allowed with or without certification. Telehealth providers and online pharmacies fall under Google's healthcare certification requirements, where LegitScript is the recognized certifier in the US.
Meta permits non-ingestible CBD ads in the US from advertisers who hold LegitScript certification and have received written approval from Meta for the ad account. The two steps are sequential. Certification first, then the approval request, then ads.
Many demand-side platforms and exchanges that accept CBD inventory ask for LegitScript certification or an equivalent as a condition of running, because their publishers do. It is worth holding even if Google and Meta are not in your plan.
Several processors and acquiring banks require LegitScript certification for CBD merchants. Brands sometimes get certified for checkout reasons before advertising is even on the table.
Plan for several weeks from application to decision, and longer if the website needs work first. The review itself is document-driven: product list, Certificates of Analysis for each product category, sourcing documentation, licensing where applicable, and the website as it stands on the day of review.
The delays brands actually hit are on their own side. A product with no current COA. A blog post from 2022 that says the oil helps with anxiety. A testimonial widget that pulls in customer reviews with health claims. A product name that implies a medical use. Each of these is a resubmission, and each resubmission is more weeks.
The fastest path is to run the website compliance clean-up before you apply, not after the first response. That means a claims audit of every page, every product description, every review widget and every email capture pop-up, against the same disease-claim standard the FDA and FTC use.
LegitScript charges an application fee plus an annual fee, and the total depends on merchant type and the number of product categories. Public guides put the CBD range in the low-to-mid four figures per year. Confirm current pricing on LegitScript's site before budgeting, because it changes and this page will lag.
The hidden cost is the website work. If your site has never been through a claims audit, budget the time to rewrite product pages, remove or rewrite blog content, and replace review widgets with ones you can moderate. That is usually more effort than the application itself, and it is work you need anyway, because the FTC reads the same pages.
The return is access. A certified CBD topical brand can run Google Search in three states and Meta across the US. An uncertified one cannot run either, and is left with organic, creators, programmatic and email.
Certification opens the door. It does not stop an ad being rejected once inside.
Meta and Google review every ad against their health policies. A certified account running "relieves arthritis pain" is rejected like any other.
Oils, gummies, capsules and drinks remain off both platforms with or without certification.
"Struggling with pain?" fails Meta's personal-attributes rule regardless of certification status.
The site that passed review in March is not the site in October. New products, new blog posts and new review widgets reintroduce claims. Keep the claims audit running.
The practical read: certification is step one of three. Step two is Meta's written approval. Step three is a claims-checked creative library and a landing page that stays clean. The CBD marketing guide covers what runs after certification.
QuickAds prepares the LegitScript application pack for CBD and telehealth clients: the claims audit of the website, the product list organized by category with Certificates of Analysis, the drug-claim removals and rewrites, and the Meta written-approval request that follows. You submit, because the certification belongs to your company, and your counsel signs off on the claims sheet.
Once the gate is open, the same claims library feeds the creative: 100+ creatives a month on a 5 to 7 day turnaround, reviewed frame by frame, plus creator sourcing and briefing through Remy, our influencer agent. A managed regulated-category program runs $2,000 to $5,000 per month depending on scope; software starts at $199 per month, and how the engagement runs is on its own page.
What we do not do: we are not LegitScript, we do not certify compliance, and we do not offer legal review. Related: CBD marketing, telehealth marketing, the regulated ads playbook.
LegitScript certification is an independent review confirming that a merchant in a regulated category, such as CBD, telehealth or online pharmacy, operates legally and transparently. It checks product sourcing, lab testing, licensing and the claims on the merchant's website. Google and Meta use it as a prerequisite before allowing certain CBD and healthcare ads, and many payment processors require it for CBD merchants.
Plan for several weeks from a complete application to a decision, longer if the website needs claims clean-up first. Most delays come from the applicant's side: a missing Certificate of Analysis, a blog post with a health claim, a review widget pulling in customer testimonials about symptoms. Running a claims audit of the whole site before applying is the fastest route through.
LegitScript charges an application fee plus an annual fee that varies by merchant type and number of product categories; public guides place CBD certification in the low-to-mid four figures per year. Confirm current pricing on LegitScript's own site. The larger cost is usually the website compliance work needed to pass, which the FTC's rules require anyway.
Yes, for the CBD products Meta allows at all. Meta permits non-ingestible CBD advertising in the US only from advertisers who hold LegitScript certification and have then received written approval for their ad account. Ingestible CBD cannot be advertised on Facebook or Instagram with or without certification. Hemp products containing no CBD do not need certification.
No. Certification removes one platform objection, the merchant-level one. Every ad is still reviewed against Meta's and Google's health policies, so an ad that names a condition, promises an outcome or uses second-person health copy is rejected regardless of certification. Ingestible CBD stays prohibited. Certification is step one; a claims-checked creative library and a clean landing page are the rest.
For CBD, yes: Google allows topical, non-ingestible CBD ads only from LegitScript-certified advertisers, and only in California, Colorado and Puerto Rico. For telehealth, online pharmacies and addiction treatment, Google requires its own healthcare certification, which relies on LegitScript's healthcare merchant program. Certification is applied for through LegitScript first, then submitted to Google. Ingestible CBD cannot be advertised on Google with or without it.