LegitScript certification. The paperwork that opens the ad platforms.

LegitScript certification is an independent review that verifies a merchant in a regulated category (CBD and hemp, telehealth, online pharmacies, addiction treatment, and others) operates legally and transparently. Ad platforms and payment processors use it as a trust signal because they do not want to audit every merchant themselves. Google's healthcare and medicines policy names LegitScript certification as a requirement for certain healthcare advertisers, and Meta requires it before it will consider a CBD advertiser for written approval.

For a CBD brand, the review confirms the product is hemp-derived rather than marijuana-derived, that every product category has a Certificate of Analysis from an accredited lab, that THC is within the legal threshold, and that the website makes no drug or disease claims. For a telehealth company, the healthcare merchant review looks at prescriber licensing, pharmacy relationships and how prescriptions are issued.

What it is not: a legal opinion, an FDA approval, or a guarantee your ads will be approved. It removes one specific objection the platforms raise. The claims review on every ad still happens afterwards.

Google Ads

Google allows topical CBD advertising only from LegitScript-certified advertisers, and only in California, Colorado and Puerto Rico. Ingestible CBD is not allowed with or without certification. Telehealth providers and online pharmacies fall under Google's healthcare certification requirements, where LegitScript is the recognized certifier in the US.

Meta (Facebook and Instagram)

Meta permits non-ingestible CBD ads in the US from advertisers who hold LegitScript certification and have received written approval from Meta for the ad account. The two steps are sequential. Certification first, then the approval request, then ads.

Programmatic exchanges

Many demand-side platforms and exchanges that accept CBD inventory ask for LegitScript certification or an equivalent as a condition of running, because their publishers do. It is worth holding even if Google and Meta are not in your plan.

Payment processors

Several processors and acquiring banks require LegitScript certification for CBD merchants. Brands sometimes get certified for checkout reasons before advertising is even on the table.

Plan for several weeks from application to decision, and longer if the website needs work first. The review itself is document-driven: product list, Certificates of Analysis for each product category, sourcing documentation, licensing where applicable, and the website as it stands on the day of review.

The delays brands actually hit are on their own side. A product with no current COA. A blog post from 2022 that says the oil helps with anxiety. A testimonial widget that pulls in customer reviews with health claims. A product name that implies a medical use. Each of these is a resubmission, and each resubmission is more weeks.

The fastest path is to run the website compliance clean-up before you apply, not after the first response. That means a claims audit of every page, every product description, every review widget and every email capture pop-up, against the same disease-claim standard the FDA and FTC use.

LegitScript charges an application fee plus an annual fee, and the total depends on merchant type and the number of product categories. Public guides put the CBD range in the low-to-mid four figures per year. Confirm current pricing on LegitScript's site before budgeting, because it changes and this page will lag.

The hidden cost is the website work. If your site has never been through a claims audit, budget the time to rewrite product pages, remove or rewrite blog content, and replace review widgets with ones you can moderate. That is usually more effort than the application itself, and it is work you need anyway, because the FTC reads the same pages.

The return is access. A certified CBD topical brand can run Google Search in three states and Meta across the US. An uncertified one cannot run either, and is left with organic, creators, programmatic and email.

Certification opens the door. It does not stop an ad being rejected once inside.

Health claims in the ad

Meta and Google review every ad against their health policies. A certified account running "relieves arthritis pain" is rejected like any other.

Ingestibles

Oils, gummies, capsules and drinks remain off both platforms with or without certification.

Personal-attribute copy

"Struggling with pain?" fails Meta's personal-attributes rule regardless of certification status.

Landing page drift

The site that passed review in March is not the site in October. New products, new blog posts and new review widgets reintroduce claims. Keep the claims audit running.

The practical read: certification is step one of three. Step two is Meta's written approval. Step three is a claims-checked creative library and a landing page that stays clean. The CBD marketing guide covers what runs after certification.

QuickAds prepares the LegitScript application pack for CBD and telehealth clients: the claims audit of the website, the product list organized by category with Certificates of Analysis, the drug-claim removals and rewrites, and the Meta written-approval request that follows. You submit, because the certification belongs to your company, and your counsel signs off on the claims sheet.

Once the gate is open, the same claims library feeds the creative: 100+ creatives a month on a 5 to 7 day turnaround, reviewed frame by frame, plus creator sourcing and briefing through Remy, our influencer agent. A managed regulated-category program runs $2,000 to $5,000 per month depending on scope; software starts at $299 per month, and how the engagement runs is on its own page.

What we do not do: we are not LegitScript, we do not certify compliance, and we do not offer legal review. Related: CBD marketing, telehealth marketing, the regulated ads playbook.