A telehealth clinic pays for LegitScript certification, waits several weeks, gets certified, goes to launch the campaign it bought certification for, and discovers it still cannot run those ads. This happens often enough that it is worth writing down plainly: LegitScript certification is the prerequisite for Meta’s prescription drug advertising permission. It is not the permission.
Two Gates, Not One
There are two separate approvals between a telehealth clinic and a Meta ad that names a prescription medication, and they are granted by two different organizations on two different timelines.
The first gate is LegitScript. LegitScript is a third-party certification body that verifies healthcare merchants are operating legitimately, and its certification is what payment processors and ad platforms lean on rather than doing that diligence themselves. You apply, they review your business, and they certify you or they do not.
The second gate is Meta. Once you hold certification, you apply to Meta for permission to advertise prescription drugs. Meta reviews that application on its own criteria and grants or denies it separately. Holding a LegitScript certificate makes you eligible to ask. It does not make the answer yes, and it does not make the answer fast.
Clinics get into trouble by budgeting for the first gate, planning the campaign, and discovering the second gate exists in the week they meant to launch.
What Certification Costs and How Long It Takes
As of 2026, LegitScript healthcare merchant certification runs approximately a $975 one-time application fee per website, plus an annual certification fee of roughly $2,150 per website at the standard tier. Merchants placed on enhanced monitoring after prior compliance issues pay meaningfully more per year. Each domain is certified and priced separately, which matters if you run a main site and a separate funnel domain.
Telemedicine falls into a review category for more complex business models, which means additional review time. Plan in weeks. LegitScript revises its schedule periodically, so confirm the live figures before you build a budget around them.
“The certification is the cheap part. The expensive part is the eight weeks a clinic spends waiting on it with no funnel built, no verification done, and no follow-up system in place, because they treated the certificate as the whole project,” says Simon Molay, founder of ScaleClinics.
There Is No Platform That Skips This
The instinct after learning the timeline is to look for a platform that does not ask. There is not one worth using.
Google runs its own certification program for advertisers in regulated healthcare categories and generally expects LegitScript certification from telemedicine advertisers, so it is the same requirement wearing a different hat. TikTok prohibits prescription drug advertising outright, so there is nothing to apply for. And the tactics people reach for instead, running through a second portfolio, using an unrelated business entity, rotating domains, are the exact patterns platform enforcement is built to detect. They escalate from a rejected ad to a permanently banned portfolio, which takes the clinic’s page, pixel, and history with it.
If a clinic genuinely cannot get certified, the honest strategic answer is to advertise a different offer. Consultations, evaluations, and the clinic’s own service are advertisable. The medication is what needs permission.
The Waiting Period Is a Build Phase
The clinics that launch fastest are the ones that treat certification review as the window where everything else gets done, because most of the rest of the stack takes weeks anyway and can run in parallel.
Business verification with Meta should be finished and clean, with the business address matching the bank account tied to the ad account. The business portfolio, ad account, and dataset should be created early and given time to build a history, because brand-new advertising assets in a health category get treated with more suspicion than aged ones. The funnel should live on a domain you control. The follow-up system should be built and tested against real submissions, since speed to first contact decides whether the ad spend converts long before creative does.
None of that requires certification, and all of it is required regardless. A clinic that finishes it during the wait launches the week permission lands. A clinic that waits starts a six-week build the day it gets approved.
What You Can Advertise Meanwhile
Standard policy leaves more room than most clinics use. Symptom-led creative works and often outperforms compound-named creative anyway, because it speaks to what the person is actually experiencing rather than to a molecule they may not know. Consultation and evaluation offers are advertisable. Provider credentials, the clinic’s process, and genuinely educational content all run inside policy.
The one thing to avoid is the near-miss: creative that does not technically name a compound but is clearly selling one through implication and imagery. Automated review is better at catching that than most advertisers expect, and a pattern of near-misses builds the account history that turns a single rejection into a restriction.
Nothing here is legal or regulatory advice, and certification requirements and platform policies change. Confirm current requirements with LegitScript, the platform, and qualified counsel before acting.