I am so tired of talking about peptides.

I've spent an unreasonable amount of time over the past year writing about experimental peptides, arguing about their safety, and explaining why I think allowing people to inject themselves with unapproved drugs based on anecdotal evidence is a terrible idea.

At this point, I have very little interest in continuing that debate. I've made my position clear. If you want to read about the science, the potential benefits, or the risks, there are plenty of places to do that. I'm not going to rehash it all again.

But a few days ago, while reading through the latest developments in the peptide saga, something caught my attention. And for the first time in a while, I found myself genuinely interested in writing about them again.

But not because of the medicine.

Because of the money.

On Monday, a company you've probably never heard of made an announcement that could help determine which experimental medicines start showing up in your Instagram feed.

The company is called LegitScript. It doesn't manufacture drugs, prescribe medications, or operate pharmacies. It isn't part of the FDA, and it doesn't answer to Congress.

But if you run an online pharmacy or telehealth company and want to advertise your services on Google or Meta, there's a good chance you'll need its blessing.

On November 2, LegitScript announced that it would begin allowing qualifying businesses offering six previously restricted compounded peptides, including BPC-157 and TB-500, to obtain its certification.

To most people, this probably sounds like a mundane administrative update.

To companies hoping to turn experimental peptides into the next billion-dollar wellness industry, it could be a very big deal.

Because while LegitScript doesn't decide whether Google or Meta will actually allow these advertisements, its certification removes one of the major obstacles standing in the way.

Neither platform has publicly committed to opening the doors to peptide advertising. Maybe they won't.

But I have a hard time imagining that two of the largest advertising businesses in human history are going to be particularly enthusiastic about turning away millions of dollars from an industry desperate to find new customers. Especially now that they have a convenient third party to point to when someone asks why they're allowing it.

And that raises a question that has nothing to do with peptides at all.

Who gave this company so much power over what medicine Americans are allowed to advertise online?

When you walk into a pharmacy in New York, there are multiple layers of regulation intended to protect you. The pharmacy must be licensed by the state. The pharmacists must maintain their licenses. The FDA regulates drug approvals and manufacturing, while state boards oversee pharmacy practice.

The system is far from perfect, as I've spent the better part of this newsletter explaining, but at least there's an established framework of public oversight.

The internet created a new problem.

Suddenly, anyone could build a website that looked like a pharmacy, advertise prescription drugs, collect a credit card number, and ship God knows what to someone's doorstep.

Google couldn't realistically send inspectors to every online pharmacy advertising on its search engine. Visa and Mastercard couldn't independently investigate every merchant selling prescription drugs.

They needed someone to tell them which businesses were legitimate.

Enter LegitScript.

Founded in 2007, LegitScript built a business around verifying that online pharmacies, telehealth providers, and other healthcare merchants comply with applicable laws and its certification standards. Meet the requirements, and you could add a trusty badge to the bottom of your website letting everyone know you’re legit.

Today, its certification is recognized by some of the largest advertising and payment companies in the world, including Google, Meta, Visa, and Mastercard.

LegitScript's own website explains that without certification, telehealth businesses may be limited in their ability to advertise on Google, Microsoft, Meta, and TikTok, or maintain relationships with certain payment providers.

Think about what that means.

You can have licensed physicians, a legitimate pharmacy partner, a functioning website, and thousands of customers. But if you can't advertise your services or reliably process payments, building a national online healthcare business becomes considerably more difficult.

LegitScript doesn't need the legal authority to shut down your healthcare business. Its influence comes from the commercial infrastructure that relies on its certification.

That's an extraordinary position for a company most consumers have never heard of.

LegitScript wasn't the first organization to tackle online pharmacy verification.

Back in 1999, the National Association of Boards of Pharmacy, or NABP, launched VIPPS, the Verified Internet Pharmacy Practice Sites program.

NABP is a nonprofit professional association representing state pharmacy boards. It's not a government agency, but its members are the regulators responsible for overseeing pharmacy practice.

VIPPS helped consumers and internet platforms distinguish legitimate online pharmacies from rogue operators. For years, it was an important credential for pharmacies seeking to advertise online.

LegitScript eventually emerged as another major player, working with search engines and payment companies to verify healthcare businesses and monitor suspicious activity.

Its influence expanded beyond traditional pharmacies into telehealth and other online healthcare services.

Google still recognizes NABP accreditation alongside LegitScript for certain online pharmacies, so it would be inaccurate to call LegitScript a literal monopoly.

But in the rapidly expanding telehealth industry, LegitScript has become an enormously influential commercial gatekeeper.

Its influence has even prompted antitrust litigation. In 2019, competing verification company PharmacyChecker accused LegitScript, NABP, and others of anticompetitive conduct. The allegations were contested, and PharmacyChecker ultimately dismissed its U.S. antitrust claims against LegitScript in 2026 without a judicial finding of wrongdoing.

But the dispute illustrates how valuable access to the online pharmacy verification market has become.

And that brings us to the part of this story I find most interesting.

LegitScript is a private, for-profit company.

Not a government agency. Not a regulatory body appointed by Congress. Not even a nonprofit professional association like NABP, which created VIPPS.

It's a business.

And like every other business, it needs customers, revenue, and growth.

I'm not accusing LegitScript of corruption, and I have no evidence that it is certifying businesses improperly to collect fees. There are good reasons for platforms to rely on independent experts to distinguish legitimate healthcare businesses from fraudulent ones.

But there is something strange about a system in which a private company becomes such an important gatekeeper to an entire industry, particularly when the companies seeking its approval are also its paying customers.

LegitScript's published standard certification fees are $975 to apply and another $2,150 annually per website once approved. That's $3,125 in the first year.

For a well-funded telehealth company, that's pocket change.

The real value isn't the certification fee. It's what certification can unlock.

A company like Hims & Hers doesn't need LegitScript because it wants a nice-looking badge on its website. Certification can be part of the infrastructure that allows a healthcare company to advertise, process payments, acquire customers, and scale.

And the more businesses that need certification, the more valuable the certification business potentially becomes.

That's why this week's peptide announcement caught my attention.

On October 28, the Department of Health and Human Services announced an enforcement-discretion policy covering certain compounded versions of six peptides. The policy outlines conditions under which the FDA intends to refrain from taking specified enforcement actions against qualifying compounders.

In layman’s terms: The peptides have not suddenly become FDA-approved drugs. But the FDA has made it clear that they won’t punish you for selling them anyway.

Days later, LegitScript announced that businesses offering qualifying compounded peptides would no longer be disqualified from certification solely because they sold those products.

From LegitScript's perspective, this is a defensible decision. The government's enforcement position changed, and the company updated its standards accordingly.

But from a business perspective, it also creates an opportunity.

An emerging category of healthcare businesses that previously faced an obstacle to certification may now qualify. Some may become paying customers.

And the opportunity doesn't end with LegitScript.

For the past several years, telehealth companies have demonstrated just how lucrative it can be to sell medicine directly to consumers online.

Companies like Hims & Hers and Ro have built businesses around making prescription treatments as easy to purchase as virtually anything else on the internet.

I've written before about the problems this creates, most recently when I discussed Ro Sparks, a compounded combination of sildenafil and tadalafil marketed through a celebrity-driven advertising campaign.

My concern then was that a telehealth company could commercialize a drug combination that had never gone through the FDA approval process, without conducting the clinical trials normally required to establish its safety and effectiveness.

This week's story is about something different.

It's about the commercial machinery that allows these companies to reach millions of potential customers in the first place.

Google and Meta make their money selling advertisements. Telehealth companies make their money acquiring patients who become paying customers.

And experimental peptides have become an enormously popular category in the wellness industry.

LegitScript's latest decision potentially removes an important obstacle for companies hoping to advertise these products.

To be clear, LegitScript certification does not automatically authorize a company to advertise peptides on Google, Meta, or TikTok. Those platforms maintain their own policies and can still reject advertisements.

And as of this writing, I have not seen a public commitment from Google or Meta to begin accepting advertisements for these six peptides.

But I have a prediction.

I suspect these platforms will eventually find a way to accommodate at least some of this market.

I can't tell you exactly how much peptide companies would spend on advertising if given the opportunity. But anyone who has spent five minutes on Instagram lately has seen just how aggressively telehealth businesses market their products.

And now the platforms have a convenient justification for allowing qualifying advertisers onto their networks.

They can point to LegitScript.

Who can point to the federal government's enforcement policy.

Who can explain that enforcement discretion isn't actually FDA approval.

Everyone has a perfectly reasonable explanation for their individual decision. Meanwhile, the advertisements may start running, the money starts flowing, and the consumer is left to figure out what any of these approvals actually mean.

Stop me if you’ve heard this before…

This is what bothers me about the entire arrangement. None of these organizations necessarily has to break a rule or act dishonestly for the system to produce an outcome that seems completely at odds with what the rules were supposed to accomplish.

I've spent the first year and a half of Drugstore Cowboy writing about the business of American healthcare. If there's one recurring theme, it's that there is an extraordinary amount of money to be made in this industry, and financial incentives don't always align with the interests of patients.

Sometimes those incentives fuel extraordinary innovation. Other times, they create an environment in which the appearance of legitimacy becomes a valuable commercial product.

A drug can remain unapproved by the FDA, be offered by a business certified by LegitScript, and potentially be advertised on the world's largest digital platforms.

All three things can be true at once.

And somewhere along the way, the average consumer is supposed to understand the difference between a company being certified, a treatment being permitted under an enforcement policy, and a drug actually being proven safe and effective.

I've spent enough time behind a pharmacy counter to know that most people don't make those distinctions. They see an advertisement from a professional-looking healthcare company, on a platform they use every day, and reasonably assume that somebody must have checked whether the medicine being sold is legitimate.

We've built a system in which commercial legitimacy can easily be mistaken for medical legitimacy.

And with so much money to be made from that confusion, I'm not convinced anyone involved is particularly eager to clear it up.

Giddy up!

Alec Wade Ginsberg, PharmD, RPh
4th-Gen Pharmacist | Owner & COO, C.O. Bigelow
Founder, Drugstore Cowboy