By
Austin Coker
Reading time: 10 min
If your Google Ads account just got a disapproval with the word “LegitScript” in it, you are not alone in being confused about what to do next. LegitScript certification is a third-party verification that proves your healthcare, pharmacy, addiction treatment, or CBD business operates legally and transparently. Ad platforms and payment processors use it to decide whether you get to advertise or take card payments at all.
This guide covers what LegitScript certification actually is, which businesses need it in 2026, what it costs, how long approval takes, and the mistakes that most often get applications delayed or denied.
LegitScript is an independent compliance company that reviews businesses selling products and services in high-risk categories. When a business passes its review, it receives LegitScript certification and is added to a public database that platforms like Google, Microsoft Advertising, Meta, and major payment processors check before approving accounts or ads.
The review looks at whether you hold the licenses required in every jurisdiction you serve, whether your website and marketing make claims you can’t back up, and whether the people behind the business have a history of regulatory or legal problems. Certification is ongoing. Once approved, LegitScript keeps monitoring your website and licenses for as long as you hold the certification.
LegitScript runs separate certification programs depending on the industry. The ones most businesses deal with are:
Healthcare Merchant Certification, for online pharmacies, telehealth providers that prescribe medication, and other healthcare merchants
Drug and Alcohol Addiction Treatment Certification, for rehab centers, detox facilities, and recovery services
CBD Certification, for CBD product sellers and their websites
Each program has its own requirements and fee structure, so the first step is figuring out which one applies to you.
You need LegitScript certification when a platform you depend on requires it. In practice, that means most businesses in the following categories.
Google Ads, Microsoft Advertising, and Meta all require online pharmacies to be certified before they can advertise prescription drugs in the US. Google’s Healthcare and medicines policy lists LegitScript as one of the accepted certifiers for this. Payment processors also commonly ask for it before approving a merchant account that sells prescription products.
If your telehealth platform connects patients with providers who prescribe medication, especially controlled substances, weight loss drugs, or hormone therapy, expect advertising platforms and processors to ask for LegitScript certification. Many telehealth brands get certified before launch because rebuilding an ad account after repeated disapprovals is slower than getting approved upfront.
Google requires addiction treatment providers to be certified by LegitScript to advertise in the US for drug and alcohol rehab services, according to its Addiction services policy. Meta has a similar requirement. This applies to inpatient facilities, outpatient programs, detox centers, sober living referral services, and helplines.
CBD is one of the hardest categories to advertise. Google only allows certain topical, hemp-derived CBD products to be advertised in a limited set of US states, and only with LegitScript certification, according to its CBD advertising policy. Outside of ads, LegitScript certification also helps CBD brands get accepted by payment processors that would otherwise decline them.
Brands selling supplements with aggressive health claims or ingredients that sit in a regulatory gray area often run into processor reviews. LegitScript certification is not always required here, but it frequently becomes the deciding factor when a processor or marketplace flags your account.
If you sell general wellness products with no medical claims and no prescription component, you probably don’t need LegitScript certification. Check the specific policy pages for each platform you plan to use before paying for a review.
LegitScript certification has two costs: a one-time, non-refundable application fee and a recurring annual fee to stay certified. Both vary by program and by how many websites, facilities, or products you submit.
As a general range based on LegitScript’s published certification pricing:
The application fee typically sits in the high hundreds of dollars per application
Annual fees typically start around $2,000 per year and increase with the number of websites, facility locations, or products covered
Addiction treatment certification usually ends up costing more for multi-location operators, because fees scale with each facility. CBD certification can scale with the number of products you submit for review. A single-website telehealth company and a 12-location treatment network will pay very different amounts, so price your exact setup on LegitScript’s site before budgeting.
There are also indirect costs that rarely get mentioned. You may need to update your website copy, add disclosures, pay for third-party lab testing (for CBD), or obtain missing state licenses before you can pass. For some businesses, those fixes cost more than the certification itself.
The cost that matters most is usually the cost of not being certified. Without it, you can’t run paid search for your core service, and in some cases you can’t process cards either.
Most businesses should plan for several weeks to a few months from application to approval. A clean application with complete licensing and a compliant website can move through review in a matter of weeks. Applications that need multiple rounds of corrections often stretch past two months.
The timeline depends heavily on how prepared you are when you apply. LegitScript reviewers will come back with requests for missing documents, website changes, or clarification on ownership, and each round adds time. The biggest delays usually come from licensing gaps, especially for telehealth companies serving patients across many states where a single missing provider license holds up the entire review.
If you have a launch date or an ad campaign tied to approval, apply as early as possible and budget extra time for at least one round of revisions.
The process is the same across programs, though the documents differ.
Confirm which program you need. Healthcare, addiction treatment, and CBD each have their own application. Applying to the wrong program wastes the application fee.
Gather your licensing. Collect every license that applies to your business in every state or country you serve. For pharmacies, that includes pharmacy licenses and pharmacist-in-charge details. For telehealth, it includes provider licenses in each state where patients are treated. For addiction treatment, it includes state facility licenses and any accreditation you hold.
Audit your website before applying. Remove claims you can’t support, make sure your contact details, ownership, and physical address are clear, and confirm your privacy policy and terms match how you actually operate. For CBD, have current certificates of analysis available for every product.
Submit the application and pay the fee. You’ll provide business information, ownership details, licensing, and the websites to be reviewed.
Respond quickly to reviewer requests. Most applications get at least one request for changes. The faster and more completely you respond, the faster you get approved.
Add your certification to the platforms. Once approved, you still need to apply for the relevant certification inside Google Ads, Microsoft Advertising, or Meta. LegitScript approval does not automatically unlock your ads.
Most denials come from issues that could have been fixed before applying.
Missing or expired licenses are the most common problem. If you serve a state, you need to be licensed there, and LegitScript checks.
Unsupported health claims on your website or product pages are another frequent issue. Phrases like “cures,” “treats,” or “clinically proven” without proper backing will get flagged, especially for supplements and CBD.
Ownership problems can also stop an application. LegitScript reviews the people behind the business, and undisclosed owners or past regulatory actions can lead to denial.
For addiction treatment providers, patient brokering concerns are a serious red flag. Call center practices, lead sharing arrangements, and misleading claims about insurance coverage are all reviewed closely.
Finally, some businesses are rejected because they applied with a website that doesn’t match what they actually sell. If your site lists products or services not covered in your application, expect follow-up questions.
Certification is ongoing monitoring. LegitScript continues to review your website, licenses, and business activity for as long as you’re certified. If you add a new product line, expand into new states, or change ownership, you’re expected to update LegitScript. Letting a license lapse or publishing non-compliant content can result in your certification being suspended, which can shut off your ads overnight.
Treat compliance as part of your marketing workflow. Every new landing page, ad, and product launch should be checked against the same standards that got you certified.
Getting certified opens the door to paid search, but it doesn’t make your campaigns perform. Healthcare, addiction treatment, and CBD are some of the most expensive and competitive categories in Google Ads, and the policies keep tightening even for certified advertisers. Ad copy, landing pages, and keywords still go through platform review, and one non-compliant landing page can get an ad disapproved even with certification in place.
On the organic side, LegitScript certification doesn’t directly improve rankings. What it does is signal trust to users and AI search engines, especially when you display your certification seal and link to your public LegitScript verification page. In regulated categories, buyers and patients look for proof that a business is legitimate before they convert, and that proof also supports the kind of trust signals that search engines and AI assistants weigh when deciding which sources to recommend.
At 95 Projects, we work with regulated and high-risk businesses on PPC, SEO, and GEO strategies built around these policies, so certification turns into customers instead of just a badge.
Austin Coker is the CEO and founder of 95 Projects. He has worked in SEO since 2020, when he built and sold an ecommerce brand that grew mainly through search. He founded 95 Projects in 2022 to help SaaS, ecommerce, and B2B service companies show up wherever their buyers search, from Google to ChatGPT and AI Overviews.
Have questions about working with us? Book a 30-minute strategy call to discuss your goals and see if we’re a good fit.
No-pressure conversation
Clear next steps (if we’re a fit)
Talk directly to an expert
Yes, for certain categories. Google requires LegitScript certification for US online pharmacies, addiction treatment advertisers, and CBD advertisers in the states where CBD ads are allowed. Other healthcare categories may require it depending on the product and location.
You pay a one-time application fee plus an annual fee that typically starts around $2,000 and increases with the number of websites, facilities, or products covered. Check LegitScript’s current pricing page for your specific program.
Plan for several weeks at minimum. Applications with complete licensing and a compliant website move fastest, while those requiring multiple revisions can take two months or longer.
Certification renews annually with your annual fee, and LegitScript monitors your business throughout the year. It can be suspended or revoked if your licenses lapse or your business falls out of compliance.
Only in limited cases. Google allows certain FDA-compliant, hemp-derived topical CBD products in specific US states for LegitScript-certified advertisers. Ingestible CBD products are still not allowed.
Most telehealth companies that prescribe medication need it to advertise on Google and Meta, and many payment processors require it as well. Telehealth services that don’t prescribe may not need it.
