Regulatory Oversight of Online Pharmacies: FDA and State Roles

When you order medication online, you’re not just clicking ‘buy’-you’re trusting a system that’s supposed to keep you safe. But not all online pharmacies are created equal. Some are licensed, legitimate, and backed by federal and state oversight. Others are dangerous operations selling fake pills, wrong dosages, or toxic substances. The difference? It comes down to who’s watching-and how.

Federal Oversight: The FDA’s Role

The Food and Drug Administration (FDA) doesn’t license pharmacies, but it controls what drugs can be sold and how they’re advertised. If a website sells prescription drugs without a valid prescription, the FDA can shut it down. If it promotes a drug with false claims-like saying a weight-loss pill is ‘FDA-approved’ when it’s not-that’s a violation too.

The FDA’s BeSafeRx program is your first line of defense. It’s a free tool that tells you whether an online pharmacy is legitimate. To pass, a pharmacy must: always require a prescription, have a U.S. physical address and phone number, employ a licensed pharmacist, and be licensed by a state board of pharmacy. If it doesn’t meet all four, it’s flagged as risky.

In 2025 alone, the FDA issued 147 warning letters to illegal online pharmacies-a 32% jump from 2024. Many of these sites were selling unapproved versions of popular drugs like Semaglutide and Tirzepatide. These aren’t just ineffective-they can be deadly. One patient in Ohio ended up in the hospital after taking a counterfeit version of a GLP-1 medication that had 12 times the active ingredient it should have.

State Boards: The Frontline Regulators

While the FDA sets national drug safety rules, state pharmacy boards are the ones actually licensing and inspecting pharmacies. Each state has its own board that decides who can operate within its borders. A pharmacy in Texas must follow Texas rules. One in California must follow California’s.

As of November 2025, 48 out of 50 states offer public online databases where you can verify if a pharmacy is licensed. You can search by name, address, or license number. If a site doesn’t show up in your state’s database, don’t trust it. Alabama and Massachusetts don’t offer full public access, so extra caution is needed there.

State boards also handle complaints. In 2024, they received 2,845 reports about illegal online pharmacies. California, Texas, and Florida led the list-not because they have more scams, but because they have more people using online services. These boards work with the FDA and DEA to shut down operations, revoke licenses, and even refer cases for criminal prosecution.

The DEA and Telemedicine: A New Era of Prescribing

Before 2025, the Ryan Haight Act made it nearly impossible to get controlled substances like Adderall or oxycodone online without an in-person visit. That changed with the DEA’s January 16, 2025, announcement of three new telemedicine registration categories.

Now, providers can prescribe Schedule III-V controlled substances (like Xanax or Vyvanse) through telemedicine without ever meeting the patient face-to-face-if they hold a Special Registration. For Schedule II drugs (like oxycodone or fentanyl), only psychiatrists, hospice doctors, pediatricians, and long-term care physicians can apply for an Advanced Telemedicine Prescribing Registration. Even then, they must check the patient’s state Prescription Drug Monitoring Program (PDMP) before writing the prescription.

The DEA is also building a nationwide PDMP system to replace the current patchwork of 50 different state databases. By Q3 2026, pharmacists and prescribers will see a patient’s full controlled substance history no matter where they live. That’s a big win for safety.

But this flexibility comes with risk. Some clinics are exploiting the new rules. The DEA has identified over 1,200 websites selling controlled substances illegally, and 68% of them operate outside the U.S. These sites pretend to be telemedicine providers, but they’re just prescription mills. One clinic in Florida was fined $500,000 in August 2025 for writing 1,400 prescriptions for Adderall in a single month-with no medical records to back them up.

What Makes a Pharmacy Legit? The Checklist

Not every pharmacy with a website is safe. Here’s how to tell the difference:

• Requires a prescription-No exceptions. If it offers pills without one, walk away.
• Has a U.S. address and phone number-Check it. Google the address. Call the number. If it’s a PO box or a call center overseas, it’s a red flag.
• Has a licensed pharmacist on staff-Legit pharmacies let you talk to a pharmacist before you buy. If you can’t reach one, don’t buy.
• Is licensed by your state board-Go to your state’s pharmacy board website and search for the pharmacy name. If it’s not there, it’s not legal.
• Uses BeSafeRx verification-Type the website into the FDA’s BeSafeRx tool. If it says “Not Verified,” that’s your answer.

Legit sites like CVS Caremark Online Pharmacy have over 12,000 reviews on Trustpilot with a 4.6/5 rating. Fake ones? They average 1.8/5. Don’t trust the website design. Trust the data.

Red Flags You Can’t Ignore

If any of these show up on a pharmacy’s site, stop. Immediately.

• “No prescription needed” or “Instant approval”
• Prices that are 70% cheaper than your local pharmacy
• Payment only by cryptocurrency or wire transfer
• No privacy policy or terms of service
• Website looks like it was built in 2008
• Social media ads with influencers saying “This drug changed my life!” without mentioning risks

The FDA has cracked down hard on influencer marketing. In 2025, they issued more enforcement letters for misleading social media ads than in any year since 2010. A single Instagram post promoting a weight-loss drug without listing side effects can trigger a federal investigation.

Compounded Drugs: The Gray Zone

Drugs like Semaglutide and Tirzepatide were in short supply for years. Compounding pharmacies stepped in to fill the gap. These are pharmacies that mix custom doses of medications-often for patients who can’t tolerate commercial versions.

There are two types: 503A and 503B. 503A pharmacies are state-licensed and can only make drugs for individual patients with valid prescriptions. 503B pharmacies are federally registered and can make larger batches-but they’re subject to stricter FDA inspections.

Here’s the problem: 503A pharmacies aren’t FDA-approved. That means the agency doesn’t test their drugs before they’re sold. If a 503A pharmacy makes a batch of Tirzepatide and one vial has too much active ingredient, the FDA can’t stop it before it’s shipped. That’s why state boards are critical-they’re the ones auditing these labs.

As of September 2025, the FDA clarified that only 503A pharmacies can compound these drugs, but they must still follow state laws and patient-specific prescriptions. Many patients don’t realize they’re getting a compounded version. Always ask your pharmacist: “Is this FDA-approved, or is it compounded?”

What You Can Do

You’re not powerless in this system. Here’s how to protect yourself:

• Always get a prescription from a licensed provider-not a website that gives you one after a 5-minute chat.
• Use only pharmacies listed on your state’s board of pharmacy website.
• Check the FDA’s BeSafeRx tool before buying anything online.
• Report suspicious sites to the FDA at fda.gov/safety.
• Ask your doctor if they recommend any online pharmacies they trust.

Over 37% of U.S. adults used online pharmacies in 2025. But 78% of those users stuck with services tied to big-name pharmacies like CVS, Walgreens, or Kaiser. That’s not an accident. These companies have compliance teams, legal departments, and real pharmacists on call. They play by the rules.

Frequently Asked Questions

Next Steps

If you’ve used an online pharmacy before, take five minutes today to verify it. Go to your state’s pharmacy board website. Search the name. Check BeSafeRx. If you’re unsure, ask your pharmacist. You don’t need to avoid online pharmacies-just avoid the unsafe ones. The system works when you use it right.