LegitScript, the Portland, Oregon company whose certification many advertising platforms and payment firms ask for before online pharmacies, telehealth providers and addiction treatment centres can buy ads or take card payments, said on September 16, 2026 that more than 10,000 websites had achieved its certification. The same release attached a number to the other side of its business: more than 140,000 internet pharmacy websites it has classified as operating outside applicable global pharmacy regulations.

In Short

LegitScript is a company that checks whether online pharmacies, telehealth services and addiction treatment centres are properly licensed, and Google and other platforms rely on that check before letting many of those businesses advertise. On September 16, 2026, it said more than 10,000 websites now hold its certification and that it has flagged more than 140,000 pharmacy websites working outside the rules. If you buy ads for a health business in a market where the check is required, that certificate and the monitoring attached to it decide whether a campaign can run, although the company did not say when the milestone was reached, how it splits by country or how many sites lose their status.

What LegitScript disclosed

The milestone arrived without a date attached to it. LegitScript's release, distributed on September 16, 2026 and datelined Portland, Oregon, says that more than 10,000 websites have achieved LegitScript Certification. It does not say when the threshold was crossed, how the total divides between healthcare, addiction treatment and the "other highly regulated industries" it also lists, or how many businesses stand behind those websites.

That last gap matters more than it might appear. The count is of websites, and one business can operate several. When LegitScript and Google widened their partnership to pharmacies in India and telemedicine providers in New Zealand on April 8, 2026, the company measured something else: a 103% increase in certified healthcare organisations over the preceding year. Organisations and websites are different denominators, so the two disclosures, five months apart, cannot be joined into one growth line.

According to LegitScript, certification gives businesses in healthcare, addiction treatment and other regulated sectors an independent standard for demonstrating compliance and building trust with consumers and industry partners. The company also describes it as a common prerequisite that helps unlock advertising on major online platforms and streamlines payment processing. Which platforms, and which payment processors, the release does not say.

"Reaching 10,000 certified websites reflects both the growth of digital healthcare and the trust placed in LegitScript as the market expands," said Scott Roth, chief executive of LegitScript. "That trust depends on maintaining rigorous standards over time, not just at the point of certification."

The release sets the figure against growth in telehealth, online pharmacies and direct-to-consumer healthcare. According to LegitScript, digital healthcare has become a broad ecosystem of providers, infrastructure platforms and speciality care companies, in which new products and business models can reach consumers quickly while regulatory requirements, advertising policies and payment rules keep shifting. The result, in the company's account, is a larger and faster market where compliance risk can surface across several channels and jurisdictions at the same time.

What the monitoring covers

Certification, as LegitScript describes it, is a two-part process. It starts with a comprehensive review against the company's own Certification Standards, which LegitScript says are based on applicable regulatory requirements and industry best practices. Approval does not end the scrutiny. After certification, businesses remain subject to ongoing monitoring that combines proprietary technology, regulatory intelligence and expert human review, according to the company.

The release names four areas that monitoring evaluates. The first is licensure and credentials. The second is a business's online presence. The third, with the most obvious bearing on fast-growing telehealth brands, is changes in business operations. The fourth is relevant regulatory and enforcement activity.

Those four areas differ in emphasis from the criteria LegitScript has described for the initial review. In April 2026, the company said its certification required an independent analysis of provider and pharmacy licensure, prescribing practices, patient privacy protections and advertising transparency. The ongoing list published on September 16 leans towards change detection: whether the licences still hold, whether the websites still look the way they did at approval, whether the business has altered what it does, and whether a regulator has acted against it. Coverage of the Canadian addiction treatment programme in February 2025 described application checks covering business registration, facility licensing and regional healthcare rules, ongoing monitoring of certified providers, and costs that vary with a facility's size and complexity.

What the release leaves out is the machinery. It does not say how often a certified website is re-examined, whether the technology component runs continuously or on a schedule, which signals send a case to a human reviewer, or what happens when a certified site fails a check. Suspension rates, revocation counts, processing times and prices are absent. For an advertiser whose campaigns depend on the credential staying valid, those are the operational variables; the release offers the categories instead.

Roth framed the obligation in the company's own terms. "As the market grows and changes, our responsibility is to ensure our program evolves with it while continuing to uphold the standards businesses, partners, and consumers rely on," he said.

140,000 pharmacy websites

The second number comes from the part of LegitScript's business that looks outward rather than at its own customers. Beyond certification, the company says it works with platforms, marketplaces and payments companies to identify risk across the broader commercial internet. Across its merchant, platform and risk intelligence products, LegitScript says it analyses millions of websites and other forms of online commercial activity spanning high-risk categories and global jurisdictions.

That intelligence, according to LegitScript, has allowed it to "classify and report on" more than 140,000 internet pharmacy websites operating outside applicable global pharmacy regulations. The classification data feeds directly into the company's monitoring processes. In the covering note sent with the release, LegitScript uses sharper language, calling the same sites rogue internet pharmacy websites that have been classified and reported. The release body avoids that label.

Several questions hang on the word "report". A report can go to a platform client, a payment network, a domain registrar or a regulator, and the release does not specify the recipients. Nor does it give a start date for the tally, an annual rate, a split by country, or any estimate of how many of the sites remain online. A cumulative figure without a time frame describes the size of an archive, not the pace of a problem.

Set side by side, the two headline numbers work out at roughly 14 classified pharmacy sites for every certified website. The comparison is loose, since the 140,000 covers pharmacies alone over an undefined period while the 10,000 spans several industries. What it does show, in raw counts, is that the flagged population is an order of magnitude larger than the certified one.

LegitScript says this breadth gives it an unparalleled view of how risk and compliance challenges are changing across the online ecosystem. The release provides no outside benchmark against which to test that claim.

"Risk doesn't develop in a single channel or on a single timetable," said Andy Bayley, director of risk and policy at LegitScript. "New products, business models, and tactics can gain traction quickly across the online ecosystem. Understanding those shifts at scale is critical to helping organizations make informed risk and compliance decisions."

The company has published examples of what such shifts look like. Research it released on December 10, 2025 found that online advertisements for unapproved peptides rose 208% in 2024 compared with 2023, while peptide-related product sales on e-commerce marketplaces grew 276% over five years. Melanotan, BPC-157, TB-500, PT-141 and GLP-1 peptides were the products most often observed. Like the 140,000 figure, that dataset comes from the company that sells the monitoring.

Where certification meets the ad account

On Google, LegitScript certification works as an entry condition for pharmacy and telemedicine advertising in a growing list of countries. Spain became the eleventh such market under a Google policy change effective August 5, 2026. The list was assembled one jurisdiction at a time. Google allowed LegitScript-certified telemedicine providers in France to promote their services from October 10, 2023. In 2024 it began requiring the certification from online pharmacies and telemedicine providers in Australia, with state registration accepted as an alternative for pharmacies. Japan followed with a dual pathway from January 2025, accepting either government registration or LegitScript certification. The United Kingdom and Singapore were added in July 2025, although Singapore relied on local licensing under its Healthcare Services Act rather than on LegitScript.

Approval on Google runs in two stages. A provider first obtains the LegitScript credential and then applies for Google's own certification once the platform policy covers its market, as the April 2026 India and New Zealand expansion set out. The third-party credential is a prerequisite, not approval in itself.

Addiction treatment sits behind a narrower gate. When Google opened the category to Canadian treatment centres in early 2025, LegitScript was described as the exclusive verification partner for addiction treatment advertising on Google, Meta and Microsoft. LegitScript documentation cited in July 2025 listed Google, Meta, Microsoft, TikTok, Netflix, LinkedIn, Visa and Mastercard as recognising its healthcare merchant certification.

Google has spent the past year changing what certified health advertisers may do while leaving the certificate itself in place. From October 2025, advertisers targeting Canada, New Zealand and the United States could use prescription drug terms in ads and landing pages without certification, but still needed it to keyword-target those terms, with enforcement from October 29. Two months later the programmatic channel parted ways with search: Google told publishers that Authorized Buyers could promote prescription drugs without certification from January 2026, stating that the Google Ads Healthcare and Medicines policy was unaffected.

New surfaces are opening in stages. In May 2026, Google confirmed a small US test of healthcare ads inside AI Mode for English-language queries, a category blocked from AI search surfaces since those placements were first monetised in 2024. Pinned assets and text disclaimers, which regulated advertisers use to hold mandatory wording in place, were left out of the test. And when Google added 14 Shopping ad markets in July 2026, medicine ads were blocked in all 14.

The payments side

Advertising is only half of what LegitScript claims for the credential. The release says certification streamlines payment processing, and Roth's final remarks were addressed as much to the payments system as to ad platforms.

The company's position there predates the milestone. LegitScript is recognised by Visa and Mastercard for assessing merchants that conduct card-not-present transactions, and its December 2025 peptides research described healthcare merchant certification as recognition for businesses selling pharmaceuticals through card-not-present transactions, which card networks treat as high risk. For a telehealth business, then, a single review can determine whether it may buy search ads and whether it can process a card.

"The scale of our work has grown significantly, but the mission behind it has remained the same," Roth said. "A safer, more transparent internet and payments ecosystem requires constant vigilance, continued investment, and collaboration across the industry. We will keep evolving our capabilities and working with businesses, platforms, and other stakeholders to stay ahead of emerging risks and help raise the standard for compliance."

The release names no payment partners and does not describe what happens to a merchant account when monitoring finds a problem.

Gambling and prediction markets

LegitScript also pointed to its work in prediction markets and online gambling in the materials sent with the release, without describing that work or naming a certification programme for either category. Both have been moving quickly on the advertising side.

Google opened prediction market advertising to CFTC-regulated platforms from January 21, 2026, placing the category under both its Financial Services and its Gambling and Games policies. On June 2, 2026, it prohibited those ads in Ohioas the state's dispute over gambling jurisdiction escalated. In August 2026, the New York City Council opened an inquiry into Polymarket, Kalshi, Coinbase and Gemini Titan over their marketing, after a Wall Street Journal analysis of more than 1,100 creator videos sponsored by Polymarket found that 70% featured fake websites and simulated trades.

Gambling has moved the other way on one channel. Google dropped end-advertiser certification for gambling ads on Authorized Buyers in 37 markets from August 10, 2026, while the Google Ads certification requirement for the same category stayed in place. Where a third-party certifier fits into those categories, and on which buying channel, is not something the September release addresses.

Why this matters for the marketing community

The milestone is a data point in a larger shift. PPC Land's weekly review of July 26, 2026 observed that eligibility is increasingly decided by external certification rather than platform review: LegitScript for telemedicine, licensing for crypto exchanges, jurisdiction-specific certification for gambling. In each case the platform keeps the switch that turns an account off and hands the substantive judgement to an outside body. More than 10,000 websites now sit on one side of that arrangement.

For agencies and in-house teams handling health brands, the September release clarifies something the country-by-country policy notices tended to obscure. Certification is not a one-time hurdle cleared before launch. According to LegitScript, a certified business remains under monitoring that tracks its licences, its websites, its operations and any enforcement against it, which means a campaign's eligibility rests on a status that can change after the media plan is signed off. How often that status is re-tested, and how often it is withdrawn, remains undisclosed.

The channel split adds a second layer. The same prescription drug advertiser faces a certification requirement on Google Ads and none on Authorized Buyers; the same gambling operator has faced a similar split since August 10. Offline, the regulatory weight falls elsewhere. Prescription drug brands raised television spend 53% after the FDA crackdown on deceptive drug ads, in a market where broadcast is subject to FDA disclosure rules while digital pharmaceutical advertising runs through a patchwork of platform policies. Private certifiers make up a large part of that patchwork.

Then there is the question of who is counting. Every figure in the release is self-reported by the company that sells both the certification and the monitoring, and none comes with independent verification. The 10,000 figure has no date, no country split and no organisation count. The 140,000 figure has no time frame and no recipient list. Both are plausible, and consistent with the policy record PPC Land has documented since 2023. Neither answers the questions a buyer of health advertising would most want answered: how long does review take, how many applicants fail, and how many certified sites are later struck off?

Timeline

Summary

Who: LegitScript, a Portland, Oregon certification and monitoring company whose credential Google requires for pharmacy and telemedicine advertising in 11 markets and which serves as verification partner for addiction treatment advertising on Google, Meta and Microsoft. Scott Roth, chief executive, and Andy Bayley, director of risk and policy, were quoted. The figures bear on online pharmacies, telehealth providers, addiction treatment centres, the agencies buying media for them, and the platforms and payment firms that rely on the certification.

What: LegitScript said more than 10,000 websites have achieved its certification across healthcare, addiction treatment and other regulated industries, and that it has classified and reported on more than 140,000 internet pharmacy websites operating outside applicable global pharmacy regulations. It described a certification model that pairs an initial review against its Certification Standards with ongoing monitoring of licensure and credentials, online presence, business operations and regulatory activity. It disclosed no date for the milestone, no split by country or industry, no organisation count, no revocation data and no time frame for the pharmacy figure.

When: The release was distributed on September 16, 2026. It follows a sequence of Google policy changes running from France in October 2023 to Spain in August 2026.

Where: The release was issued from Portland, Oregon. The certification operates as an advertising prerequisite on Google in 11 markets and is recognised by other advertising platforms and card networks; the pharmacy classification work covers global jurisdictions.

Why: LegitScript tied the milestone to the growth of telehealth, online pharmacies and direct-to-consumer healthcare, and to regulatory, advertising and payment requirements that keep changing. For the advertising market, the figures show how much of health advertising eligibility now depends on a private certifier's continuing assessment, at a time when Google is loosening what certified advertisers may say, opening new surfaces and splitting requirements by buying channel.