Regulatory Oversight of Online Pharmacies: FDA and State Roles Explained

Buying medicine online sounds simple-click, pay, delivery. But behind that convenience is a complex web of rules meant to keep you safe. In 2025, more than 37% of U.S. adults used online pharmacies, up from just 22% in 2020. That’s a huge jump. And with it came a surge in dangerous, fake websites selling pills that don’t work, contain poison, or have no active ingredient at all. The FDA and state pharmacy boards are the two main forces trying to stop this. But how do they actually work together? And what should you look for to avoid getting hurt?

What the FDA Actually Does

The FDA doesn’t license pharmacies. That’s not their job. Instead, they watch the drugs themselves-making sure what’s sold online is real, safe, and properly labeled. If a website sells unapproved versions of drugs like Semaglutide or Tirzepatide, or markets them without warning about serious side effects, the FDA steps in. In the first nine months of 2025 alone, they issued 147 warning letters to illegal online pharmacies, a 32% increase from 2024.

They also crack down on false advertising. In 2024, enforcement dropped to just five Untitled Letters and zero Warning Letters-far below the 50+ letters issued in 2010. But in 2025, that changed. The FDA and HHS announced new rules targeting direct-to-consumer ads on social media. Paid influencers pushing weight-loss drugs without mentioning risks? That’s now a red flag. The FDA’s Office of Prescription Drug Promotion is actively scanning Instagram, TikTok, and YouTube for ads that skip the required safety info.

For consumers, the FDA’s BeSafeRx tool is your first line of defense. It doesn’t list every pharmacy, but it tells you how to check if a pharmacy is licensed. You enter the pharmacy’s name or address, and it guides you to your state’s official pharmacy board database. If the pharmacy isn’t listed there? Walk away. The FDA also warns: if prices seem too good to be true, they probably are. Fake pharmacies often lure people in with discounts, then steal credit card info or send nothing at all.

State Pharmacy Boards: The Real Gatekeepers

While the FDA watches the drugs, state boards watch the people. Every legitimate online pharmacy must be licensed by the state where it’s physically located. That means if a pharmacy is based in California, it answers to the California State Board of Pharmacy-not just the FDA. These boards handle licensing, inspections, and complaints. In 2024, state boards received 2,845 complaints about online pharmacies. California, Texas, and Florida led the list.

Forty-eight out of fifty states have public online databases where you can verify a pharmacy’s license. Alabama and Massachusetts are the exceptions-they don’t offer full public access. But if a pharmacy claims to be licensed in a state that doesn’t even let you check? That’s a huge red flag.

State boards also enforce rules about who can dispense prescriptions. For example, pharmacists must verify the patient’s identity before filling a controlled substance from a telemedicine visit. They must also confirm the prescriber is licensed and that the prescription is valid. If a pharmacy fills a prescription from a doctor who never met the patient? That’s a violation-and state boards can shut them down.

And they’re not passive. In August 2025, the FDA and state regulators jointly fined QuickMedsOnline.com $500,000 for repeatedly violating the Ryan Haight Act by dispensing controlled substances without valid prescriptions. That case wasn’t just a federal action-it was a state-led investigation that triggered the federal penalty.

The DEA’s New Rules: Telemedicine Gets a Framework

Before 2025, the Ryan Haight Act required doctors to see patients in person before prescribing controlled substances. That rule was loosened during the pandemic, and now it’s being rewritten. In January 2025, the DEA announced three new Special Registrations for telemedicine providers.

Here’s what changed:

• Standard Registration: Allows prescribing Schedule III-V drugs (like Xanax, Adderall, or certain pain meds) via telemedicine-no in-person visit needed.
• Advanced Telemedicine Prescribing Registration: Only for psychiatrists, hospice, long-term care, and pediatricians. Permits prescribing Schedule II drugs (like oxycodone) via telemedicine, but only if they’re board-certified in their specialty.
• Limited State Telemedicine Registrations: For providers practicing in states that allow it, with extra state-level restrictions.

There’s a catch: before prescribing any controlled substance under these rules, the provider must check the patient’s Prescription Drug Monitoring Program (PDMP) data. Right now, each state has its own PDMP. By Q3 2026, the DEA plans to launch a nationwide PDMP so doctors can see a patient’s full prescription history across state lines.

This is a big deal. Before, a doctor in New York might not know a patient was getting opioids from a pharmacy in Florida. Now, they’ll have to see it all. The goal? Stop “doctor shopping” and prevent drug diversion.

Compounding Pharmacies: The Gray Zone

When brand-name drugs like Semaglutide were in short supply, compounding pharmacies stepped in. These are labs that mix custom doses of medications. They’re not FDA-approved, meaning the FDA doesn’t test their safety or effectiveness before they’re sold.

There are two types:

• 503A: State-licensed, can only compound based on individual patient prescriptions. These are the only ones allowed to make GLP-1 drugs like Semaglutide as of September 2025.
• 503B: Registered with the FDA as outsourcing facilities. They can make larger batches and sell to clinics, but they’re held to stricter FDA standards.

The problem? Some 503A pharmacies started acting like manufacturers-making bulk supplies, advertising online, and selling without individual prescriptions. That’s illegal. The FDA and state boards have been cracking down. In 2025, several 503A pharmacies were shut down for selling compounded GLP-1 drugs without valid prescriptions.

Bottom line: if you’re buying compounded drugs online, make sure the pharmacy is licensed in your state and requires a prescription from your doctor. If they’re selling it like a product on a website? Run.

How to Spot a Legit Online Pharmacy

You don’t need to be an expert to avoid dangerous sites. Here’s what to check:

1. Requires a prescription: Legit pharmacies never sell controlled substances without one. If they offer “no prescription needed,” it’s illegal.
2. Has a U.S. address and phone number: Check the website. If it only lists a PO box or a foreign number, walk away.
3. Has a licensed pharmacist on staff: They should be able to answer your questions about side effects or interactions.
4. Is licensed by your state’s board: Use the FDA’s BeSafeRx tool to find the link to your state’s pharmacy license database. Search the pharmacy’s name. If it’s not there, it’s not legal.
5. Has VIPPS accreditation: The National Association of Boards of Pharmacy (NABP) runs the Verified Internet Pharmacy Practice Sites (VIPPS) program. As of October 2025, only 187 online pharmacies had this seal. It’s a trusted mark.

And don’t trust reviews on random sites. Fake pharmacies often buy 5-star reviews. Check Trustpilot or Google reviews-but look at the details. Legit pharmacies like CVS Caremark Online have 4.6 out of 5 stars from over 12,000 reviews. Unverified sites average 1.8 stars from fewer than 5,000 reviews.

What Happens When Rules Are Broken?

The consequences aren’t theoretical. People have ended up in the hospital after taking fake medications. One Reddit thread from September 2025 had 87 comments from people who took “weight-loss pills” from an unverified site. Many reported heart palpitations, dizziness, or no effect at all. One user said their pill had “no active ingredient.” Another said they got a completely different drug.

Regulators are responding. The DEA has identified 1,243 websites selling illegal controlled substances as of October 2025. Sixty-eight percent of them operate outside the U.S., making them nearly impossible to shut down. But the FDA and DEA are working with international partners to block payments and take down domains.

Pharmacies that break the rules face fines, license revocation, and criminal charges. The $500,000 penalty against QuickMedsOnline.com wasn’t a slap on the wrist-it was a message. This isn’t just about money. It’s about lives.

What’s Next for Online Pharmacy Regulation?

The system is still evolving. By December 2026, the FDA plans to expand BeSafeRx to include real-time verification of telemedicine prescriptions. That means when a doctor sends an e-prescription, the system will instantly check if the prescriber is registered, the patient has been evaluated, and the pharmacy is licensed-all before the pill is dispensed.

Industry analysts predict a 22% increase in FDA warning letters in 2026, especially targeting social media ads and compounded drugs. The DEA’s nationwide PDMP will make it harder for patients to doctor-shop across state lines. And state boards are pushing for more uniform rules-right now, 27 states have extra restrictions beyond federal law, creating confusion for both pharmacies and patients.

One thing is clear: the old model of fragmented oversight is breaking down. The future is integration-federal and state agencies sharing data, aligning rules, and acting as one front against illegal pharmacies.

For you? That means more protection. But it also means you need to be smarter. Don’t assume a website is safe because it looks professional. Don’t trust a discount. Always verify. Your health isn’t a gamble.