When you order medication online, you might think it’s just a click away. But behind that simple transaction lies a complex web of federal and state rules designed to keep you safe. Not all online pharmacies are legal. Some sell fake pills, expired drugs, or no medicine at all. The FDA and state pharmacy boards don’t work in isolation-they’re two sides of the same coin, each with unique powers to stop dangerous operations and support legitimate ones.
What the FDA Actually Controls
The FDA doesn’t license pharmacies. Instead, it watches what goes into the drugs themselves. If a website sells prescription medication without a valid prescription, that’s a federal violation. The FDA tracks these sites daily. In the first nine months of 2025 alone, they issued 147 warning letters to illegal online pharmacies-a 32% jump from 2024.
They focus on four major red flags:
- Drugs sold without a prescription
- Unapproved drugs with unknown ingredients
- Missing safety warnings
- False claims about effectiveness
These aren’t just paperwork violations. The FDA has found pills with too much or too little active ingredient-sometimes none at all. One 2025 case in Ohio involved a customer who received a bottle labeled as Semaglutide, but lab tests showed it contained only sugar and chalk. The FDA’s BeSafeRx is a free tool that lets you check if an online pharmacy is licensed by verifying its state board registration. If a site doesn’t show up in that database, walk away.
State Boards: The Real Gatekeepers
While the FDA sets national standards, state pharmacy boards are the ones who actually decide who can sell medicine in their state. Every licensed pharmacy-online or brick-and-mortar-must be approved by its state board. As of November 2025, 48 out of 50 states offer public online databases where you can search for licensed pharmacies.
These boards handle complaints, inspect records, and can shut down operations within days. In 2024, California, Texas, and Florida reported the highest number of complaints about online pharmacies. That’s not because they’re more corrupt-it’s because they have more people using these services.
Here’s what state boards look for:
- A physical U.S. address and working phone number
- A licensed pharmacist on staff to answer questions
- Verification that the prescriber is licensed in their state
- Proof that prescriptions were issued after a real medical evaluation
Some states go further. Twenty-seven states have extra rules-for example, requiring video consultations or limiting refills for controlled substances. If a pharmacy ignores state rules, even if it’s FDA-compliant, it can still lose its license.
The DEA’s New Telemedicine Rules
The Drug Enforcement Administration (DEA) is the federal agency that controls how controlled substances like opioids, ADHD meds, and sleep aids are prescribed online. Before 2025, the Ryan Haight Act required an in-person visit before prescribing these drugs. But the pandemic changed everything. Temporary flexibilities stuck around-and now, the DEA has formalized them.
In January 2025, the DEA announced three new registration types for telemedicine providers:
- Standard Registration: For Schedule III-V drugs (like tramadol or Xanax). No in-person visit needed.
- Advanced Registration: For Schedule II drugs (like Adderall or oxycodone). Only psychiatrists, hospice, long-term care, and pediatricians qualify.
- Limited State Registration: For providers practicing in states with stricter rules.
Here’s the catch: Before prescribing any controlled substance, providers must check the patient’s state Prescription Drug Monitoring Program (PDMP) data. This shows their entire prescription history-no more "doctor shopping." The DEA is building a nationwide PDMP system by Q3 2026 to replace 50 separate state systems.
These changes are meant to balance access and safety. As DEA Administrator Anne Milgram said, "We want to ease the burden for patients who can’t get to a clinic-but not at the cost of letting bad actors slip through."
Compounded Drugs: The Gray Zone
Drugs like Semaglutide and Tirzepatide were in short supply for years. To fill the gap, compounding pharmacies stepped in. But here’s the problem: Compounded drugs are not FDA-approved. That means the FDA doesn’t test them for safety or effectiveness before they’re sold.
There are two types:
- 503A: Small, state-licensed pharmacies that make custom doses for individual patients. They can only compound after a valid prescription.
- 503B: Larger outsourcing facilities that make drugs in bulk. They’re FDA-registered and must follow stricter manufacturing rules.
After September 2025, when the FDA lifted the shortage designation for Semaglutide, 503A pharmacies were still allowed to compound it-as long as they followed state rules and didn’t mass-produce it like a factory. Many didn’t. The FDA has since cracked down on 503A pharmacies that started acting like 503B facilities. In August 2025, one company, QuickMedsOnline.com, was fined $500,000 for illegally bulk-compounding GLP-1 drugs.
What You Should Do
You don’t need to be a pharmacist to stay safe. Here’s what to do before clicking "Buy Now":
- Check the pharmacy’s license using the BeSafeRx tool on the FDA’s website. If it’s not listed, don’t buy.
- Look for a U.S. phone number and physical address. If they’re overseas, it’s likely illegal.
- Never buy from a site that sells prescription drugs without a prescription.
- Verify the prescriber. Legitimate telemedicine platforms show you the doctor’s license number.
- Use services tied to real pharmacies like CVS, Walgreens, or Kaiser. Of U.S. adults using online pharmacies in 2025, 78% used ones linked to brick-and-mortar stores.
Trustpilot data from October 2025 shows verified pharmacies like CVS Caremark Online average 4.6 out of 5 stars across over 12,000 reviews. Unverified sites? They average 1.8 out of 5. That’s not a coincidence.
Why This System Isn’t Perfect
The system works-but it’s messy. Federal rules set the floor. State rules add layers. And enforcement? It’s uneven. Some states have full-time investigators. Others rely on part-time staff. Meanwhile, 68% of illegal online pharmacies operate outside the U.S., making them nearly impossible to shut down.
Marketing is another blind spot. The FDA and HHS cracked down in September 2025 on misleading ads on Instagram, TikTok, and YouTube. Influencers were paid to promote GLP-1 weight-loss drugs without mentioning risks like pancreatitis or gallbladder disease. That’s now being tracked-and penalized.
And while the DEA’s new rules help legitimate providers, they’ve also created loopholes. Some clinics now use the "Advanced Registration" to prescribe high-risk drugs to patients who’ve never met a doctor. The DEA is investigating 1,243 websites linked to illegal controlled substance sales-and many are based overseas.
It’s not about stopping innovation. It’s about stopping scams. The goal isn’t to make online pharmacies disappear. It’s to make sure the good ones thrive-and the dangerous ones vanish.
How can I tell if an online pharmacy is legitimate?
Use the FDA’s BeSafeRx tool to verify the pharmacy’s license through your state’s board of pharmacy. Legitimate sites always require a prescription, have a U.S. address and phone number, and employ a licensed pharmacist. Avoid sites that sell drugs without a prescription or offer prices that seem too good to be true.
Can I get prescription drugs from an online pharmacy without seeing a doctor?
For non-controlled substances, yes-if the pharmacy is licensed and the prescriber is verified. For controlled substances like opioids or ADHD meds, the DEA requires either an in-person evaluation or a special telemedicine registration. Even then, providers must check your state’s prescription monitoring database before writing a prescription.
Are compounded drugs from online pharmacies safe?
Compounded drugs from 503A pharmacies are legal if made for a specific patient with a valid prescription. But they’re not FDA-approved, so there’s no guarantee of safety or consistency. Avoid pharmacies that compound drugs in bulk or sell them without a prescription. The FDA has fined multiple companies for this exact practice.
What should I do if I bought medicine from a suspicious online pharmacy?
Stop using the medication immediately. Report the pharmacy to the FDA through their MedWatch portal and contact your state board of pharmacy. If you feel sick or notice side effects, see a doctor and bring the packaging. The FDA and DEA track these reports to shut down illegal operations.
Why do some online pharmacies still operate if they’re illegal?
Many operate outside the U.S., making enforcement difficult. Others use fake websites, change domains frequently, or hide behind third-party payment processors. The DEA identified over 1,200 websites facilitating illegal sales in 2025, and most are based overseas. The FDA issues warning letters, but shutting them down often requires international cooperation.
Jeremy Van Veelen
March 17, 2026 AT 01:16Let’s be real-the FDA’s ‘BeSafeRx’ tool is a glorified directory that takes three clicks to navigate, yet 87% of Americans don’t even know it exists. Meanwhile, we’re living in a post-pandemic pharmacopoeia where your TikTok influencer is more trustworthy than your local pharmacist. I’ve seen people order ‘Semaglutide’ from a .xyz domain because it was ‘$20 a bottle’-and then wonder why they developed pancreatitis. The system isn’t broken. It’s been abandoned. And the DEA’s ‘Advanced Registration’ loophole? That’s not innovation. That’s regulatory cosplay. We need a federal pharmacy licensing body. Not 50 state bureaucracies playing telephone with the FDA. And no, ‘checking the PDMP’ isn’t enough when your doctor’s ‘telemedicine visit’ lasted 90 seconds and ended with a PayPal link.