Regulatory Oversight of Online Pharmacies: FDA and State Roles

When you order medication online, you expect it to be safe, effective, and legal. But not all online pharmacies are created equal. In fact, the FDA has issued over 147 warning letters to illegal online pharmacies in just the first nine months of 2025 - a 32% jump from 2024. Many of these sites sell fake pills, incorrect dosages, or drugs with toxic ingredients. Some don’t even require a prescription. So who’s actually watching over these operations? The answer isn’t simple: it’s a mix of federal agencies and state-level regulators working in parallel - and sometimes at cross-purposes.

The FDA’s Role: Protecting Drug Safety and Truth in Advertising

The Food and Drug Administration (FDA) doesn’t license pharmacies, but it does control what drugs can be sold, how they’re labeled, and whether their marketing is truthful. For online pharmacies, this means the FDA steps in when drugs are sold without approval, advertised with false claims, or shipped without proper warnings.

One of the biggest red flags the FDA watches for is unapproved drugs. Take GLP-1 medications like semaglutide and tirzepatide. After these drugs went into short supply in 2024, some online pharmacies began selling compounded versions - often without clear labeling or safety data. While 503A compounding pharmacies are allowed to make these drugs for individual patients with valid prescriptions, they’re not FDA-approved. That means the FDA can’t guarantee their safety before they’re sold. The burden falls on state boards to ensure these pharmacies follow good practices.

The FDA also cracks down on misleading ads. In 2024, enforcement dropped to just five Untitled Letters and zero Warning Letters - but that changed sharply in 2025. The agency has now turned its attention to social media. Paid influencers promoting weight-loss drugs with no mention of side effects? That’s a violation. Online pharmacies running ads that say “Get your prescription in 10 minutes - no doctor needed”? Also illegal. The FDA’s Office of Prescription Drug Promotion has ramped up digital monitoring, especially targeting Instagram, TikTok, and Facebook ads that omit risk information.

Consumers can check if a pharmacy is legitimate using the FDA’s BeSafeRx tool. This isn’t just a directory - it links directly to state pharmacy board databases. If a site doesn’t show up there, it’s not licensed. Legitimate pharmacies must also display a U.S. physical address, a working phone number, and have a licensed pharmacist on staff to answer questions. If they don’t? The FDA will issue a warning, and often, the DEA will follow up.

State Pharmacy Boards: The Frontline Regulators

While the FDA sets national standards for drugs and advertising, state boards of pharmacy are the ones who actually license and inspect pharmacies. Every pharmacy - online or brick-and-mortar - must be licensed by the state where it operates. Forty-eight out of fifty states offer public online databases where you can verify a pharmacy’s license. If a site claims to be licensed in California but isn’t listed in the California State Board of Pharmacy database, it’s a scam.

State boards handle complaints, investigate illegal sales, and can shut down operations within their borders. In 2024, they received 2,845 complaints about online pharmacies. California led with 312, followed by Texas (287) and Florida (245). These aren’t just numbers - they represent real patients who received pills that didn’t work, had dangerous side effects, or were completely fake.

But here’s the problem: a pharmacy based in Texas can sell to someone in New York. That means one state’s enforcement doesn’t stop a bad actor from operating across state lines. That’s why state boards rely on federal partners like the DEA and FDA to help track and shut down illegal websites that operate outside their jurisdiction.

Some states have gone further than federal rules. Twenty-seven states impose additional restrictions on telemedicine prescribing - like requiring video visits instead of chat-based consultations, or limiting the number of controlled substances a provider can prescribe remotely. This creates a patchwork of rules that even legitimate pharmacies struggle to follow.

The DEA: Controlling Controlled Substances Online

The Drug Enforcement Administration (DEA) has one job: prevent controlled substances - opioids, stimulants, sedatives - from falling into the wrong hands. Before 2025, the Ryan Haight Act required an in-person medical exam before a doctor could prescribe these drugs online. That rule was temporarily relaxed during the pandemic, but the DEA didn’t just bring it back - it rewrote it.

In January 2025, the DEA announced three new Special Registrations for telemedicine providers:

• Standard Registration: Allows prescribing of Schedule III-V drugs (like tramadol or certain sleep aids) without an in-person visit - but only if the provider checks the patient’s state Prescription Drug Monitoring Program (PDMP) record first.
• Advanced Telemedicine Prescribing Registration: Permits prescribing of Schedule II drugs (like oxycodone or Adderall) - but only for psychiatrists, hospice doctors, pediatricians, and long-term care physicians who are board-certified.
• Limited State Telemedicine Registrations: For providers who only prescribe within one state, under that state’s specific rules.

This isn’t a free pass. Providers must complete DEA-approved training, maintain detailed records, and use verified telehealth platforms. The DEA is also building a nationwide PDMP system to replace the current 50-state mess. By Q3 2026, pharmacists and doctors will be able to see a patient’s full controlled substance history - no matter which state they’re in.

Since 2025, the DEA has identified 1,243 websites selling controlled substances illegally. Over 68% of them are based outside the U.S., making them nearly impossible for state boards to reach. That’s why federal enforcement is critical.

How the System Works Together - and Where It Falls Apart

Legitimate online pharmacies must satisfy both federal and state rules. A pharmacy in Ohio must be licensed by Ohio’s board, follow FDA labeling rules, and comply with DEA prescribing rules if it handles controlled substances. It’s complicated - and expensive.

That’s why only 187 online pharmacies have earned the Verified Internet Pharmacy Practice Sites (VIPPS) seal from the National Association of Boards of Pharmacy. These sites pass rigorous audits on licensing, security, and pharmacist availability. They’re the only ones you should trust.

But enforcement gaps still exist. A pharmacy might be licensed in one state but sell to patients in another where it’s not registered. A telemedicine provider might use a loophole in federal rules to prescribe opioids without ever meeting the patient - and state boards won’t know until someone complains. The FDA can shut down a website selling fake insulin, but it can’t stop a doctor in a different state from writing the prescription.

And then there’s the cost. In August 2025, the FDA and DOJ fined QuickMedsOnline.com $500,000 for repeatedly violating the Ryan Haight Act. But that’s a drop in the ocean compared to the millions these illegal sites make each month.

What You Should Do - And What to Avoid

Here’s how to stay safe:

1. Use the BeSafeRx tool. Type in the pharmacy’s name or website. If it doesn’t show up in the state database, walk away.
2. Never buy without a prescription. If a site offers “instant prescriptions” or sells pills without one, it’s illegal.
3. Check the price. If it’s too good to be true - like $10 for a 30-day supply of Ozempic - it’s fake.
4. Look for a licensed pharmacist. Legitimate sites have a phone number you can call to ask questions. If they don’t, they’re hiding something.
5. Stick to known brands. CVS Caremark Online, Walgreens, and Kaiser Permanente’s pharmacy services have 4.6/5 ratings on Trustpilot. Unverified sites average 1.8/5.

On Reddit and health forums, users report receiving pills that didn’t work, caused rashes, or made them dizzy. One person in a September 2025 thread said they took what they thought was metformin - but it turned out to be a cheap Chinese counterfeit with no active ingredient. Their blood sugar spiked. They ended up in the ER.

The Future: More Integration, More Enforcement

By the end of 2026, the DEA’s nationwide PDMP will go live. That’s a game-changer. Doctors and pharmacists will finally see a full picture of a patient’s controlled substance history - no matter where they live. The FDA also plans to expand BeSafeRx to verify telemedicine prescriptions in real time, not just the pharmacy’s license.

Expect more crackdowns on social media ads. More fines. More shutdowns. The days of shady online pharmacies slipping through the cracks are ending - but only if patients stay vigilant.

Regulation isn’t perfect. But when federal agencies and state boards work together - and when you know how to spot the red flags - you can get your medication safely, legally, and without risking your health.