Regulatory Oversight of Online Pharmacies: How FDA and State Boards Protect You

When you order medication online, you’re trusting a website with your health. But not all online pharmacies are legitimate. Some sell fake pills, expired drugs, or no medicine at all. In 2025, the FDA issued 147 warning letters to illegal online pharmacies - a 32% jump from 2024. So who’s actually watching these sites? The answer isn’t just one agency. It’s a system: the FDA at the federal level, and 50 different state boards of pharmacy working together - sometimes in sync, sometimes at odds.

What the FDA Actually Does

The FDA doesn’t license online pharmacies. That’s a common mistake. Instead, it watches what’s being sold. If a website sells unapproved drugs - like counterfeit versions of Ozempic or Mounjaro - the FDA steps in. Their main job is safety: making sure drugs are what they say they are, contain the right dose, and come with proper warnings.

They also crack down on false advertising. In 2025, the FDA and HHS announced new rules targeting direct-to-consumer ads on social media. Influencers promoting GLP-1 weight-loss drugs without mentioning side effects like nausea or pancreatitis? That’s now a target. The FDA’s Office of Prescription Drug Promotion issued zero warning letters in 2024 - but that’s not because things got better. It’s because they shifted focus. Now they’re going after digital ads, not just print.

The BeSafeRx tool on the FDA’s website lets you check if a pharmacy is real. Type in the site’s name, and it tells you if the pharmacy is licensed by a state board. If it’s not listed? Don’t buy from it. In Q3 2025, over 1.2 million people used BeSafeRx - up 40% from the year before. People are learning to check before they click.

State Boards: The Real Gatekeepers

Here’s the truth: the FDA can’t shut down a website without help from the states. That’s because state pharmacy boards issue the actual licenses. Every legitimate online pharmacy must be licensed in the state where it operates. Forty-eight out of fifty states have public databases where you can search for licensed pharmacies. California, Texas, and Florida reported the most complaints in 2024 - not because they have more bad pharmacies, but because they have more people using them.

State boards also handle complaints. If you get a pill that looks wrong, or your prescription never arrives, you report it to your state board. They can fine the pharmacy, suspend its license, or even refer the case to the DEA for criminal charges. In August 2025, QuickMedsOnline.com was hit with a $500,000 penalty for repeatedly selling prescriptions without valid doctor orders.

But here’s the problem: rules vary by state. Twenty-seven states have extra rules on top of federal law. Some require in-person exams before telemedicine prescriptions. Others limit how many controlled substances a provider can prescribe remotely. That’s why a pharmacy licensed in Florida might be illegal in New York - even if both are FDA-compliant.

DEA Rules: Controlled Substances and Telemedicine

If you’re ordering opioids, stimulants, or sedatives online, the DEA is involved. Before 2025, the Ryan Haight Act required an in-person visit before any controlled substance could be prescribed remotely. That rule was relaxed during COVID, and then made permanent - but only for certain providers.

In January 2025, the DEA rolled out three new Special Registrations:

• Standard Registration: Lets providers prescribe Schedule III-V drugs (like Xanax or tramadol) via telemedicine - no in-person visit needed, but they must check the state’s Prescription Drug Monitoring Program (PDMP) first.
• Advanced Registration: Only for psychiatrists, hospice doctors, pediatricians, and long-term care providers. Allows them to prescribe Schedule II drugs (like Adderall or oxycodone) remotely - if they meet strict training and patient review rules.
• Limited State Registration: For providers in states that still require in-person visits. Lets them operate under state rules while still being DEA-registered.

These changes mean more patients can get needed medications without driving hours to a clinic. But they also mean more oversight. The DEA is building a nationwide PDMP - something that didn’t exist before. Right now, providers have to check 50 different state systems. By 2026, they’ll have one central database.

Compounding Pharmacies: The Gray Zone

When drugs like semaglutide and tirzepatide were in short supply in 2024, compounding pharmacies stepped in. These are pharmacies that mix custom doses - not mass-produced pills. The FDA doesn’t approve these drugs before they’re sold. That’s the key point: compounded drugs aren’t FDA-reviewed.

Only 503A pharmacies - the kind that make drugs for individual patients with a valid prescription - can legally compound these medications. 503B pharmacies, which make bulk batches for clinics, can’t touch them unless they’re on the FDA’s shortage list. And as of September 2025, those drugs were removed from the list - meaning 503B pharmacies can no longer make them at scale.

That left the market to 503A pharmacies. But because they’re regulated by states, not the FDA, oversight is patchy. One state might require strict quality controls. Another might not. That’s why the FDA warns: if a website offers “custom” versions of brand-name drugs at half the price, it’s likely not following the rules.

What to Look For - And What to Avoid

Here’s how to tell if an online pharmacy is safe:

• It requires a valid prescription - no exceptions.
• It has a U.S. physical address and phone number you can call.
• A licensed pharmacist is available to answer questions.
• It’s listed on the FDA’s BeSafeRx site or has VIPPS accreditation (from the National Association of Boards of Pharmacy).
• It doesn’t offer “miracle cures” or “no-exam” prescriptions for controlled substances.

Red flags:

• Prices way lower than CVS or Walgreens - if it’s too good to be true, it is.
• No contact info, or only a PO box.
• Offers to sell drugs without a prescription.
• Sells drugs not approved in the U.S. - like versions of insulin from Mexico or India.
• Asks for payment only in cryptocurrency or wire transfer.

Real users report bad experiences: pills that don’t work, side effects no one warned them about, or no medicine at all. On Reddit’s r/Telehealth, users in September 2025 shared 87 stories of receiving counterfeit meds. Meanwhile, verified pharmacies like CVS Caremark Online have a 4.6/5 rating from over 12,000 reviews.

The Bigger Picture: Why This System Exists

There’s no perfect system. The FDA can’t police every website. State boards are underfunded and overwhelmed. The DEA’s new rules help, but they’re complex. And patients? They just want affordable, fast access to their meds.

The goal isn’t to stop online pharmacies. It’s to stop the bad ones. In 2025, 37% of U.S. adults used an online pharmacy - up from 22% in 2020. But 78% of those users stuck with pharmacies tied to brick-and-mortar chains like CVS, Walgreens, or Kroger. Those are the ones with the strongest compliance records.

The future? A more connected system. The nationwide PDMP will help. Real-time verification of telemedicine scripts by the end of 2026 will help. And more enforcement - especially on social media - will make it harder for bad actors to hide.

But your best protection? Stay informed. Check the pharmacy. Don’t skip the prescription. And if something feels off - report it. Your state board is waiting to hear from you.