Regulatory Oversight of Online Pharmacies: FDA and State Roles Explained

When you order medication online, you might think it’s just a click away-fast, cheap, and convenient. But behind that simple transaction lies a complex web of federal and state rules designed to keep you safe. Not all online pharmacies are created equal. Some are licensed, legal, and trustworthy. Others are dangerous operations selling fake, contaminated, or mislabeled drugs. The FDA and state pharmacy boards are the two main forces trying to separate the good from the bad. Here’s how they do it-and what you need to know to protect yourself.

What the FDA Actually Does

The Food and Drug Administration doesn’t license online pharmacies. That’s not its job. Instead, the FDA watches what’s being sold. If a website is selling prescription drugs without a valid prescription, that’s a red flag. If it’s pushing unapproved versions of popular drugs like Semaglutide or Tirzepatide-especially those made in overseas labs-that’s a violation. The FDA has issued 147 warning letters to illegal online pharmacies in just the first nine months of 2025. That’s a 32% jump from 2024.

The agency also cracks down on misleading ads. In 2024, there were only five Untitled Letters and zero Warning Letters about prescription drug advertising. By 2025, that number exploded. The FDA’s Office of Prescription Drug Promotion is now actively monitoring social media influencers who promote weight-loss drugs without disclosing side effects. A single post saying “Lose 20 pounds in 3 weeks with this pill!” without mentioning nausea, pancreatitis, or gallbladder risks? That’s now a target.

One of the FDA’s most useful tools is BeSafeRx. This free website lets you type in a pharmacy’s name and instantly check if it’s licensed. Legitimate online pharmacies must:

• Require a valid prescription from a U.S. licensed provider
• Have a U.S. physical address and phone number
• Employ a licensed pharmacist to answer your questions
• Be licensed by a state board of pharmacy

If any of these are missing, walk away. The FDA’s BeSafeRx site had 1.2 million visits in Q3 2025-proof that people are starting to check before they buy.

State Boards of Pharmacy: The Real Enforcers

While the FDA sets national standards, state pharmacy boards do the heavy lifting. Every state has its own board that licenses pharmacies operating within its borders. This means a pharmacy in California must follow California rules, and one in Texas must follow Texas rules. There are 50 different sets of rules. Some states require extra training for telemedicine prescribers. Others ban online pharmacies from shipping controlled substances entirely.

As of November 2025, 48 out of 50 states offer public online databases where you can verify a pharmacy’s license. California, Texas, and Florida reported the most complaints about illegal online pharmacies in 2024-312, 287, and 245 respectively. These aren’t random numbers. They’re reports from real people who received pills that didn’t work-or worse, made them sick.

State boards also investigate complaints. One pharmacy in Florida was fined $500,000 in August 2025 for repeatedly violating the Ryan Haight Act by filling prescriptions without verifying the patient’s identity. Another in Ohio had its license revoked after customers reported receiving pills with the wrong active ingredient. These aren’t rare cases. The National Community Pharmacists Association documented dozens of similar incidents in its August 2025 safety bulletin.

And here’s the catch: a pharmacy can be licensed in one state but sell to customers in 49 others. That’s where federal oversight kicks in. The FDA can shut down websites that operate across state lines without proper licensing. But if the pharmacy is based overseas? That’s harder to stop.

The DEA’s New Telemedicine Rules

The Drug Enforcement Administration (DEA) controls which doctors can prescribe controlled substances like opioids, stimulants, and sedatives via telemedicine. Before 2025, the Ryan Haight Act of 2008 required an in-person visit before prescribing any controlled drug. That rule stayed in place for years-even during the pandemic.

But in January 2025, the DEA changed course. It introduced three new types of Special Registrations for telemedicine providers:

• Standard Registration: Allows prescribing of Schedule III-V drugs (like Xanax, Adderall, or certain painkillers) without an in-person visit-but only if the provider checks the patient’s state Prescription Drug Monitoring Program (PDMP) data first.
• Advanced Telemedicine Prescribing Registration: For psychiatrists, hospice doctors, pediatricians, and long-term care physicians who can now prescribe Schedule II drugs (like oxycodone) remotely. They need board certification and extra training.
• Limited State Telemedicine Registrations: For providers who only treat patients in states that allow it. This helps bridge gaps where state laws conflict with federal rules.

This shift is huge. It means patients with chronic pain, ADHD, or mental health conditions can now get care without leaving home. But it also creates new risks. The DEA says 68% of websites selling illegal controlled substances operate outside the U.S. That means even with better rules, bad actors are still slipping through.

By Q3 2026, the DEA plans to launch a nationwide PDMP system. Right now, doctors have to check 50 different state databases. A single system will make it easier to spot patients who are “doctor shopping”-getting the same drug from multiple providers.

Compounded Drugs: The Gray Zone

When Semaglutide and Tirzepatide became hard to find due to high demand, compounding pharmacies stepped in. These are labs that mix custom doses of drugs. They’re not FDA-approved. That means the FDA doesn’t test their safety or effectiveness before they hit the market.

Only pharmacies registered under Section 503A of the Food, Drug, and Cosmetic Act can legally compound drugs like these. They must have a valid patient-specific prescription and follow strict hygiene standards. But many unlicensed labs started making and selling these drugs online, claiming they were “identical” to the brand-name versions. Some contained too much active ingredient. Others had none at all.

The FDA’s September 2025 update clarified that 503A pharmacies are the only ones allowed to compound these drugs-but only if they meet all state and federal requirements. That’s left a lot of confusion. Patients don’t know if their pharmacy is 503A-registered. And state boards are struggling to track them all.

What You Should Do

You don’t need to be a pharmacist to stay safe. Just follow three simple rules:

1. Use BeSafeRx. Go to the FDA’s BeSafeRx website. Type in the pharmacy’s name. If it doesn’t show up, don’t buy.
2. Check for a U.S. address and phone number. If the website only has a PO box or a foreign number, it’s not legitimate.
3. Ask if a pharmacist is on staff. Legit pharmacies let you call or chat with a licensed pharmacist. If they can’t connect you, walk away.

Also, be wary of deals that seem too good to be true. A 70% discount on Ozempic? That’s a red flag. The real drug costs hundreds. If it’s $30, it’s fake.

And always verify your prescription. If a website asks you to fill out a quick online form and then ships you pills without talking to a doctor, that’s illegal. Real telemedicine requires a video call with a licensed provider who reviews your history.

Why This Matters

Over 37% of U.S. adults used online pharmacies in 2025-up from 22% in 2020. That’s 95 million people. Most of them used services tied to big pharmacies like CVS or Walgreens. Those sites have strong compliance. But 1 in 5 people used unverified sites. And that’s where the danger lives.

People have reported getting pills with no active ingredient, too much of a drug, or even rat poison. One Reddit thread in September 2025 had 87 comments from users who took online meds and had unexpected side effects-headaches, rashes, heart palpitations. Some ended up in the ER.

The system isn’t perfect. State and federal agencies don’t always talk to each other. Some online pharmacies slip through cracks. But the tools to protect yourself are here. The FDA, DEA, and state boards are working harder than ever. And now, you know how to use their tools.