Regulatory Oversight of Online Pharmacies: FDA and State Roles Explained

Buying medicine online sounds convenient-until you get a pill that doesn’t work, or worse, makes you sick. In 2025, online pharmacies are used by 37% of U.S. adults, up from just 22% in 2020. But not all of them are safe. Some sell fake drugs with the wrong ingredients. Others don’t require a prescription. And many operate from overseas, making them nearly impossible to track. So who’s actually watching over them? The answer isn’t simple. It’s a patchwork of federal agencies and 50 different state systems, all trying to keep up with a digital marketplace that moves faster than the law can write rules.

The FDA’s Role: Safety, Labels, and Scams

The Food and Drug Administration (FDA) doesn’t license pharmacies. But it does control what drugs can be sold, how they’re labeled, and whether their advertising is truthful. When it comes to online pharmacies, the FDA acts like a watchdog for dangerous products. If a website sells unapproved versions of popular drugs like Semaglutide or Tirzepatide-especially ones made in unregulated labs-the FDA steps in. In the first nine months of 2025 alone, the FDA sent out 147 warning letters to illegal online pharmacies, up 32% from the same period in 2024.

The agency also runs BeSafeRx, a free tool that helps people check if a pharmacy is legitimate. A real online pharmacy must: require a valid prescription, have a U.S. physical address and phone number, employ a licensed pharmacist, and be licensed by a state board of pharmacy. If a site doesn’t meet all four, the FDA flags it as risky. The BeSafeRx website got 1.2 million visits in Q3 2025, showing how many people are trying to avoid scams.

But the FDA can’t shut down every fake site. Many operate from outside the U.S., and even if they’re blocked, they pop up again under new names. That’s why the FDA focuses on education-telling people how to spot red flags. If a price seems too good to be true, if there’s no way to talk to a pharmacist, or if the site asks for payment via wire transfer-it’s probably not safe.

State Pharmacy Boards: The Frontline Enforcers

While the FDA handles drug safety, state boards of pharmacy handle the people selling them. Each state licenses its own pharmacies, including online ones that serve residents within its borders. These boards check credentials, inspect records, and investigate complaints. In 2024, state boards received 2,845 complaints about online pharmacies. California, Texas, and Florida led the list, with over 200 complaints each.

Forty-eight out of 50 states offer public online databases where you can verify if a pharmacy is licensed. You can search by name, address, or license number. If a site claims to be licensed in Florida but doesn’t show up in Florida’s database, it’s fake. The FDA recommends using these state tools before ordering anything.

But here’s the problem: a pharmacy in Ohio can ship drugs to someone in Georgia. Who’s responsible then? The Ohio board licenses the pharmacy. The Georgia board can’t touch it unless the pharmacy has a physical presence there. This gap lets some bad actors slip through. That’s why the DEA and FDA are pushing for more coordination-but right now, enforcement is still mostly state-by-state.

The DEA and the Telemedicine Revolution

Before 2025, the Ryan Haight Act made it illegal to prescribe controlled substances like oxycodone or Adderall through telemedicine without an in-person visit. That rule was meant to stop pill mills. But during the pandemic, temporary rules allowed remote prescriptions to keep people from risking exposure.

In January 2025, the DEA made those temporary rules permanent-but with new limits. They introduced three types of Special Registrations for telemedicine providers:

• Standard Registration: For Schedule III-V drugs (like tramadol or Xanax), no in-person visit needed, but prescribers must check the patient’s state PDMP (Prescription Drug Monitoring Program) before prescribing.
• Advanced Registration: For Schedule II drugs (like oxycodone or fentanyl), only psychiatrists, hospice doctors, pediatricians, and long-term care providers can apply-and they need board certification.
• Limited State Registration: For providers who only treat patients within one state, under that state’s rules.

These changes mean telemedicine is now legal for controlled substances-but only if the provider is registered, the patient’s history is checked, and the prescription is for a legitimate medical need. The DEA is also building a nationwide PDMP system to replace the current mess of 50 separate state databases. By Q3 2026, pharmacists and doctors will be able to see a patient’s full prescription history no matter where they live.

Compounded Drugs: The Gray Zone

When brand-name drugs like Ozempic or Mounjaro were in short supply, compounding pharmacies stepped in. These are labs that mix custom doses of drugs based on a doctor’s prescription. They’re not FDA-approved, meaning the agency doesn’t test their safety before they’re sold. That’s a big risk.

Only 503A compounding pharmacies are allowed to make these drugs for individual patients. 503B facilities, which make larger batches for hospitals, can’t sell directly to consumers. In September 2025, the FDA lifted the shortage designation for Semaglutide and Tirzepatide-but compounding pharmacies kept selling them anyway, claiming they were still needed.

State boards are now cracking down on 503A pharmacies that act like manufacturers. If a pharmacy is compounding large volumes of the same drug without a specific patient order, it’s breaking the law. The FDA has started warning letters targeting these operations, especially those advertising weight-loss drugs on social media.

What You Can Do: Protect Yourself

Here’s how to avoid dangerous online pharmacies:

1. Only use pharmacies listed on the FDA’s BeSafeRx website.
2. Verify the pharmacy’s license on your state’s board of pharmacy website.
3. Never buy from a site that doesn’t require a prescription.
4. Check if you can talk to a real pharmacist-call them. If they don’t answer, walk away.
5. Look for the VIPPS seal from the National Association of Boards of Pharmacy. As of October 2025, only 187 online pharmacies had it.
6. Avoid sites that offer “discounts” on brand-name drugs like Ozempic. Legit pharmacies don’t undercut manufacturers that much.

Real online pharmacies, like CVS Caremark Online, have ratings above 4.5 on Trustpilot. Fake ones? They hover around 1.8. One Reddit user in September 2025 reported getting pills that looked nothing like the real medication-and ended up in the ER with an allergic reaction. That’s not rare.

The Future: More Rules, More Integration

The system is still broken, but it’s getting better. The DEA’s nationwide PDMP will help doctors see if a patient is getting opioids from five different clinics. The FDA is expanding BeSafeRx to verify telemedicine prescriptions in real time by December 2026. Social media ads for prescription drugs are now under heavy scrutiny-paid influencers promoting weight-loss meds without listing side effects are getting fined.

Enforcement is ramping up. In August 2025, QuickMedsOnline.com was hit with a $500,000 penalty for repeatedly ignoring the Ryan Haight Act. The FDA’s Office of Prescription Drug Promotion, which barely issued any warning letters in 2024, is now active again.

But the biggest challenge remains: balancing access with safety. Millions of people rely on online pharmacies for convenience, especially in rural areas or for chronic conditions. The goal isn’t to shut them down-it’s to make sure the ones you use are legal, licensed, and safe.

If you’re using an online pharmacy, treat it like you would a stranger selling pills on the street: verify everything. The system isn’t perfect, but the tools to protect yourself are free and easy to use. Don’t assume a website is safe just because it looks professional. Real pharmacies don’t hide behind flashy ads and fake reviews. They’re licensed, accountable, and transparent.