How to sell peptides legally: a guide for med spas, telehealth, and online distributors

The peptide market is booming and the regulatory ground beneath it keeps shifting. In February 2026, HHS Secretary Robert F. Kennedy Jr. announced that approximately 14 of the 19 peptides the FDA had placed on its Category 2 restricted list in 2023 would return to legal compounding status. Twelve were formally removed from Category 2 effective April 23, 2026. The FDA's Pharmacy Compounding Advisory Committee is scheduled to review seven of them for 503A eligibility at its July 23-24, 2026 meeting.

That is good news for peptide fans. But reclassification is not deregulation. Businesses that treat the 2026 announcements as a green light to operate the way they did in 2022 are walking into enforcement risk. The legal framework for selling peptides remains complex, category-specific, and heavily dependent on how your business is structured, what claims you make, and what state you operate in.

The framework: three categories, three sets of rules

Before anything else, understand that "peptides" is not a single legal category. How the law treats a peptide depends entirely on its FDA status.

FDA-approved peptides include semaglutide (Ozempic, Wegovy), tirzepatide (Mounjaro, Zepbound), tesamorelin, and others. These are prescription drugs subject to the full Federal Food, Drug, and Cosmetic Act (FD&C Act) framework. They can be prescribed by licensed providers, dispensed by licensed pharmacies, and administered in clinical settings. They cannot be compounded as a near-copy of an approved drug unless that drug is in shortage, and the FDA shut that door for semaglutide and tirzepatide in 2025.

Category 1 is the FDA's "okay to compound" list. If a peptide is on it, a licensed compounding pharmacy can prepare it for a patient who has a prescription.

Here is what most coverage gets wrong. The big April 2026 news was that twelve peptides came off the banned list, but coming off the banned list is not the same as being cleared to sell. Those twelve, including BPC-157 and TB-500, are now in limbo: no longer banned, not yet allowed. They only become available to compound if an FDA advisory committee recommends them and the FDA signs off, and that committee turned down every peptide it reviewed the last time, in 2024. The committee meets again in July 2026 to consider seven of them.

The one real exception so far is GHK-Cu in topical form, which the FDA moved onto the Category 1 list in a May 2026 update, so a pharmacy can compound it now. Injectable GHK-Cu is still off-limits. A few other peptides have always been compoundable because they sit outside this whole fight, sermorelin being the most common. The takeaway for your business: coming off the banned list and being cleared to sell are two different things, and right now almost none of the headline peptides have crossed that line.

Category 2 is the FDA's "do not compound" list, the peptides it considers too risky to allow. Watch this list closely, because April 2026 reshuffled it. Melanotan II, LL-37, and PEG-MGF were taken off the Category 2 list in April 2026, so they are no longer on it, even though they still cannot be compounded. Other well-known peptides do remain restricted, including the growth-hormone-type compounds GHRP-2, GHRP-6, and MK-677. The exact list keeps changing as the FDA updates it, so confirm a peptide's current status before you rely on any single name. Either way, none of these can be legally made for people. Selling them or giving them to patients as treatments puts your business at risk of FDA enforcement, having products seized, and even criminal charges.

1. Med spas and aesthetic clinics

Med spas offering peptide therapies operate at the intersection of three regulatory frameworks: state medical practice law, FDA drug compounding rules, and the Corporate Practice of Medicine doctrine (CPOM), which governs who can own and control a medical practice.

The medical director requirement. In most states, a med spa that administers prescription peptides must have a licensed physician serving as medical director. The medical director cannot be a figurehead. They must establish protocols, supervise clinical staff, review patient charts, and be reachable for clinical questions. A nominal medical director who signs paperwork but never appears on-site is one of the most common enforcement targets for state medical boards.

The prescription and sourcing requirement. Compounded peptides require a valid patient-specific prescription from a licensed provider. The prescription must be filled by a licensed compounding pharmacy — either a 503A pharmacy for individual patient prescriptions or a 503B outsourcing facility for office-use supply. Med spas cannot buy peptides from unregulated online vendors, overseas suppliers, or "research use only" distributors and administer them to patients. Doing so is administering an unapproved drug, regardless of what the label says.

Informed consent. Peptides available through compounding are not FDA-approved drugs for most therapeutic uses. Patients must be informed of this. Informed consent documentation should state that the treatment is compounded, that the compound is not FDA-approved for the intended use, and that clinical evidence is limited.

The most common mistakes med spas make:

• Sourcing peptides from gray-market online vendors rather than licensed 503A or 503B pharmacies

• Administering Category 2 peptides that cannot legally be compounded for human use

• Using a nominal medical director who is not actually supervising clinical protocols

• Making marketing claims that imply FDA approval or guaranteed efficacy ("clinically proven," "FDA-cleared," "medical-grade")

• Failing to obtain and document patient-specific prescriptions before administering compounded peptides

2. Telehealth platforms

Telehealth has become the dominant distribution channel for peptide therapy. It is also the channel under the most active enforcement scrutiny. The FDA's enforcement push in 2025 and 2026 has been aggressive. It sent 30 warning letters in a single day on March 3, 2026, and more than 80 to telehealth companies over the year leading up to it. Those March letters were about advertising, not medicine. The FDA went after companies for suggesting their compounded weight-loss products were the same as FDA-approved drugs, and for hiding which pharmacy actually made them. The separate "prescription mill" problem, where a patient gets a quick rubber-stamp prescription with little real evaluation, draws its own scrutiny from state medical boards.

The standard of care applies online. A telehealth provider prescribing peptides must conduct a clinically adequate evaluation. That means reviewing medical history, assessing for contraindications, documenting clinical rationale, and establishing a monitoring plan. A questionnaire with a checkbox asking whether the patient wants a peptide protocol is not a clinical evaluation.

The pharmacy must be licensed in the patient's state. A telehealth platform routing prescriptions to a single compounding pharmacy for nationwide distribution must verify that the pharmacy is licensed to ship compounded medications to each patient's state of residence. Florida, California, and Texas all require out-of-state pharmacies to register with their state boards before shipping to residents.

Marketing claims are a primary enforcement trigger. Describing compounded semaglutide as a "generic," claiming it is "clinically proven," or implying equivalence to an FDA-approved branded drug are independent violations of 21 C.F.R. Part 202 and the FTC Act's prohibition on deceptive advertising.

GLP-1s require specific caution in 2026. The semaglutide shortage officially ended in February 2025, and pharmacies had until April 2025 to stop making copies of it. Tirzepatide's shortage ended even earlier, in December 2024. Then, on April 30, 2026, the FDA proposed to permanently bar large-scale compounding of semaglutide, tirzepatide, and liraglutide. The public comment window runs through the end of June 2026.

The most common mistakes telehealth platforms make:

• Prescribing at volume without conducting clinically adequate patient evaluations

• Routing prescriptions to compounding pharmacies not licensed in the patient's state

• Making marketing claims that imply equivalence to FDA-approved branded products

• Continuing to compound or prescribe GLP-1s under the shortage exemption after that pathway closed

• Failing to document medical necessity for each individual compounded prescription

3. Online distributors and the "research only" label

The research-use-only (RUO) market is the largest gray area in peptide distribution and the one that carries the most legal risk for business owners who think they have found a compliant structure.

The FDA's enforcement position is that labeling alone does not determine regulatory status. What matters is the totality of the circumstances: who is buying the product, how it is being marketed, what the seller knows about intended use, and whether the product is being sold alongside dosing instructions, syringes, bacteriostatic water, or other indicators of human use.

When the "research only" label fails. The FDA assumes any peptide shipped to someone's home, bought by a regular person with no lab behind them, or sold with dosing instructions is meant for people, no matter what the label says. It proved the point on April 7, 2026, when it sent warning letters to seven online "research only" peptide sellers. Their product pages talked about weight loss and appetite, and they sold injection water right next to the peptides. More than 40 state attorneys general also wrote to the FDA and the Department of Homeland Security in 2025, going after sellers who used the "research only" label as cover for selling restricted peptides and weight-loss drugs straight to consumers.

What a legitimate “research only” operation requires. A business that genuinely sells peptides for research purposes must: sell exclusively to verified institutional buyers with documented purchase orders; label every product explicitly as not for human or animal use; not include dosing instructions or clinical use language anywhere; and ship only to verified facility addresses, not residential addresses.

Category 2 peptides cannot be sold for human use under any label. Melanotan II, GHRP-2, GHRP-6, LL-37, and PEG-MGF cannot be legally marketed or sold for human consumption under 21 U.S.C. § 331, regardless of the label.

The most common mistakes online distributors make:

• Using the RUO label while marketing to consumers with dosing guides, before-and-afters, or wellness claims

• Selling to residential buyers without institutional verification

• Selling Category 2 peptides alongside injection supplies that signal human use intent

• Assuming a website disclaimer provides legal protection when the totality of the business signals consumer human use

What your state adds on top

California. California Business and Professions Code § 4127 governs pharmacy compounding. Board of Pharmacy rules finalized October 2025 redefine "essentially a copy" and impose an affirmative duty on pharmacists to document patient-specific "clinically significant differences." Out-of-state pharmacies must be licensed with the California Board of Pharmacy before shipping to California patients. Starting July 1, 2026, any out-of-state pharmacy that ships into California has to put a California-licensed pharmacist in charge of that operation. So if your med spa gets its compounded products from a pharmacy in another state, confirm that pharmacy is licensed to ship into California and has that California pharmacist in place.

New York. Specific documentation requirements apply to telehealth prescribing of compounded medications as of May 2025. Out-of-state compounding pharmacies must be registered with the New York State Board of Pharmacy before shipping to New York patients. The New York AG participated in the 2025 multi-state enforcement letter.

Texas. The Texas State Board of Pharmacy requires prescribers to document that FDA-approved alternatives were considered and deemed clinically inappropriate before issuing a compounded peptide prescription. Out-of-state pharmacies must register with the Texas State Board of Pharmacy before shipping to Texas residents.

Florida. Florida requires out-of-state 503B outsourcing facilities to register with the Florida Board of Pharmacy and submit quarterly compounding logs before shipping to Florida residents. Florida's SB 860 and HB 877 would impose additional API sourcing and documentation requirements on compounded drug distribution.

Michigan. The Michigan Board of Pharmacy requires out-of-state pharmacies to obtain a Michigan pharmacy license before dispensing to Michigan residents. Medical directors of Michigan med spas must hold an active Michigan medical license regardless of where the employing entity is incorporated.

How to use Inhouse

Start a chat below and describe your business model: are you a med spa administering peptides to patients, a telehealth platform routing prescriptions to compounding pharmacies, or an online distributor? Describe the specific peptides involved and the states where you operate. Inhouse can produce a compliance checklist specific to your model, a medical director agreement framework, a patient informed consent template for compounded peptide therapy, and a plain-language breakdown of which peptides are currently in Category 1 versus Category 2.

For marketing materials, describe your current website copy and claims and Inhouse can flag language that creates FDA or FTC enforcement exposure and suggest compliant alternatives. What gets routed to a lawyer: structuring your medical director agreement and CPOM compliance, reviewing compounding pharmacy contracts for state licensing gaps, and any situation where you are currently operating under the RUO model and want to assess your actual legal exposure.

_________

The information provided in this article speaks only to the information and guidance we have available as of the date of publication and is subject to change. This legal update was created by Inhouse Counsel P.C, and is not intended as a substitute for professional legal advice. Receipt, by itself, does not create an attorney-client relationship. For any questions, or for further information, loop in an Inhouse Counsel on your next task at Inhouse.ai.