How to sell peptides legally: a guide for med spas, telehealth, and online distributors

The peptide market is booming and the regulatory ground beneath it keeps shifting. In February 2026, HHS Secretary Robert F. Kennedy Jr. announced on the Joe Rogan Experience that approximately 14 of the 19 peptides the FDA had placed on its Category 2 restricted list in 2023 would return to legal compounding status. Twelve were formally removed from Category 2 effective April 23, 2026. The FDA's Pharmacy Compounding Advisory Committee is scheduled to review seven of them for 503A eligibility at its July 23-24, 2026 meeting.

That is good news. But reclassification is not deregulation. Businesses that treat the 2026 announcements as a green light to operate the way they did in 2022 are walking into enforcement risk. The legal framework for selling peptides remains complex, category-specific, and heavily dependent on how your business is structured, what claims you make, and what state you operate in.

The framework: three categories, three sets of rules

Before anything else, understand that "peptides" is not a single legal category. How the law treats a peptide depends entirely on its FDA status.

FDA-approved peptides include semaglutide (Ozempic, Wegovy), tirzepatide (Mounjaro, Zepbound), tesamorelin, and others. These are prescription drugs subject to the full Federal Food, Drug, and Cosmetic Act (FD&C Act) framework. They can be prescribed by licensed providers, dispensed by licensed pharmacies, and administered in clinical settings. They cannot be compounded as essentially a copy of an approved drug outside of a shortage designation — a pathway the FDA formally closed for semaglutide and tirzepatide in 2025.

Category 1 compoundable peptides are those the FDA has determined have sufficient safety data to be compounded by licensed pharmacies under Section 503A (patient-specific, state-licensed pharmacies) or Section 503B (FDA-registered outsourcing facilities producing larger batches) of the FD&C Act. Following the 2026 reclassification, BPC-157, TB-500, CJC-1295, Thymosin Alpha-1, Ipamorelin, AOD-9604, GHK-Cu, and others are expected to return to this category — but only once each completes PCAC review and receives formal FDA confirmation. Removal from Category 2 and approval for 503A compounding are two different steps.

Category 2 restricted peptides are those the FDA has determined lack sufficient safety data for compounding. As of June 2026, approximately five remain in this category, including Melanotan II, GHRP-2, GHRP-6, LL-37, and PEG-MGF. These cannot be legally compounded for human use. Selling or administering them as therapeutic products exposes your business to FDA enforcement, product seizure, and potential criminal liability under 21 U.S.C. § 331.

Med spas and aesthetic clinics

Med spas offering peptide therapies operate at the intersection of three regulatory frameworks: state medical practice law, FDA drug compounding rules, and the Corporate Practice of Medicine doctrine (CPOM), which governs who can own and control a medical practice.

The medical director requirement. In most states, a med spa that administers prescription peptides must have a licensed physician serving as medical director. The medical director cannot be a figurehead. They must establish protocols, supervise clinical staff, review patient charts, and be reachable for clinical questions. A nominal medical director who signs paperwork but never appears on-site is one of the most common enforcement targets for state medical boards.

The prescription and sourcing requirement. Compounded peptides require a valid patient-specific prescription from a licensed provider. The prescription must be filled by a licensed compounding pharmacy — either a 503A pharmacy for individual patient prescriptions or a 503B outsourcing facility for office-use supply. Med spas cannot buy peptides from unregulated online vendors, overseas suppliers, or "research use only" distributors and administer them to patients. Doing so is administering an unapproved drug, regardless of what the label says.

Informed consent. Peptides available through compounding are not FDA-approved drugs for most therapeutic uses. Patients must be informed of this. Informed consent documentation should state that the treatment is compounded, that the compound is not FDA-approved for the intended use, and that clinical evidence is limited.

The most common mistakes med spas make:

• Sourcing peptides from gray-market online vendors rather than licensed 503A or 503B pharmacies

• Administering Category 2 peptides that cannot legally be compounded for human use

• Using a nominal medical director who is not actually supervising clinical protocols

• Making marketing claims that imply FDA approval or guaranteed efficacy ("clinically proven," "FDA-cleared," "medical-grade")

• Failing to obtain and document patient-specific prescriptions before administering compounded peptides

Telehealth platforms

Telehealth has become the dominant distribution channel for peptide therapy. It is also the channel under the most active enforcement scrutiny. The FDA's 2025-2026 enforcement wave — which included more than 50 warning letters in a single action in March 2026 — was aimed primarily at telehealth platforms that operated as prescription mills: minimal patient evaluation, high-volume prescribing, direct-to-patient compounded peptide shipment.

The standard of care applies online. A telehealth provider prescribing peptides must conduct a clinically adequate evaluation. That means reviewing medical history, assessing for contraindications, documenting clinical rationale, and establishing a monitoring plan. A questionnaire with a checkbox asking whether the patient wants a peptide protocol is not a clinical evaluation.

The pharmacy must be licensed in the patient's state. A telehealth platform routing prescriptions to a single compounding pharmacy for nationwide distribution must verify that the pharmacy is licensed to ship compounded medications to each patient's state of residence. Florida, California, and Texas all require out-of-state pharmacies to register with their state boards before shipping to residents.

Marketing claims are a primary enforcement trigger. Describing compounded semaglutide as a "generic," claiming it is "clinically proven," or implying equivalence to an FDA-approved branded drug are independent violations of 21 C.F.R. Part 202 and the FTC Act's prohibition on deceptive advertising.

GLP-1s require specific caution in 2026. The FDA formally closed the shortage-based compounding pathway for semaglutide in April 2025. The FDA proposed on April 30, 2026 to permanently exclude semaglutide, tirzepatide, and liraglutide from the 503B Bulks List. The public comment period closes June 29, 2026.

The most common mistakes telehealth platforms make:

• Prescribing at volume without conducting clinically adequate patient evaluations

• Routing prescriptions to compounding pharmacies not licensed in the patient's state

• Making marketing claims that imply equivalence to FDA-approved branded products

• Continuing to compound or prescribe GLP-1s under the shortage exemption after that pathway closed

• Failing to document medical necessity for each individual compounded prescription

Online distributors and the "research only" label

The research-use-only (RUO) market is the largest gray area in peptide distribution and the one that carries the most legal risk for business owners who think they have found a compliant structure.

The FDA's enforcement position is that labeling alone does not determine regulatory status. What matters is the totality of the circumstances: who is buying the product, how it is being marketed, what the seller knows about intended use, and whether the product is being sold alongside dosing instructions, syringes, bacteriostatic water, or other indicators of human use.

When the RUO exemption fails. The FDA presumes any peptide shipped to a residential address, purchased by an individual without institutional affiliation, or sold with dosing instructions is intended for human use — regardless of what the label says. Forty state attorneys general sent a formal letter to the FDA in 2025 specifically targeting vendors using the RUO label as cover for consumer sales of Category 2 peptides and unapproved GLP-1 products.

What a legitimate RUO operation requires. A business that genuinely sells peptides for research purposes must: sell exclusively to verified institutional buyers with documented purchase orders; label every product explicitly as not for human or animal use; not include dosing instructions or clinical use language anywhere; and ship only to verified facility addresses, not residential addresses.

Category 2 peptides cannot be sold for human use under any label. Melanotan II, GHRP-2, GHRP-6, LL-37, and PEG-MGF cannot be legally marketed or sold for human consumption under 21 U.S.C. § 331, regardless of the label.

The most common mistakes online distributors make:

• Using the RUO label while marketing to consumers with dosing guides, before-and-after content, or wellness claims

• Selling to residential buyers without institutional verification

• Selling Category 2 peptides alongside injection supplies that signal human use intent

• Assuming a website disclaimer provides legal protection when the totality of the business signals consumer human use

What your state adds on top

California. California Business and Professions Code § 4127 governs pharmacy compounding. Board of Pharmacy rules finalized October 2025 redefine "essentially a copy" and impose an affirmative duty on pharmacists to document patient-specific "clinically significant differences." Out-of-state pharmacies must be licensed with the California Board of Pharmacy before shipping to California patients. California SB 282 (introduced January 2026) would impose new registration and oversight requirements specifically on med spas that administer compounded drugs.

New York. Specific documentation requirements apply to telehealth prescribing of compounded medications as of May 2025. Out-of-state compounding pharmacies must be registered with the New York State Board of Pharmacy before shipping to New York patients. The New York AG participated in the 2025 multi-state enforcement letter.

Texas. The Texas State Board of Pharmacy requires prescribers to document that FDA-approved alternatives were considered and deemed clinically inappropriate before issuing a compounded peptide prescription. Out-of-state pharmacies must register with the Texas State Board of Pharmacy before shipping to Texas residents.

Florida. Florida requires out-of-state 503B outsourcing facilities to register with the Florida Board of Pharmacy and submit quarterly compounding logs before shipping to Florida residents. Florida's SB 860 and HB 877 would impose additional API sourcing and documentation requirements on compounded drug distribution.

Michigan. The Michigan Board of Pharmacy requires out-of-state pharmacies to obtain a Michigan pharmacy license before dispensing to Michigan residents. Medical directors of Michigan med spas must hold an active Michigan medical license regardless of where the employing entity is incorporated. How to use Inhouse

Start a chat below and describe your business model: are you a med spa administering peptides to patients, a telehealth platform routing prescriptions to compounding pharmacies, or an online distributor? Describe the specific peptides involved and the states where you operate. Inhouse can produce a compliance checklist specific to your model, a medical director agreement framework, a patient informed consent template for compounded peptide therapy, and a plain-language breakdown of which peptides are currently in Category 1 versus Category 2.

For marketing materials, describe your current website copy and claims and Inhouse can flag language that creates FDA or FTC enforcement exposure and suggest compliant alternatives.

What gets routed to a lawyer: structuring your medical director agreement and CPOM compliance, reviewing compounding pharmacy contracts for state licensing gaps, and any situation where you are currently operating under the RUO model and want to assess your actual legal exposure.

This article is for general information only and does not constitute legal advice or medical advice. The regulatory status of peptides under FDA and state law is actively changing as of June 2026. The Category 2 reclassification announced in February 2026 is proceeding through formal FDA review stages and has not been fully implemented; businesses should verify current FDA categorization before making compliance decisions. State laws referenced above reflect requirements as of June 2026 and are subject to change, including pending Florida and California legislation. The GLP-1 compounding landscape is under active litigation, rulemaking, and enforcement action. Consult a licensed healthcare regulatory attorney in your jurisdiction before structuring or modifying your peptide business. Nothing in this article should be construed as authorization to administer, compound, or distribute any specific peptide compound.