A green badge near a checkout button is one of the few trust signals this market offers, and it is doing less work than it appears to. The certification behind it is real, the standards behind that are substantial, and the thing it is issued against is narrower than most buyers assume. It certifies a website, it is bought primarily so that a business can take card payments and run advertisements, and it says nothing whatever about who prepares the medicine — a separate entity with a separate regulator, covered in the supplier article.
What the program says it is for
The certifier’s own healthcare FAQ, read on September 15, 2026, describes the certification as “a necessary part of the approval process for conducting card-not-present transactions with Visa and Mastercard and for advertising on Google and Bing.”[1] The listed benefits are eligibility to advertise on participating platforms, recognition by participating payment providers and financial institutions, and independent verification that the business meets the certifier’s standards. The same page adds that certification “does not guarantee advertising approval.”
The price is published: an application fee of $975 and an annual certification fee of $2,150, assessed per root domain.[1] That is a commercial credential with a commercial purpose, sold at a commercial price, and none of that makes it meaningless. It does mean the badge is evidence that a business wanted to advertise and process cards, which is a different proposition from evidence that a vial is what the label says.
It attaches to a domain, not to a company
Certification applies to the root domain, with subdomains covered under the same certificate, and businesses under common ownership may be included in one application while each root domain is billed separately.[1] The consequence is specific and easy to miss: a company can operate several brands, certify one of them, and display the result anywhere. The domain in the browser bar is the unit that was examined.
After certification, the merchant is asked to notify the certifier of changes to ownership, operations, partnerships, services, licensing, and any disciplinary or regulatory action.[1] Continuing accuracy therefore depends partly on the certified business reporting its own bad news, which is an ordinary feature of certification schemes and worth knowing about this one.
What it is not
It is not a regulator. The certifier states plainly on its public lookup page that it “is a private certification body and not affiliated with any law enforcement agency,” and that it does “not have the authority to investigate or prosecute criminal activity.”[2] A state board of pharmacy license and a federal outsourcing-facility registration are different objects with different consequences, and the distinction between those two is set out in the pharmacy-category article.
It is not an approval of the product either. Compounded drugs are not FDA-approved, which means the agency does not verify their safety, effectiveness or quality before they are marketed, and no certification of the merchant changes that status.[3] What the phrase actually excludes is worked through in the approval article.
Broker, facilitator, or the brand taking the payment
The program’s own scope list names the activities that qualify: selling or advertising prescription medications online, offering telemedicine consultations that may result in a prescription, processing card-not-present payments for prescription drugs, manufacturing or distributing pharmaceuticals, connecting patients with contracted pharmacies or providers, and operating a prescription price-comparison or discount site.[1] Six activities, and a single purchase can involve three different companies doing three of them.
The certifier has vocabulary for that split. A facilitator connects patients with a single telemedicine provider or pharmacy under a contractual or financial relationship; a broker maintains those relationships with a network of partners.[1] Either can hold a certification in its own right, which means a sentence naming a telehealth partner as the certified party can be entirely accurate and still leave the domain collecting the money uncertified. The statement is true. It is answering a different question.
An absent seal is not a finding
This is where the inference reverses, and it reverses hard. The program’s published eligibility list excludes in-person-only clinics that do not offer telemedicine prescribing, and med spas that neither prescribe remotely nor process card-not-present payments for prescription drugs. It also excludes research-use-only chemical businesses, naming peptides explicitly.[1]
So a bricks-and-mortar clinic with no seal has not failed anything — it is outside the scheme. And the sellers with the worst documented product quality, the gray-market vendors shipping vials labeled for research, are excluded by definition rather than by judgment; the assays of what those shipments actually contained are in the counterfeit article. A missing badge cannot distinguish refused from ineligible from never applied, which makes its absence uninformative in both directions.
The five shapes a claim takes
Of the 220 sellers written up here, 27 carry a recorded certification claim, or 12.3%, and 33 write-ups mention the program in some form. Sorting those by what the claim actually asserts produces five distinct shapes, and they are not equally checkable.
One seller publishes a certification number against its own name, beside a named pharmacy with a street address. Three display a badge linked through to the certifier’s live status lookup. Most of the remainder display a badge or state the fact in prose with no number and no link, which is checkable but requires the reader to go and do it.
Two shapes are different in kind. Several sellers state that they source exclusively from certified compounding pharmacies while naming none of them, and one offers a list of accreditations behind a link that resolves to nothing — claims about a supplier, not about the storefront taking the payment. And at least one site’s certification belongs to the telehealth organization it integrates with rather than to the brand a buyer pays, a distinction its own write-up records because the seller makes no certification claim of its own. None of those is presented here as dishonest; each is a claim that a reader would have to restate before it could be verified.
How often a claimed seal fails to resolve
The published measurements come from other drug categories, and they point the same way. A cross-sectional study of online pharmacies selling Adderall found 62 such sites across four search engines, of which 61 were rogue or unclassified under the certifier’s own classification system. Among those rogue and unclassified sites, 33% claimed registration or accreditation of their pages.[4] A third of the sites making a credential claim were in a group that was almost entirely unclassifiable.
A United Kingdom study of 116 sites selling medicines popularized during the coronavirus pandemic found 55 (47%) rogue, 47 (41%) verified on the national regulator’s register, and 14 (12%) verified by some other body but not by the regulator. Separately, 63 of 93 sites declaring a physical location declared one that did not match where the site actually operated.[5]
That 12% is the finding worth carrying. A verification claim can be entirely true, refer to a real body, and still not be the credential that answers the question — which is the same shape as a claim that belongs to a supplier or a partner. Neither study measured GLP-1 sellers, neither was run in 2026, and both describe sites operating without a prescription requirement rather than the licensed telehealth market. They bound the problem; they do not size it here.
Checking a seal instead of trusting it
The certifier runs a public status lookup that takes a website and returns whether it is certified, legitimate, or rogue.[2] Four habits make it useful. Enter the exact root domain shown in the browser bar, since that is the unit certified, rather than a parent brand or a pharmacy named in an FAQ. Read what the seller’s sentence claims before checking it: a statement about a supplier is a question about the supplier’s domain, not the seller’s.
Third, treat the logo as decoration. An image can be copied, a link can point at a homepage instead of a certificate, and a status page either shows the domain or does not. Fourth, ask support for the certificate number in writing and check that too; a company that holds one can supply it in a sentence. The other things a page can imply without stating are collected in the presentation article.
What this page did not establish
No census of the 27 claims recorded here against the public lookup has been run. That lookup is an interactive, one-domain-at-a-time check and the program’s interface refuses an unauthenticated automated request, so the proportion of claims on this market that resolve is unmeasured rather than low. Anyone reading the figures above as a resolution rate for GLP-1 sellers is reading numbers from Adderall and pandemic-era medicines instead.
Nor does a resolved seal finish the job. It establishes that a website met a private body’s standards at a point in time, which leaves the preparer, the contents of the vial and the price all open. What each company states about its own certification is recorded in the seller write-ups, and the rule that a claim gets recorded as a claim rather than promoted into a fact is set out in the methodology.