Selling Peptides and State-Level Rules

most peptide operators do their legal homework at the federal level, conclude they understand the rules, and launch a store that ships to all fifty states. then a state agency, a state-licensed processor requirement, or a state consumer protection inquiry shows up and they discover the second half of the map.

state law is where a lot of the real constraints live. this article describes the general categories of state regulation that touch this business so you know what to ask about. it is not legal advice, it does not tell you what any specific state requires today, and it deliberately avoids naming statutes because this area changes and fabricated specifics are worse than none. work with counsel who covers your actual footprint.

why states matter more here than in most ecommerce

in ordinary ecommerce, state law mostly means sales tax. in this category, states hold direct authority over several things that are core to how a peptide business works.

• —the practice of medicine, including who may evaluate and prescribe and under what conditions.
• —pharmacy licensure and what may be compounded, by whom, and for whom.
• —wholesale drug distribution and licensure for entities that distribute certain products into the state.
• —telehealth, including modality requirements and whether an in-person visit is needed first.
• —consumer protection and deceptive trade practices, which state attorneys general enforce actively.
• —in some cases, specific restrictions targeting particular substances or categories.

any one of those can apply to you depending on your model. a purely RUO business generally sidesteps the medical and pharmacy layers but is fully exposed on consumer protection. a clinical telehealth model touches nearly all of them.

the nexus question

operators often assume they are subject only to the law of the state they are incorporated in. that is not how regulators see it. shipping product into a state, advertising to residents of a state, or having a licensed provider treating patients located in a state can all create a basis for that state to assert authority.

the practical version of this question is: which states do we actually touch, and through what activity? make the list explicitly. it usually includes every state you ship to, every state where a provider is licensed, every state where you have staff, and every state you run ads into.

a website feels like one national business. to fifty attorneys general, it is fifty local businesses that happen to share a domain.

the RUO business and state law

if you are running a clean research-use-only operation, your primary state exposure is consumer protection. state UDAP statutes, which prohibit unfair or deceptive acts and practices, are broad, actively enforced, and often carry private rights of action and attorney fee shifting.

what draws attention: claims in advertising that a consumer would find misleading, pricing or subscription practices that surprise people, testimonials that imply outcomes, and any gap between what you say and what you deliver. the RUO framing does not exempt you from being honest, and a regulator arguing that your marketing was aimed at consumers will use your consumer-facing conduct as proof.

secondary exposure includes any state-specific restrictions on selling certain substances, and in some places, licensing regimes that reach entities distributing particular product categories into the state. this is exactly the sort of thing that varies and changes, which is why it is a counsel question rather than a blog question.

the clinical business and state law

a med spa or telehealth model touches far more. the prescriber has to be licensed where the patient is located, not just where the clinic is. the evaluation has to meet that state's standard. delegation and supervision rules apply at the point of administration. corporate practice of medicine rules may constrain your ownership structure. and the compounding pharmacy you work with needs to be licensed appropriately for the states it ships into.

1. 1.list every state where a patient will be physically located at the time of service.
2. 2.confirm prescriber licensure in each of those states.
3. 3.confirm the telehealth standard in each: modality, prior in-person requirement, documentation.
4. 4.confirm your pharmacy partner's licensure covers shipment into each.
5. 5.confirm delegation and supervision rules for any in-person administration.
6. 6.review ownership structure against corporate practice rules in your home state and any state with a physical location.

most clinics that expand into telehealth underestimate step two and three and end up quietly out of compliance in three or four states.

the practical strategy: footprint control

you do not have to serve every state. narrowing your footprint is a legitimate and underused risk control, especially early. many operators choose to exclude a small number of states where the rules are strictest or least clear, ship to the rest, and revisit annually.

the mechanics are straightforward: geo-restrict at checkout, exclude those states in your ad targeting, and make sure your 3PL enforces it. the revenue cost is usually smaller than operators fear, and the risk reduction is real.

for scale context: WayyLess did $19.1M in revenue on $4.3M in spend at 4.45 blended ROAS. businesses at that size do not get there by ignoring jurisdictional questions. they get there by resolving them early so the growth engine never has to stop.

advertising into states

state consumer protection authority follows your advertising. that means an ad running in a state you do not ship to can still matter, and it means state-level rules on health-related advertising, testimonials, and provider marketing can reach you.

if you are a licensed practice, your state board almost certainly has advertising rules of its own covering testimonials, guarantees, credential claims, and before-and-after imagery. those are separate from and often stricter than general consumer protection law.

keeping up without going insane

no operator can track fifty states continuously. what works is a cadence and a trigger list.

• —a semiannual counsel review of your footprint and any material changes.
• —an immediate review whenever you add a state, a product, a provider, or a channel.
• —a subscription to a health care regulatory update service, or a firm that sends client alerts.
• —a single internal owner for compliance who is accountable for the calendar.
• —written records of the decisions you made and why, so a later reviewer sees good faith.

the honest summary

state law in this category is genuinely fragmented and genuinely moving. anyone who tells you they have a definitive fifty-state answer is selling something. what you can do is know the categories, map your real footprint, narrow it deliberately, and pay counsel to check the specific states that matter to you. that is the whole strategy, and it is enough.