LegitScript certification for Google Ads, explained

LegitScript is an independent certification body. Google requires its certification before an advertiser in certain restricted categories can run ads at all: most commonly addiction treatment, telemedicine, pharmacy, and some healthcare services. Google's healthcare and medicines policy names LegitScript directly for online pharmacies and points to a certification application for each restricted category.

Without it, ads in those categories are disapproved. This is not a ranking penalty or a quality signal; the ads simply do not run.

The category boundaries are not always obvious. A clinic offering a mix of wellness and treatment services can find one service line restricted and the rest fine, which is worth establishing before building campaigns rather than after.

This is the misunderstanding that costs the most time. LegitScript certification and Google certification are separate steps, in that order, and holding the first does not produce the second.

Google's policy for addiction services is written as a permission list rather than a certification list: advertisers who have applied and been approved may advertise, and only in a defined set of countries, currently Australia, Canada, France, Ireland, New Zealand and the United States. The third-party accreditation is an input to that application. It is not a substitute for it.

So a US operator opening in a country outside that list does not have a paperwork problem, it has a market that cannot be advertised into on this channel. Establish that first, because no amount of certification work changes it, and it is a strategy question rather than an operations one.

The practical sequence is: confirm the category, confirm the country, obtain the third-party certification, then apply to Google, then build campaigns. Teams that run those in parallel usually discover the ordering constraint at the point where the campaigns are already built.

An evidence pack rather than a form. Licensing, ownership, clinical staffing, policies and practices, assembled and submitted for review.

LegitScript's own addiction treatment programme lists the shape of it: facility names and addresses, lease or ownership records, liability insurance, licensure, business registration numbers for the organisation and its principals, and current DEA certificates for any practitioner prescribing controlled substances. It also asks you to list every domain you own, including the ones you are not certifying.

That last requirement catches groups with a marketing site, a booking subdomain and two legacy domains nobody has touched in years. Compile the domain list before you start, from your registrar rather than from memory, because an omission found later reads as concealment rather than oversight.

The work is mostly assembly and coordination: gathering documents that exist in several places inside the business and presenting them coherently. The bottleneck is usually internal, not the reviewer.

Budget real calendar time. LegitScript offers a paid expedited option that starts the review within two business days of submission, which tells you plainly that the standard path is not measured in days. This gates advertising entirely, so it belongs at the front of a launch plan rather than in parallel with it.

Certification carries renewal dates and an annual fee. Renewals get missed because nobody owns the calendar, and a lapsed certification stops advertising in the restricted categories.

For an operator running a handful of locations, this is manageable. Across thirty accounts in a manager account structure, renewal dates are exactly the sort of administrative detail that decays: the same category of failure as unclaimed promotional credits and drifting naming conventions.

Set the reminder against the renewal date minus a realistic assembly window, not against the date itself. The documents that were assembled last year have changed: leases renew, practitioners leave, insurance certificates expire on their own schedule. A renewal reminder that arrives the week it is due is a reminder that you are already late.

A compliance log with renewal dates, owned by someone, is the entire fix. It is unglamorous and it is why MCC management treats regulated verticals as carrying more administrative load rather than the same load.

The first row is common and frustrating. A certified advertiser gets flagged anyway, usually because automated policy matching caught a phrase rather than because anything is actually wrong. It is correspondence work, not a real violation, and it resolves with evidence.

The last row catches multi-location operators. Certification scope is tied to entities, and a new clinic added to the group is not automatically covered by the group's existing certification.

Row two is worth pricing rather than fearing. A lapse produces downtime of a known shape: ads stop, the renewal runs, ads resume. Row four is a different category entirely, and the difference is explained below.

These are three different problems and they get discussed as one. A disapproval affects an ad. A suspension affects an account, and Google notes that related accounts may be suspended too, along with new accounts the same advertiser creates.

The warning behaviour differs by policy, and that difference is the most useful thing to understand here. For ordinary repeat violations Google states it sends a warning at least seven days before a suspension. For what it classifies as egregious policies, the account is suspended immediately without prior warning.

Certification categories sit on the safe side of that line, and misrepresentation does not. Providing false or fraudulent information as part of a verification programme is a circumventing systems violation, and Google states those accounts are suspended upon detection and without prior warning. This is precisely why a certification application is not a place to round anything up. An overstated staffing claim to speed an application through converts a recoverable problem into an unrecoverable one.

It is worth being honest about the odds on appeal as well. Google's own wording is that accounts are only reinstated in compelling circumstances, such as a mistake. That is not a reason to skip the appeal; it is a reason to make the first submission the good one.

Appeal preparation is evidence assembly: what was wrong, what changed, and proof of the change. An appeal that argues rather than documents usually fails.

Nobody can guarantee a platform's decision, and any provider who does is guessing on your behalf. What is controllable is the quality of the documentation and the persistence of the escalation.

If the suspension followed activity nobody on the team recognises, treat it as a security incident rather than a policy one: that is a compromise until proven otherwise, and the containment clock is already running.

Do not create a replacement account while an appeal is open. Google states that new accounts created by a suspended advertiser may be suspended as well, and doing it during an appeal reads as evasion of exactly the kind that moves a case into the egregious category.

Three things make regulated advertising boring rather than fraught, which is the goal. A compliance log with renewal dates and a named owner. An onboarding runbook that confirms certification scope covers each new entity before campaigns are built. And a policy correspondence file, so the next disapproval is answered with the last successful appeal rather than from scratch.

Add a fourth if you run more than a handful of accounts: a monthly disapproval sweep across the estate. Disapprovals do not announce themselves, and the failure pattern is a franchisee calling to ask why their phone stopped ringing, typically in week two. An MCC layer is what makes that sweep a single view rather than thirty logins.

That is administrative infrastructure rather than campaign work, and it is usually nobody's explicit job. If you are running regulated advertising across multiple locations, it should be someone's.