Google Ads healthcare policy just opened Spain to Rx telehealth ads

What Google just reopened in Spain#

The fox that gets fed is the fox that reads the notice board first. On 22 July 2026, Google quietly rewrote one, and anyone tracking Google Ads healthcare policy in Spain's search results should have noticed the scratch of the pen.

Buried inside Google's own Healthcare and Medicines ad policy is a single new clause: telemedicine providers may now promote prescription drug services to Spanish users, provided the provider holds LegitScript's Healthcare Merchant Certification and the advertiser is separately certified with Google itself. Two credentials, one narrow doorway, and folkfox is watching it for every healthcare digital advertising client we work with in the healthcare marketing space.

Google states it plainly: “Google allows the promotion of prescription drug services by telemedicine providers that are certified by LegitScript's Healthcare Merchant Certification Program.” Read that twice, because the second half is the whole story. A telehealth brand can now buy media that says “book a consultation for weight management” in Spain. It cannot buy media that names the drug, prices the drug, or shows the drug's packaging. The service is promotable. The medicine stays under wraps.

Why Google Ads healthcare policy matters for telehealth advertisers#

For most industries a footnote in an ads policy is filler. For anyone reading Google Ads healthcare policy closely, it is a signal flare. Prescription-adjacent advertising in the EU has been thicketed and thorny for years, and Spain has just had one narrow trail cut through it, sourced not from a change in Spanish law but from Google widening a prescription-drug service policy it already runs elsewhere. That distinction matters: this is a platform gate reopening market by market, not a healthcare marketing regulations loosening across the board.

The general policy document is blunt about the two-track requirement everywhere it applies: “Advertisers must apply to serve ads for prescription drug services.” Spain simply became the newest country where that gate has an open latch, and the credential doing the unlocking is the same one Google, Meta, Microsoft, and Netflix all lean on to vet who gets to advertise healthcare products in the first place, per LegitScript's own certification page.

The certification itself is not a Spanish invention. LegitScript traces back to 2007, founded, per Wikipedia's summary of the company, “in response to the proliferation of dangerous counterfeit pharmaceuticals sold on the internet.” Two decades of vetting online pharmacies is exactly the pedigree Google wants standing between a telehealth advertiser and a Spanish patient, and it is why anyone building on Google Ads healthcare policy treats this credential as infrastructure rather than paperwork.

Enforcement carries a courtesy folkfox appreciates: Google's policy promises “at least 7 days” notice before any suspension, per the policy's own wording. A warning lands first. Compliance is a conversation here, not a trapdoor, and that graduated design gets its own reckoning in section four below.

LegitScript: the gate Google didn't have to build#

LegitScript did not build its Healthcare Merchant Certification for Spain, or for Google. It built the den first and let the platforms move in. Public records trace the company back to a Portland, Oregon compliance outfit that has spent nearly two decades tracking rogue online pharmacies, and by its own telling had, as of 2013, “approved over 250 online pharmacy websites and documented over 48,000 'rogue' online pharmacy websites” as early as 2013. LegitScript still frames the mission the same way today, as protecting and growing the world's digital economy. That two-decade fight against rogue pharmacies is exactly why online pharmacy advertising now runs through LegitScript's gate on every platform that matters.

What the certification actually checks, stage by stage, is not published in granular detail on LegitScript's public pages: LegitScript's certification landing page and its certification overview both describe the outcome (credibility, eligibility to advertise, eligibility to accept card payments) without listing every criterion behind it. What IS published, plainly, is the shape of the pathway a telemedicine provider walks through.

Four gates, in this order: create an account, submit an application, sit through LegitScript's own review, and then maintain the certification once it is granted, per LegitScript's certification overview. Nothing about that pathway is quick, and nothing about it is meant to be. Anyone treating Google Ads healthcare policy compliance as a box to tick before a launch date will find the review stage does not move to suit a media plan.

Who else already leans on the same gate#

This is the part worth saying plainly to any client who assumes Spain invented the hurdle: it did not. LegitScript's own merchant-risk page states outright that “Google, Meta, Microsoft, Netflix, TikTok, and LinkedIn rely on LegitScript certification to vet eligible online pharmacies and drug stores that want to advertise on their platforms.” Card networks lean on the same credential too, folkfox found: the same page notes that Visa and Mastercard both recognise LegitScript Certification as part of their own high-risk merchant registration and compliance monitoring.

None of that is unique to Spain, and none of it is new. What is new is Google switching the gate on for a market it previously kept shut. A healthcare digital advertising team that already holds LegitScript certification for a US or UK client is not starting from nothing: it is porting a credential the platforms already trust into a market that Google Ads healthcare policy just opened its own door to.

Contrast that with the older, thornier ground it grew out of. Wikipedia's account of telehealth regulation traces the US federal constraint back to the Ryan Haight Act of 2008, which requires a valid in-person or telemedicine consultation before a controlled substance can be prescribed across state lines. LegitScript-gated advertising for telehealth prescribing has effectively existed in that US market for the better part of two decades; Spain is a much younger clearing in the same wood.

A best healthcare marketing agency that skips the credential and runs the ad anyway is not saving time, it is borrowing it, at Google's interest rate. Every healthcare digital advertising team worth its retainer builds Google Ads healthcare policy into the media plan before the media plan gets built.

What the ad can say, and what it must not#

Say the service, never the substance. That is the entire grammar of a compliant Spanish telehealth ad, and it is worth stating as bluntly as Google states it: “Advertisers cannot promote prescription drugs in their ads and landing pages.” The service gets the microphone. The medicine stays backstage.

The duller version wins, every time. It survives review because it never has to defend a drug name, a dose, or a price against a policy line that was written to keep exactly those things off the page. Anyone applying Google Ads healthcare policy to Spanish landing pages should treat the drug name as a word the client is not allowed to hand the copywriter.

Notice what is absent from that table: a price for LegitScript's certification. folkfox looked. Its own merchant-risk page discloses none, offering revenue-share and enterprise partnership guides instead of a public rate card. Any healthcare digital advertising team quoting a client a certification cost from memory is quoting a number nobody has published; ask LegitScript directly, and budget the waiting room, not just the fee.

A best healthcare marketing agency cannot promise a client a shortcut through that gate, and should say so before the brief is signed, not after the ad gets pulled. Google Ads healthcare policy does not grant shortcuts, only a slower, cleaner path.

Graduated enforcement, and the wider pattern#

Google did not build this policy to punish anyone by surprise. Buried in the same paragraph as the certification requirement is a courtesy most advertisers never read until they need it.

Seven days is not generous, but it is not nothing either. It is enough time for a healthcare digital advertising team to swap a mistimed landing page under Google Ads healthcare policy, pull a rogue paid social variant that named a drug, or surface documentation LegitScript already holds. Google's own text is unambiguous: “Violations of this policy will not lead to immediate account suspension without prior warning. A warning will be issued, at least 7 days, prior to any suspension of your account.”

Read those three numbers as a single sentence: two credentials buy a telehealth brand access to a platform six others already trust, with seven days of runway if something slips. That is a workable set of healthcare marketing regulations for a market that used to be closed outright, and anyone applying Google Ads healthcare policy should be quoting all three to a nervous client rather than the drug-promotion prohibition alone.

LegitScript's own recent newsroom coverage, folkfox checked directly, has covered adjacent expansions in recent months, weight-loss clinic certification and veterinary telehealth advertising among them: the same certification instinct, extending vertical by vertical rather than arriving as one sweeping rule.

What a top healthcare marketing agency does next#

Every fox worth its brush knows the difference between a gap in the hedgerow and an open field. This is a gap: narrow, credentialed, and closing again the moment an advertiser gets careless inside it. Here is what Google Ads healthcare policy actually asks an advertiser to do about it.

What Google Ads healthcare policy asks advertisers to check first#

A healthcare digital advertising team does not treat that playbook as a one-off launch checklist. It runs the audit quarterly, because certifications lapse and landing pages drift, usually at the exact moment nobody is watching them.

This is not the first time Google Ads healthcare policy has asked an advertiser to prove its client's compliance rather than take a claim on faith. Regulated advertising keeps rewarding the operators who treat healthcare marketing regulations as the brief rather than the obstacle, a pattern folkfox has tracked closely across HIPAA-compliant marketing and FTC enforcement against healthcare marketers alike.

The same discipline shows up in how a page gets found in the first place. A best healthcare marketing agency chasing visibility for a newly certified telehealth client should be reading our own work on healthcare answer engine optimisation alongside the compliance file, because a page an AI answer engine cannot safely cite is a page a regulator cannot safely ignore either.

Spain will not be the last market to reopen this door. Anyone building for Google Ads healthcare policy who builds the LegitScript relationship now, before the next country follows, is the one still standing in the clearing when the rest of the pack finally catches the scent. If you want that groundwork laid properly, folkfox runs PPC and SEO and GEO services built for exactly this kind of credentialed, compliance-heavy campaign, and we would rather build it right than build it twice.

Frequently asked questions#