Influencer and Affiliate Marketing for Rx Programs: the Rules That Bind You Both

Three seats, three exposures

Start with who can be named, because it decides how the rest reads. The advertiser is liable for its advertising, which surprises nobody. The endorser is separately liable for statements made in the course of an endorsement, including, in the Guides' own words, when an endorser falsely represents that they personally used a product. And the middle layer is named explicitly: advertising agencies, public relations firms, review brokers, reputation management companies and other similar intermediaries may be liable for their roles in creating or disseminating endorsements containing representations that they know or should know are deceptive.

The FTC's December 2025 order against a telehealth weight-loss marketer, Southern Health Solutions, Inc., trading as Next Medical and NextMed, is the working example, and it also shows the individual dimension: two people were named personally alongside the company, one of them a former officer. The conduct included testimonials from actors recruited on Craigslist and a gig platform, one endorser who was an officer's own mother, another who was one of the named respondents, and internal direction to add fake reviews using a VPN to evade a review platform's fraud detection.

So the practical rule for a program with affiliates: your contract can allocate cost, and it cannot allocate exposure. Every party in the chain has to be able to defend its own conduct, which means the brand's compliance obligation does not end at the brief it sends. Knowing or having reason to know is the standard the middle layer is held to, and a brand that never checks what its affiliates publish is not in a strong position on the second half of that phrase.

Indemnity moves money, not liability. If your affiliate program has no review step, nobody in the chain can honestly say they had no reason to know.

What counts as an endorsement now, which is more than you think

The 2023 revision widened the definition in ways that matter for how Rx programs actually get promoted. An endorsement is any advertising, marketing or promotional message that consumers are likely to believe reflects the opinions, beliefs, findings or experiences of a party other than the sponsoring advertiser, even if the views expressed are identical to the advertiser's own. Tags in social media posts count. So do depictions of a person's name, likeness or other identifying characteristics, and the name or seal of an organization.

Two additions close doors people still walk through. Fake positive reviews used to promote a product are endorsements, which places them squarely inside this framework rather than in some separate category of marketing mischief. And purchasing or creating indicators of social media influence, then using them to misrepresent that influence, is itself a deceptive practice. The 2023 announcement also reached the surrounding behavior: procuring, suppressing, boosting, organizing, publishing, upvoting, downvoting or editing reviews so as to distort what consumers see.

Employee and insider endorsements deserve their own line, because health brands generate them naturally and rarely disclose them. A founder, an investor, a clinician on your network, or a staff member posting enthusiastically about the program is an endorser with a material connection. So is a family member. The NextMed complaint's most quotable detail is that one testimonial was an officer's mother, and the reason it reads badly is not that a mother is disqualified from having an opinion; it is that nobody told the audience.

• Paid, gifted, commissioned, affiliate, employee, investor and family relationships are all material connections
• A tag counts, a likeness counts, an organization's seal counts
• Fake reviews are endorsements, not a separate category
• Buying followers or engagement and trading on it is itself deceptive
• Suppressing, boosting or editing reviews to shape perception is covered too

Disclosure: the bar is higher than a bio link

The standard is stated plainly. A disclosure is clear and conspicuous when it is difficult to miss, meaning easily noticeable, and easily understandable by ordinary consumers. And in any communication using an interactive electronic medium, such as social media or the internet, the disclosure should be unavoidable. Unavoidable is the operative word: a link in a bio, a hashtag below a fold, a mention in the fourth line of a caption, or a disclosure that only appears if the viewer taps More are all avoidable by construction.

One example in the current Guides is worth knowing precisely because it looks like an edge case and is not, for this category. Where a health-product advertisement is microtargeted in a foreign language to a group with a particular health condition, the typical-results disclosure has to appear in that same language. Any program running Spanish-language creative for a weight-loss audience is inside that example rather than beside it.

The affiliate-specific trap is scale. A brief that says please disclose is not a control. What functions as one is a disclosure requirement written into the agreement, a specimen post that shows placement rather than describing it, a review step before or shortly after publication, and a record of what you checked. None of that is exotic, and all of it is cheaper than one disapproval cascade across a network you cannot recall.

The claims themselves, which is where health marketing differs

Disclosure fixes the relationship problem. It does nothing for the claim problem, and for a prescription program the claim problem is stricter than most creator marketing has ever had to handle. Objective claims need substantiation held before the ad runs, and for health benefits the standard is competent and reliable scientific evidence, which the FTC's guidance says will generally mean randomized, controlled human clinical testing. The same guidance states that anecdotal evidence about individual consumers, including surveys of customer experiences, is never sufficient on its own to substantiate a claim about a health product's effects.

Testimonials carry a specific rule that catches this format constantly. Where a testimonial reports results more dramatic than users can generally expect, the guidance says attempts to disclaim with statements like results not typical do not cure the deception, and that what is required instead is a clear and conspicuous disclosure of the results a typical consumer can actually expect. Which means you have to know that number. NextMed's average-weight-loss claims failed on exactly this: the company did not maintain records of its members' weight loss, and could not show its results were comparable to the industry-sponsored trials the claims implicitly borrowed from, particularly since some advertising promised no diet or exercise was required while the trial participants did both.

The related trap for creators is borrowing a drug's trial results for a program. A GLP-1 medication's published outcomes describe the population studied under the protocol studied. They are not a claim about your program's members, and repeating them beside your brand converts them into one.

If your program cannot state what a typical member achieves, it cannot run a testimonial that beats typical. The disclaimer is not the fix; the number is.

Billing and cancellation, since affiliates sell subscriptions

Affiliate traffic overwhelmingly lands on recurring-billing offers, so the terms of that offer are part of the advertising. Before charging, a seller must clearly and conspicuously disclose its name, a description of the product including the length of any contract, the amount and timing of every charge, and all material restrictions, in close proximity to the request for billing information. That is what the NextMed order requires, and it runs on Section 5 of the FTC Act and ROSCA rather than on the rule most articles cite.

Get that citation right, because it is the most common error in this subject area. The 2024 amended Negative Option Rule, popularly called click to cancel, was vacated in full by the Eighth Circuit in July 2025, and in February 2026 the Commission recodified the pre-2024 text, leaving only the narrow prenotification-plan rule in force. A fresh rulemaking is at the comment stage with no proposed rule issued. What ROSCA requires is a simple cancellation mechanism, and the December 2025 order requires cancellation through the purchase channel from the respondents it binds. Matching signup effort step for step is a good design target and our recommendation, not a current federal obligation.

The enforcement has not slowed for the rule's absence. In July 2026 the FTC and a group of states filed suit against Hims & Hers over, among other things, subscription and cancellation practices, charged under the FTC Act and ROSCA. Those are allegations in ongoing litigation, and nothing here is a conclusion about that company; what the filing establishes is direction.

A program you could actually defend

Written into the affiliate agreement: the disclosure requirement with placement specified, a prohibition on claims beyond an approved set, a ban on fabricating or incentivizing reviews, and the right to require removal. Provided to every affiliate: an approved claims list, the typical-results figure for any outcome you allow them to reference, and a specimen post showing where the disclosure sits. Operated continuously: a spot-check cadence with a record of what was reviewed and when, and an off-boarding step that includes taking content down.

The reason to build it this way is not fear of the Commission. It is that the alternative concentrates every one of these risks at the moment you scale, which is exactly when you have the least visibility into what a hundred affiliates are posting. Our FTC guide covers the underlying rules in full, the creator platform page covers what changes when the brand is your own, and the advertising cluster covers the platform-policy layer that sits on top of all of it.