What changed for GLP-1 marketing after the FDA's 2026 crackdown?

On March 3, 2026, the FDA sent warning letters to 30 telehealth companies over how they marketed compounded GLP-1 drugs. It sent another 25 letters on June 16, 2026. If you run growth at a GLP-1 brand, you probably read those letters with a knot in your stomach and a note to call legal.

Here's the part worth being precise about. The letters were about marketing claims. They objected to language that blurred the line between an approved product and a compounded one. Calling a compounded product "generic Zepbound". Implying a compounded product was FDA-approved. Suggesting the seller compounded the drug when it didn't. That's what the agency named.

The letters were not about artificial intelligence. They were not an action against GLP-1 telehealth as a whole. If your claims don't do those things, the conduct named in the letters isn't yours.

So why did the bar move anyway? Because once regulators, plaintiff's lawyers, and your partners' compliance teams start reading how GLP-1 patients are marketed to, they may look at every touch. That review can reach emails, texts, automated follow-up, and older messages nobody remembers writing.

Hello Patient builds conversational AI agents for consumer health brands. Our agent doesn't recommend specific medications or doses. Every conversation is logged. Anything clinical hands off to your medical team, with the context attached.

Those guardrails are what let a brand keep talking to its members while the category is under review. A lead leaves a signup unfinished. A member asks what the program costs or when the next check-in is. The agent follows up, answers the approved questions, and keeps the conversation moving. The clinical questions go to your medical team, and every exchange is on the record.

What the FDA actually did, and what it means for your program

Start with the facts, because they're narrower than the headlines suggested. The agency's concern was product claims. When a company sold a compounded GLP-1 and described it in words that made it sound approved, or named it after a brand-name drug, or claimed to have compounded something it had bought, the FDA sent a letter. Foley & Lardner and McDermott Will & Emery both published client alerts breaking down the language that drew fire. The FDA's own announcement describes the action and the claims it objected to.

None of that describes your intake flow or your outreach cadence. So why should a clean marketer care?

The letters didn't address lifecycle outreach. What they did was put GLP-1 marketing under a closer read, and a closer read may not stop at the product page. Partner compliance teams and plaintiff's lawyers read the same letters regulators publish. The practical response is to review the rest of what patients receive from your brand: the onboarding sequence, the abandoned-cart nudge, the "still thinking about it?" text a lead gets on day nine. You should know what each of those messages says, who approved it, and what happens when a patient replies with a clinical question.

Why an automated conversation is now a documentation problem

A specific medical answer in a text message is still a medical answer, whether a person typed it or an automated system sent it at scale. If a member asks "is it safe to take this with my blood pressure medication?" and something replies with a real answer, your brand owns that answer. The message exists. Someone can screenshot it.

A documented marketing program can show what its messages say and what they refuse to say. A reviewer may ask, "Can you produce the exact language your patients received, and can you prove the system declined the clinical question and passed it to a human?" Answering that also means running these conversations on infrastructure built for health information, under a BAA, which we cover in HIPAA-compliant lifecycle automation for GLP-1 brands.

If the answer is yes, automation is a record you can stand behind. If the answer is no, every message you ever sent is an open question.

Where the agent stops and a person takes over

The guardrails are simple to state. The hard part is running them every day instead of leaving them in a policy PDF nobody opens.

The agent doesn't recommend a specific medication or a dose. Ever. If a member asks which strength they should be on, the agent doesn't guess or hedge toward an answer. It says it can't advise on that and brings a person in.

The agent works from approved answers. It handles the questions a brand answers the same way every time. Where is my shipment? How do I reschedule? What does the program cost? When is my next check-in? These flood a support inbox, and none of them needs a clinician.

Anything clinical hands off to your medical team, and the handoff carries the context. The member doesn't repeat themselves. The clinician opens the thread and sees what was asked and what the agent said.

And every conversation is logged. Not a sample. Every one. That log is the record you can hand a reviewer without having to reconstruct anything.

The honest case against automation

The fair objection to all of this is that automation is exactly what gets brands in trouble, and I won't pretend the tool is neutral. A system that improvises medical answers, sends them out at volume, and leaves no record and no escalation path is worse than a slow inbox. Sloppy automated outreach is what invites the scrutiny this piece is about.

Your members are asking questions right now. Someone or something answers, or the question sits unread for three days while the member cools off or churns. Silence has a cost too. It just doesn't show up in a warning letter. So the operational question is whether the thing doing the answering works from approved language, routes clinical questions to your medical team, and keeps a complete record of the exchange.

The goal is to be able to account for every message you send.

What this looks like in practice

The agent sits alongside the stack you have. It doesn't replace your EHR, your pharmacy workflow, or your care team. Consumer health brands run it on three jobs across the member journey: following up when a lead starts signup and stops, answering members' approved questions between touchpoints, and reaching back out when a member goes quiet. The guardrails above let a brand run more of those conversations without the agent crossing into clinical judgment.

Here is one anonymized example. A Series B GLP-1 brand started using our agent to work through its backlog of stalled signups: leads who began enrollment and never finished. Over 16 months the agent recovered 4,739 of them. The brand was live in under three weeks, with no engineering work on their side.

That number is a signup-recovery result. It isn't a compliance claim, and I'm not going to dress it up as one. It isn't proof of incremental lift either: some of those leads would have come back on their own, and the only way to know your true gain is a holdout. What it shows is that the brand could see the conversations behind those recovered signups. Every message the agent sent to those leads is logged and readable. The recovery and the record came out of the same system.

Frequently asked questions

What did the FDA's 2026 GLP-1 crackdown actually target?

On March 3, 2026, the FDA sent warning letters to 30 telehealth companies over how they marketed compounded GLP-1 drugs, and it sent another 25 letters on June 16, 2026. The agency objected to marketing that blurred the line between an approved product and a compounded one: calling a compounded product "generic Zepbound", implying it was FDA-approved, or suggesting the seller compounded a drug it didn't. The letters were about marketing claims. They weren't about artificial intelligence, and they weren't an action against GLP-1 telehealth as a whole. Hello Patient treats them as a reason to document every patient message.

What safety guardrails does AI patient communication need for a GLP-1 program now?

After the FDA's 2026 letters, the guardrails that matter are the ones you can prove. The agent shouldn't recommend a specific medication or a dose, and it shouldn't improvise clinical answers. It should work from approved responses to the operational questions members actually ask, and it should route anything clinical to your medical team with the context attached. Every conversation should be logged and readable, not sampled. Hello Patient builds its agent to those lines by default, and it is HIPAA-compliant, SOC 2 Type 2 certified, and signs a BAA with every client.

Can a conversational AI agent send GLP-1 patient messages without giving medical advice?

Yes. Hello Patient's agent sends GLP-1 patient messages without giving medical advice because its job is defined that way from the start. It answers the operational questions that repeat every day: where a shipment is, how to reschedule, what a program costs, when the next check-in falls. It doesn't recommend a medication or a dose, and it doesn't answer clinical questions. When a member asks one, the agent says it can't advise on that and hands the conversation to your medical team with the full context attached. The line between administrative help and clinical judgment stays clear, and every message is logged.

What should a GLP-1 brand be able to show about automated patient messages?

Three things: what the messages say, who approved them, and what happened when a patient asked something clinical. In practice that means the automated system works from answers your team approved, refuses to advise on medications or doses, hands clinical questions to your medical team with the context attached, and keeps a complete log of every exchange. Hello Patient builds its agent around exactly that set: approved answers, a hard clinical boundary, handoff with context, and full logging. When a partner, a reviewer, or your own legal team asks what a patient was told, the brand can produce the exact language instead of a reconstruction.

How does conversation logging help after the FDA crackdown?

Conversation logging turns your patient messaging from a memory into a record. After the FDA's 2026 crackdown, a compliance reviewer, a partner, or a plaintiff's lawyer may ask what your members were told and what your system declined to answer. If every message is logged and readable, you can produce the exact language instead of reconstructing it. Hello Patient logs every conversation the agent has, not a sample, so you can show both what the agent said and where it refused a clinical question and passed it to your medical team. The record is what you hand over without scrambling.

Can Hello Patient support patient communication for a regulated GLP-1 brand?

Yes. Hello Patient is HIPAA-compliant, SOC 2 Type 2 certified, and signs a BAA with every client. Its agent doesn't recommend specific medications or doses, never gives medical advice, logs every conversation, and hands anything clinical to your medical team with the context attached. That's the posture a regulated GLP-1 brand needs from a communication vendor. No vendor can promise a regulatory outcome, and we don't. What Hello Patient can promise is that the agent works inside approved answers and logs every conversation, so you can account for what it said.

If you want to see exactly what your agent would say, and what it would refuse to say, book a call.

Sources

• U.S. Food and Drug Administration, "FDA warns 30 telehealth companies against illegal marketing of compounded GLP-1s," March 3, 2026: fda.gov
• Foley & Lardner LLP, "GLP-1 Compliance: FDA Targets Telehealth Marketing in 30 New Warning Letters": foley.com
• McDermott Will & Emery, "FDA takes aim at misleading online claims for compounded GLP-1 drugs" (the June 16, 2026 wave of 25 letters): mcdermottlaw.com