Nobody audits your marketing on a schedule. It gets read once, by one person, for one reason — and by then it has been public for years.
A result didn't match what the website promised. The complaint goes to the state board, and the board reads the page the patient read.
The practice down the road knows exactly what you claim, because they watch your site. Reporting a competitor is free and anonymous.
Regulators run sweeps by service category. Nobody is looking for you specifically until the day they're looking at everyone offering what you offer.
In all three, the trigger isn't something you did this week. It's a sentence that has been sitting on your services page since the site was built — written by a marketer who wasn't thinking about the FDA, and approved by nobody who was.
Everything on this page in brief — how a compliance problem actually starts, and why the trigger is usually a sentence that has been on the site for years.
Last week we scanned 27 med spa and aesthetic practice websites across Ohio and Pennsylvania — chosen only because they came up in a search for their own city. We don't name them, and none of them asked us to look.
The worst had 51 findings. The best — a genuinely well-run site — still had a handful. These are normal practices with normal marketing, and not one of them is trying to break a rule. That's the point: this is what ordinary aesthetic marketing looks like when someone finally reads it against the rulebook.
Not a fine on day one. A process — and the process is the cost.
A complaint, a submission, or a sweep puts your page in front of someone whose job is to read it carefully.
Regulators typically ask you to respond within a set number of days — explaining your claims, or correcting them. The clock starts whether or not you have counsel.
This is where the money goes. Not a penalty — professional fees, urgently, on someone else's timetable. You are paying for compliance either way; the only question was whether you paid before or after.
FDA warning letters are published on FDA.gov. State board actions appear in the license lookup patients use to check you. Both are indexed by search engines, and neither expires when the matter is resolved.
The remediation at the end is almost always the same edit you could have made voluntarily, quietly, for nothing.
In 2018 FDA wrote to manufacturers of energy-based devices being marketed for gynecologic uses. The wording is worth reading, because it's FDA describing its own files:
"we have conducted a review of our files, and have been unable to identify any Food and Drug Administration (FDA) clearance or approval for the [devices] as currently marketed…"
Those letters are still published today, seven years on, with the company names on them. When we scanned Pennsylvania practices this week, we still found sites advertising that exact indication.
We won't put a dollar figure on the right-hand column, because it varies and anyone quoting you a precise number is guessing. But the shape is not in doubt: the same correction costs more after someone asks for it than before.
Everything you've published, reviewed once
Because the risk comes back every time you post
An audit fixes what's there now. Monthly is what stops it coming back — because the finding we remove in January is replaced by a new one in March, written by someone who never read the report. If you only take one, take the one that keeps working.
Posting is the whole risk and your website is fine? Preflight is $49/month. Prefer to do it yourself? The handbook has every rule in it, and what you pay for it comes back as credit.
Your score and sample findings in about a minute. No card, no call.
Scan my websiteAutomated screening for educational purposes — not legal advice, and not a prediction that any regulator will act. The scan statistics above are from our own reviews of publicly available websites, conducted in August 2026; practices are not identified. Findings marked for escalation should be reviewed by qualified healthcare counsel.