FDA takes aim at pharmaceuticals’ social media activity
The FDA is turning its eye towards pharmaceuticals’ social media use. Review the laws and regulations triggering FDA warning letters and how to stay compliant.
Written by a human
In brief:
- Social media platforms create regulatary challenges through character limits, dynamic or user-generated content risks, and difficulty in controlling to whom or where your content is displayed
- Posts or other activities by sales reps, influencers, or prominent employees can easily run afoul of Food and Drug Administration (FDA) regulations
- Companies have a responsibility to submit social media content to the FDA, including dynamic content or comments and responses declaring adverse reactions
Whether it’s monitoring private or ephemeral messages by high-risk employees or archiving and reporting the activity of contracted Digital Opinion Leaders (DOLs) promoting pharmaceutical products, social media creates myriad opportunities for healthcare and life sciences companies to find themselves noncompliant with federal regulations. Over the past year, the FDA has issued a slate of warning letters demonstrating just that. Such letters can signal to regulators a lack of interest in proactive compliance, specifically outlined in the Department of Justice’s (DOJ’s) Evaluation of Corporate Compliance Programs (ECCP), hurting companies down the line when regulators look to judge violations.
Before we get into specific letters and the ways in which sloppy social media use can leave companies vulnerable, we review the laws, regulations, and guidelines most applicable to social media use by healthcare and life sciences companies.
Laws and regulations affecting social media use for healthcare and life sciences companies
Most laws and regulations on social media use previously existed as rules on how companies market their products. What’s new is how regulators interpret social media activity against these laws. Below are the four most common laws and regulations companies run afoul of when using social media platforms.
Guidance from the FDA around proper social media use, along with updated general compliance program guidelines from the US Department of Health and Human Services, can be used by companies navigating the murky waters of social media.
21 CFR Part 202: Requires that any presentation of benefits must be fairly balanced by the inclusion of equally prominent risk information. Character limits and video run times can make it difficult to equally present both benefits and risks in a single post.
21 CFR Part 314: Requires pharmaceutical companies to submit all promotional material to the FDA at time of first use, including digital and social media content. Posts by sales reps and third-party affiliates along with user-generated content blur the lines of liability and can be difficult to capture and report appropriately.
21 USC 352: Defines what makes a drug or medical device misbranded under the Food, Drug, and Cosmetic Act (FDCA). Violation of this standard can trigger the enforcement of a regulation like 21 CFR Part 202.
21 USC 1320a-7b: Commonly referred to as the Federal Anti-Kickback Statute (AKS), this law bars healthcare providers from offering or soliciting remuneration in exchange for medical services or products from healthcare and life sciences companies.
Companies looking to create robust social media use policies should look to FDA guidance on proper social media use for healthcare and life sciences companies. While not social media- specific, the U.S. Department of Health and Human services also updated its compliance program guidance, useful for companies building out compliance policies around social media.
Recent warning letters issued to pharmaceutical companies for improper social media activity
Last year, the FDA issued several untitled letters to pharmaceutical companies for posting false and misleading advertisements via paid influencer posts. One celebrity omitted all risk information in a post, while a video posted by another influencer sped through risk information at a pace the FDA deemed inadequate for the necessary “prominence and readability.”
The first instance, an Instagram post in paid partnership with kaléo Inc., presented efficacy claims for the drug while failing “to communicate any risk information,” a violation of 21 CFR 202. This creates false or misleading advertising within the Federal Food, Drug, and Cosmetic Act (FDCA). Another warning letter was issued to Merz Pharmaceuticals for a video post by a third-party that creates “a misleading impression regarding the safety and effectiveness” of a drug. In the warning letter, the issuing Officer of Prescription Drug Promotion (OPDP) requests a response from Merz addressing the concerns stated and listing all promotional communications for the drug “that contain representations like those described above.”
It’s not just influencers who are under review. In May 2025, the FDA issued Sprout Pharmaceuticals a warning letter for false or misleading claims made by the CEO on her Instagram account. Failure to present risk information is low-hanging fruit for FDA enforcement, but the warning letter is an interesting example of how the FDA is watching social media activity from high-risk employees. The promotional material was also not submitted to the FDA at the time of first use, violating 21 CFR 314. Clearly, there’s need for an updated compliance policy that includes social media use and posts within its data governance strategy.
Direct messages, comment sections, and other challenges posed by social media
Social media use opens new channels of communication that can be difficult to tamp down. Comment sections, direct messages, and repost activity can all trigger reporting requirements or compliance violations.
For example, if a customer comments under a company post with a description of an adverse reaction to their product, that triggers necessary reporting under Title 21 CFR Part 314. If a user were to repost the marketing material with an account of their own adverse reaction or respond to the company via direct message, it could easily go unnoticed and unreported.
Direct messages are another tricky channel for business communications. Sales reps or other client-facing employees may use direct messaging on social media as a way of connecting with customers, prescribing doctors, and other external parties. Such communication can easily switch from casual conversations to a business nature, triggering a recordkeeping obligation.
How proactively companies monitor these channels for improper use might impact the response taken by prosecutors once the offense is known and investigated. Under the DOJ’s ECCP, prosecutors are advised to consider how proactive a company has been in the prevention and detection of misconduct when deciding what, if any, punishment to dispense. Theoretically, a company that has made no attempt to block or monitor business communications on social media platforms may receive more severe punishment than they otherwise would have if they’d self-reported the violative activity.
How to capture, archive, and monitor social media channels
Some of the largest fines ever levied against pharmaceutical companies have come from off-label marketing activities. While a single post or comment won’t incur six-figure penalties, they can indicate pervasive behavior. A durable social media compliance program can alert your team to improper social media use before it snowballs into a long-standing problem. Tools that capture and retain all communications on platforms like X, LinkedIn, and Instagram can help companies meet recordkeeping and reporting requirements as well, ensuring you stay on good standing with federal regulators.
Global Relay oversees and monitors communication data across all channels and archives all your data in one secure place. With greater risks posed by influencer promotions and social media opening more channels of communication with both HCPs and customers, it is crucial that healthcare and life sciences companies implement the tools and tech needed to enhance their compliance strategies and avoid risk.
