Why online pharmacies and prescribing services are high risk
Online pharmacies, digital prescribing services, and aesthetic treatment providers operate in a high-risk regulatory environment because they involve medicines, medical devices, or interventions that may cause harm if accessed inappropriately.
This includes but is not limited to:
• Prescription medicines
• Weight-loss drugs including GLP-1 agonists
• Hormonal treatments
• Cosmetic injectables such as dermal fillers and botulinum toxin
• High-risk over-the-counter medicines
Unless a service is genuinely suitable for users of any age, operators should assume that children may attempt to access it and design safeguards accordingly. In practice, this requires age assurance.
Medicines and age restrictions in the UK
There is no single universal legal minimum age for purchasing medicines in the UK. However:
• Many medicines are not licensed for use by children
• Some medicines are only licensed above specific age thresholds
• Retailers and pharmacies routinely impose minimum age policies
Examples of products commonly restricted by policy or licence include:
• Pain relief medicines such as aspirin, paracetamol, and ibuprofen
• Sleep remedies and stimulant laxatives
• High-caffeine products
• CBD-containing products
Where a business adopts a minimum age policy, it is expected to enforce it. In an online context, this generally requires age assurance. Reliance on payment method alone, including credit cards, does not establish the customer’s age.
Prescription medicines and weight-loss drugs
Prescription-only medicines may only be supplied following a lawful prescribing decision by an appropriately regulated clinician.
For online services, this typically involves:
• Establishing the patient’s age
• Establishing clinical suitability
• Ensuring the prescription is lawful and appropriate
Weight-loss medicines in particular have attracted increased regulatory scrutiny, including around inappropriate prescribing, off-label use, and access by under-18s.
Where a medicine is not indicated for children, or where prescribing to children would require specialist oversight, services must take effective steps to ensure that under-18s cannot obtain it.
Cosmetic procedures and injectables
In England, it is unlawful to provide cosmetic botulinum toxin or dermal filler treatments to under-18s for aesthetic purposes.
Online services offering:
• Remote consultations
• Booking of in-person treatments
• Sale or facilitation of cosmetic injectables
must therefore be able to identify and exclude children.
Age checks based on self-declaration are unlikely to be sufficient where a service enables access to restricted cosmetic treatments.
UK GDPR and health data
Under UK GDPR, personal data relating to health is special category data and attracts heightened protection.
If you rely on consent as a lawful basis for processing personal data, Article 8 requires that users are old enough to give valid consent. In the UK, the digital age of consent is 13.
However, where health data is involved:
• Consent must be valid, informed, and freely given
• If the user is below the digital age of consent, parental consent is required
• In many clinical contexts, consent alone may not be sufficient as a lawful basis
If a service does not know the user’s age and location, it cannot know whether consent is valid. Age assurance is therefore often a prerequisite to lawful processing.
Enforcement and penalties
The ICO can issue assessment notices, enforcement notices, and administrative fines of up to £17.5 million or 4% of global annual turnover, whichever is higher.
Age Appropriate Design Code
The Age Appropriate Design Code, also known as the Children’s Code, applies to any online service likely to be accessed by children under 18 that processes personal data.
For online pharmacies and health services, this reinforces the expectation that:
• Children should not be able to access unsuitable medicines or treatments
• Services must assess physical and psychological risks to children
• Proportionate safeguards must be in place to prevent harm
Where a service is clearly inappropriate for children, effective exclusion of under-18s is expected.
Our view
Online pharmacies, prescribing services, and providers of regulated treatments should assume that children will attempt to access their services unless robust preventative measures are in place.
Age assurance is therefore not an optional enhancement. It is often a prerequisite to:
• Enforcing minimum age policies
• Preventing access to unsuitable medicines or treatments
• Demonstrating compliance with data protection and consumer safety law
Given the clinical and reputational risks involved, we generally recommend at least a standard level of age assurance, with higher levels of rigour for prescription medicines, weight-loss drugs, and cosmetic interventions.
PLEASE NOTE
This website does not constitute legal advice. You should always seek independent legal advice on compliance matters