Laws relating to the prescribing and sale of pharmaceuticals are generally made at state level, rather than by the European authorities.
This page currently only applies to online pharmacies serving customers located in the United Kingdom.
UK
The NHS states that there are no legal age restrictions for buying medicines, but some medicines should not be given to children – for example, children under 16 should not take aspirin.
There may be some situations where a retail outlet cannot sell a medicine to a child for their use because the medicine is not licensed for children of that age. For example, some antacid medicines are only recommended for children aged 12 and over.
However, some retail outlets have their own policies that restrict the sale of medicines to children. For example, one supermarket states that:
Customers must be aged 18 or over to purchase the following:
- Sleep remedies
- Stimulant laxatives
- Hemp Seed/CBD containing products
Customers must be aged 16 or over to purchase the following:
- Medicines for pain relief (including aspirin, paracetamol, ibuprofen and any products containing these products, e.g. Lempsip, adult Bonjela etc.) These items will be sold at a maximum of 2 packets or 32 tables per customer
- High caffeine tablets
To enforce such policies in an online pharmacy, age verification is going to be required. It should be noted that even insisting on a credit card being used does not guarantee that the customer making the purchase is over 18.
GDPR (in force today)
If your customers open accounts on your website, you should be sure that your users are at least old enough to give consent for their personal data to be processed, if you rely on consent under Article 8 of GDPR, as a basis for processing some or all personal data you obtain from your users. (Remember, personal data even includes just an IP address.) In the UK, this “age of digital consent” is 13 but it varies between EU member states so if you have users in the EU, you will need to also determine their location and apply the relevant age as part of this check.
You may be dealing with sensitive personal data if you are gaining knowledge of the drugs prescribed to your users, so are more likely to be reliant on consent for permission to process data, so it is even more important that you establish the customer is old enough to give that consent in the country where they are located.
Age Appropriate Design Code (in force today, but grace period in operation in the UK until 2 September 2021)
This requires sites to consider if they could risk the moral, physical or mental well-being of children under 18. And if so, to put in proportional measures to safeguard children and young people.
There is clearly a physical – and potentially mental – risk arising from providing pharmaceuticals to children. Our opinion is that online pharmacies clearly require age verification to be in place to keep children from acquiring drugs which may be unsuitable for their age. The rigor required is a matter for the judgement of the sites concerned – giving consideration to the nature of the content on the site, the number of users under 18 found to be using it, etc. But given the reputational risk if a child is harmed by drugs acquired from your online store, we recommend at least a standard level of assurance. See our page on levels of assurance for an explanation of the methods of age verification that achieve this degree of confidence in an age check.
Online Safety Bill (only draft legislation, not yet passed by Parliament)
Online pharmacies do not generally allow users to interact and share content such as photographs, so they are not likely to be in scope for the Online Safety legislation. But if you do allow for online communities to discuss their conditions etc., then the site may fall within scope.
As Online Pharmacies are “unlikely to be used by Children” they probably do not need to with the further duties applicable. (But remember, children are defined as under 18-years-old.) It is recommended that sites monitor the age of their customers to check they have not become a site that is
- (a) there are a significant number of children who are users of the service or of that part of it, or
- (b) the service, or that part of it, is of a kind likely to attract a significant number of users who are children – where a “significant” number includes a reference to a number which is significant in proportion to the total number of UK users of a service or (as the case may be) a part of a service. (This test is based on evidence about who actually uses a service, rather than who the intended users of the service are.)
Please read our briefing on the Online Safety Bill for further explanation of these new duties.