Which lines in your catalogue actually need a check

Online pharmacy age verification: what UK law requires

Orders sit in manual review queues at online pharmacies for days at a time because nobody on the team is certain whether one line in the basket needs a check. The basket goes to a supervisor, the supervisor asks the superintendent, and the order waits.

The customer sees none of that. They paid on Sunday evening and by Wednesday they are refreshing a tracking page that still says processing. Some of them cancel and buy the same items from a supermarket that asked nothing at all.

Online pharmacy age verification is the label the trade uses for requirements that come from four separate bodies of law, and only one of them is pharmacy regulation. That is most of why the rules get conflated.

How can an online pharmacy verify a customer’s age in the UK?

An online pharmacy in Great Britain runs two separate duties. The General Pharmaceutical Council requires an identity check appropriate for the medicine being supplied, with no age threshold attached. Hard age limits of 18 come from separate product law covering vapes, nicotine, tobacco, loose blades and butane lighter refills.

Those two duties land in the same basket and are resolved by different evidence. A pharmacy that runs one control for the whole basket will still miss the lines that carry a criminal penalty.

The GPhC asks for identity, and the standard rises with the medicine

The General Pharmaceutical Council’s current guidance for registered pharmacies providing pharmacy services at a distance, including on the internet, dates from February 2025. Across all 30 pages, the word age does not appear.

It asks for this: “For sales or supplies of P and POM medicines, make sure pharmacy staff can check that the person receiving pharmacy services is who they claim to be by carrying out an identity check appropriate for the medicine being supplied.”

Appropriate for the medicine is the operative phrase, and it is a proportionality test. The guidance lists categories that should not be prescribed on a questionnaire alone, among them antimicrobials, medicines liable to misuse, weight management medicines and black triangle medicines.

The guidance gives examples of method, “using an outside credit reference database, or a specific identity-checking service using photo ID verification”. No supplier is named and no technology is mandated. It does not require a certified provider, so the choice sits with the pharmacy, judged against the medicine.

From January 2025 the GPhC prioritises first inspections of online pharmacies within six months of registration. At first inspection 66% met all standards, against 90% of traditional pharmacies, on figures reported by The Pharmaceutical Journal on 18 December 2024.

The hard 18s on a pharmacy website come from elsewhere

Vapes and nicotine products carry a statutory 18. In England and Wales that comes today from regulation 3 of the Nicotine Inhaling Products (Age of Sale and Proxy Purchasing) Regulations 2015, and Scotland legislates separately. Section 10 of the Tobacco and Vapes Act 2026 makes it an offence to sell a vaping or nicotine product to anyone under 18, with a fine at level 4 on the standard scale, and it comes into force six months after Royal Assent, on 29 October 2026. Section 10 sits in the Act’s England and Wales Part, with corresponding provision for Scotland and Northern Ireland in the Parts that follow.

Tobacco and cigarette papers sit at 18 as at August 2026, under section 7 of the Children and Young Persons Act 1933 in England and Wales and section 4 of the Tobacco and Primary Medical Services (Scotland) Act 2010 in Scotland.

Bladed products catch more pharmacy catalogues than operators expect. Section 141A of the Criminal Justice Act 1988 sets 18 for razor blades and other bladed articles. A 1996 exemption order carves out blades permanently enclosed with less than 2 mm exposed, which covers a cartridge razor head. Loose double-edge blades and scalpel blades stay within the 18 rule. Sections 34, 35 and 38 to 42 of the Offensive Weapons Act 2019 require age verification on a remote sale both when the order is accepted and at the point of delivery. They commenced on 6 April 2022 in England and Wales and on 28 June 2022 in Scotland.

The Cigarette Lighter Refill (Safety) Regulations 1999 set 18 as the age of sale for any refill canister containing butane.

Paracetamol and aspirin have no legal age limit

There is no statutory minimum age to buy paracetamol or aspirin in the UK. The March 2025 change many teams remember was voluntary MHRA best practice guidance rather than legislation, and any 16-plus prompt at a till is retailer policy.

The binding constraint is quantity. The MHRA’s March 2025 guidance caps a general sale pack at 16 tablets or capsules and allows a pharmacy to sell packs of up to 32 under the supervision of a pharmacist. It also states that “it is illegal for either general sales outlets or pharmacies to sell more than 100 tablets or capsules of either paracetamol or aspirin in any one transaction without prescription”. Best practice is two packs per transaction, and the guidance tells online sellers that multiple purchases to a single address may be prevented with timed purchasing controls.

Pseudoephedrine and ephedrine work the same way. Regulation 237 of the Human Medicines Regulations 2012, in force since April 2008, makes it unlawful to supply without prescription more than 720 mg of pseudoephedrine or 180 mg of ephedrine, counted across combined products in one transaction. That is a basket-level rule.

Online pharmacy age verification thresholds, line by line

Which checks count as a real age check

Ofcom set out the methods it regards as capable of being highly effective in guidance published on 16 January 2025: “open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation”. Its four criteria are that age assurance be “technically accurate, robust, reliable and fair”, and self-declaration is rejected outright.

That list is a reference point for pharmacy teams. They do not owe the duty behind it. The Online Safety Act 2023 applies to user-to-user services, search services and Part 5 providers of pornographic content. Schedule 1 paragraph 4 exempts a service whose only user-generated content is comments, reviews and ratings on the provider’s own material, which is what an ordinary pharmacy site carries. Any supplier pitching a pharmacy on Online Safety Act compliance is selling to the wrong statute.

Where the threshold is a statutory line, such as the 18 on a vape or a packet of loose blades, the pharmacy has to be able to show how it reached the answer if the sale is ever challenged. Age estimation returns a probability band, so residual risk on a criminal offence stays with the pharmacy.

How to handle a mixed basket at checkout

A single basket can contain a general sale analgesic with a quantity cap, a P medicine that still requires pharmacist supervision even though the transaction is remote, a nicotine product with a hard statutory 18, and a prescription-only medicine that needs a named patient and a prescriber who has had an appropriate consultation.

Gate the whole basket at the strictest standard and the pharmacy pays on every order, in review queue labour and support tickets about delayed dispatch. A customer buying hay fever tablets and asked to photograph a passport usually closes the tab.

The alternative resolves each line at the level it needs. Quantity logic is enough for a general sale analgesic. A nicotine product has to clear a threshold against a held record before anything ships. Pharmacist supervision already applies to P medicines under the Human Medicines Regulations, with an identity check sized to the product. The strongest identity evidence belongs on the prescription line, because that is where the GPhC’s proportionality test bites hardest.

Four things decide whether a provider can support that design: whether one integration resolves an age threshold and an identity check on the same order, what happens to the basket when a check fails, whether the result leaves evidence an inspector can follow, and whether it works for a customer with no passport in the house.

The over-18 flag has a shelf life

From 1 January 2027 the tobacco question stops being whether someone is 18. The Tobacco and Vapes Act 2026 makes it an offence to sell a tobacco product, a herbal smoking product or cigarette papers to a person born on or after 1 January 2009, and the effective threshold moves forward a year every year after. Section 1 carries that offence for England and Wales and commences on 1 January 2027, with corresponding provision for Scotland and Northern Ireland. Vapes and nicotine products stay at 18.

The change matters more to a pharmacy group with a retail estate than to a pure dispensing operation, and the design principle holds either way. Any gate built to return a single over-18 boolean needs rebuilding once the question becomes a comparison against a date of birth. Banks and mobile network accounts already hold one.

Where OneID fits

OneID supplies the identity and age component of a pharmacy checkout and nothing beyond it. It does not prescribe or triage, and it does not perform the independent verification of a person’s information that the GPhC expects on higher-risk medicines. That stays with the pharmacy and the prescriber.

OneID’s identity checks reach GPG45 levels of confidence from medium through to very high, orchestrated across bank records, international electronic identities, a digital wallet and document scanning, so an order that fails one route can be resolved by another rather than dropping into a manual queue. A bank-verified check returns in under 12 seconds. The customer taps through to a bank they already use and lands back on the checkout. OneID supports five of the seven methods Ofcom names, and is listed on the public register of digital verification services held by the Office for Digital Identities and Attributes.

No regulator requires a pharmacy to use a service like this, and the GPhC leaves the choice of method open. The argument for a record-based check is operational. Most orders clear without a person looking at them. An order that does stop reaches the reviewer with a documented result already attached.

Start with the catalogue

Export every SKU and mark each one against four fields: statutory age, quantity cap, supervision requirement, prescription requirement. Most catalogues carry fewer hard age gates than the team assumed. The quantity rules catch more lines and are rarely enforced by the platform. That single pass tells you what your online pharmacy age verification needs to do, and how much of the current manual review queue exists because nobody has written the answer down.

Questions pharmacy teams ask

Does the GPhC require online pharmacies to verify a customer’s age? No. The GPhC’s February 2025 distance guidance requires an identity check appropriate for the medicine being supplied, and the guidance does not mention age at any point. Age thresholds on a pharmacy website come from separate product legislation covering nicotine, tobacco, bladed articles and lighter refills, which the GPhC does not administer.

Is there a legal minimum age to buy paracetamol online in the UK? No. There is no statutory minimum age for paracetamol or aspirin. The March 2025 MHRA best practice guidance is voluntary and sets no age. The legal constraint is quantity: 16 tablets per pack at general sale, up to 32 in a pharmacy under supervision, and an absolute limit of 100 tablets of paracetamol or aspirin in one transaction.

What age do you have to be to buy a vape from an online pharmacy? The customer must be 18. In England and Wales that comes today from regulation 3 of the Nicotine Inhaling Products (Age of Sale and Proxy Purchasing) Regulations 2015, and Scotland legislates separately. From 29 October 2026 section 10 of the Tobacco and Vapes Act 2026 carries the same age of 18 in England and Wales, with a level 4 fine. The generational tobacco measure does not affect vapes.

Does the Online Safety Act apply to an online pharmacy? Generally no. The Act covers user-to-user services, search services and Part 5 pornographic content providers. Schedule 1 paragraph 4 exempts a service whose only user-generated content is comments, reviews and ratings on the provider’s own material, which describes an ordinary pharmacy site. Ofcom’s age assurance methods remain a useful reference standard.

Do online pharmacies in Great Britain need the distance selling logo? No. Since 1 January 2021, sellers based in England, Wales and Scotland have not been required to display the EU common logo, and the MHRA no longer processes new applications in Great Britain. Anyone in Northern Ireland selling medicines to the public via a website must still display it on every page offering medicines for sale.

Can a P medicine be sold online without a pharmacist involved? No. Regulation 220 of the Human Medicines Regulations 2012 requires that a medicine not subject to general sale is sold by a lawfully conducted retail pharmacy business at registered premises, either under the supervision of a pharmacist or in line with regulations 220A or 220B. A remote transaction does not remove that requirement.

References

1. General Pharmaceutical Council, Guidance for registered pharmacies providing pharmacy services at a distance, including on the internet, February 2025 (published 4 February 2025). Full-text check, 7 August 2026: 30 pages, no instance of “age”. Identity check requirement; example methods; categories requiring additional safeguards; reference to the Identity Verification and Authentication Standard for Digital Health and Care Services.
2. The Pharmaceutical Journal, 18 December 2024. GPhC first inspection priority within six months for online pharmacies; 66% of online pharmacies meeting all standards at first inspection against 90% of traditional pharmacies.
3. Human Medicines Regulations 2012, regulation 220 (in force version dated 7 January 2026), legislation.gov.uk. Sale of medicines not subject to general sale.
4. Human Medicines Regulations 2012, regulation 237, in force since April 2008. Pseudoephedrine 720 mg and ephedrine 180 mg limits.
5. MHRA, Best practice guidance on the sale of medicines for pain relief, March 2025. Pack size 16 at general sale, 32 in a pharmacy under supervision, 100 tablet transaction limit, two pack best practice maximum, timed purchasing controls for online sellers. Voluntary guidance.
6. Tobacco and Vapes Act 2026 (c. 18), Royal Assent 29 April 2026. Sections 1 and 10 sit in Part 1, “Sale and distribution: England and Wales”; Part 2 makes corresponding provision for Scotland and Part 3 for Northern Ireland. Section 175(1) brings Parts 1 to 4 into force six months after Royal Assent, on 29 October 2026; section 175(3) instead commences sections 1, 2, 5, 6 and 44(2) and Schedule 7 on 1 January 2027. Section 10 is not in that list, so it commences on 29 October 2026. Extent and commencement verified at legislation.gov.uk, 7 August 2026.
7. Nicotine Inhaling Products (Age of Sale and Proxy Purchasing) Regulations 2015 (SI 2015/895), regulations 3 and 4. Headed “Public Health, England and Wales”; extent verified at legislation.gov.uk 7 August 2026. Scotland legislates separately, including through the Tobacco and Primary Medical Services (Scotland) Act 2010.
8. Criminal Justice Act 1988, section 141A; Criminal Justice Act 1988 (Offensive Weapons) (Exemption) Order 1996, article 2; Offensive Weapons Act 2019, sections 34, 35 and 38 to 42, commenced 6 April 2022 in England and Wales (SI 2022/418) and 28 June 2022 in Scotland (SSI 2022/150).
9. Cigarette Lighter Refill (Safety) Regulations 1999.
10. Ofcom, Guidance on highly effective age assurance and other Part 5 duties, published 16 January 2025. Seven methods; four criteria; rejection of self-declaration.
11. Ofcom, Online Safety Act Explained Q&A, last updated 28 May 2025; Online Safety Act 2023, Schedule 1 paragraphs 4 to 6.
12. GOV.UK / MHRA, Register for the Distance Selling logo, published 16 June 2015, last updated 23 October 2025. Northern Ireland requirement; Great Britain position since 1 January 2021.
13. Office for Digital Identities and Attributes, public register of digital verification services. OneID Limited, service ID 286, certified 12 June 2026, expiry 21 June 2029. Register checked 7 August 2026.
14. OneID, client supplied, August 2026. Five of the seven methods Ofcom lists; bank-verified identity check returning in under 12 seconds; GPG45 levels of confidence medium to very high.
15. Children and Young Persons Act 1933 (c. 12), section 7, “Sale of tobacco, etc. to persons under eighteen”, extent England and Wales, the age raised to eighteen by the Children and Young Persons (Sale of Tobacco etc.) Order 2007 (SI 2007/767); Tobacco and Primary Medical Services (Scotland) Act 2010 (asp 3), section 4(1), which covers “a tobacco product or cigarette papers”. Section 35 of the 2010 Act defines a tobacco product as consisting wholly or partly of tobacco, so herbal smoking products sit outside section 4; section 7 of the 1933 Act does reach smoking mixtures used as a substitute for tobacco. Herbal smoking products come within the generational offence across Great Britain under the Tobacco and Vapes Act 2026, in addition to the 1933 Act position in England and Wales. Sections, definitions, extent and section headings verified at legislation.gov.uk, 7 August 2026.