Identity and age verification is where a lot of online pharmacies quietly fall down, and it is one of the first things a regulator looks at. The failure is rarely dramatic — it is a questionnaire that takes a patient's word for who they are and how old they are, in front of medicines that are exactly the ones people have reasons to lie about. This is what good verification looks like, and what the GPhC actually expects.
Why verification is the compliance fault line
Every online prescribing decision rests on the patient being who they say they are, the age they say they are, and telling the truth about their health. Weak verification undermines all three at once, and it does so precisely where the stakes are highest — the medicines liable to misuse, overuse or diversion are the ones people have the strongest incentive to obtain dishonestly.
That is why verification, not the consultation form, is the compliance fault line. Regulators treat it as a proxy for whether a service is fundamentally safe, and a service that gets it wrong is not a service with a minor gap — it is one with a hole under the whole thing.
What GPhC guidance actually requires
The GPhC's guidance for pharmacies providing services at a distance is explicit that online pharmacies must have effective safeguards, including verifying the identity of the person they are supplying. For certain categories of medicine it goes further: the prescriber must make independent, robust checks and cannot rely solely on the answers in an online questionnaire. The point is that some prescribing decisions require the clinician to actively confirm information, not just receive it.
This is guidance with teeth — inspection findings and enforcement action have turned on exactly these expectations. Treat it as the baseline your process has to clear, and document how it does so. For the wider rulebook, see our overview of the superintendent pharmacist's responsibilities.
The medicines that need extra safeguards
The GPhC highlights categories where extra safeguards are expected before prescribing online, including:
- Opioids and other medicines liable to abuse, overuse or misuse.
- Sedatives and medicines with dependence potential.
- Medicines that require ongoing monitoring or management.
- Weight-management medicines.
- Antimicrobials, where inappropriate supply drives resistance.
- Non-surgical cosmetic medicines such as injectables.
For these, a tick-box questionnaire is not a safe basis for prescribing. The prescriber needs to verify the clinical picture independently — for example by contacting the patient, seeking information from their GP with consent, or confirming details another way — and record that they did.
Building an identity and age verification stack
Practically, robust verification combines several layers: a government-issued document check, a liveness or biometric check to confirm the document belongs to the person presenting it, and explicit age confirmation for age-restricted products. Specialist providers such as Onfido, Yoti and Veriff exist precisely because doing this reliably is hard to build well in-house.
The aim is proportionate friction: enough to confirm identity and age with confidence, not so much that legitimate patients abandon the process. Where a product is age-restricted, the age check has to be a genuine gate, not a self-declared date of birth that anyone can type.
The GPhC is explicit: for higher-risk categories — opioids, sedatives, weight-management medicines and others — the prescriber must make independent, robust checks and cannot rely solely on an online questionnaire. If your process for those medicines is a form the patient fills in unaided, it does not meet the standard.
Stopping the multi-order problem
A specific weakness of the online model is that no single pharmacy sees a patient's orders elsewhere. Someone refused at one service can try another, or spread orders across several to accumulate quantities no responsible prescriber would authorise. Verification that only confirms identity does not solve this; the same real person can still game the system.
Mitigations include asking for and using GP details, spotting suspicious ordering patterns within your own service, and applying clinical judgement to quantities and frequency. It is an imperfect defence, but a service that ignores the multi-order problem entirely is one an inspector will notice.
The medicines liable to misuse are the ones people have the strongest incentive to lie about. Verification is not paperwork around the consultation — for those medicines, it is the consultation's foundation.
Getting the data protection side right
Verification generates sensitive personal data, and biometric checks can be special-category data under UK GDPR. That brings obligations: a lawful basis, data minimisation, defined retention, and security around identity documents and biometric results. You cannot collect verification data indefinitely "just in case", and how you handle it belongs in your DPIA.
Get the two disciplines to talk to each other — the verification you need for safe prescribing and the data protection rules that govern it are the same project, not competing ones. See our guides to UK GDPR for telehealth and records and retention.
How PExpo handles verification
PExpo builds identity and age verification into the regulated layer, alongside the prescriber governance that decides when the independent, robust checks the GPhC expects are required. Brands get a verification and prescribing flow designed around the guidance rather than assembled to pass a launch deadline.
That means the harder categories are handled with the safeguards regulators look for, and the data protection side is built in rather than bolted on. See our brand model for the scope, or how UK telehealth services verify patient identity for the mechanics.
Verification is the compliance fault line for online prescribing: get it right and the higher-risk categories become defensible; get it wrong and the whole service is exposed. Combine document and liveness checks, real age gates, multi-order controls and a data-protection footing that holds. See our guides to UK GDPR for telehealth and verifying patient identity.
Frequently asked questions
Is an online questionnaire enough to prescribe restricted medicines?
No. GPhC guidance says that for higher-risk categories — such as opioids, sedatives and weight-management medicines — the prescriber must make independent, robust checks and cannot rely solely on the answers in an online questionnaire.
What counts as robust identity verification?
In practice, a combination of a government-issued document check, a liveness or biometric check confirming the document belongs to the person, and a genuine age gate for age-restricted products. Specialist providers are commonly used because reliable verification is hard to build well in-house.
How do you stop patients ordering across multiple pharmacies?
No single online pharmacy sees a patient's orders elsewhere, so verification alone does not solve it. Mitigations include requesting and using GP details, detecting suspicious ordering patterns within your own service, and applying clinical judgement to quantities and frequency.
