Can pharmacies ask for and display patient reviews?

Which three regimes govern a review?

Generic guidance on online reviews covers one body of law. A pharmacy faces three. The two that generic guidance misses are the two most likely to cause trouble.

Consumer protection law governs how you may ask for, publish, select and aggregate reviews. Since April 2025 that regime has been substantially stricter and considerably better enforced. Medicines advertising law governs the content of what you display: a review naming a prescription medicine, republished by the pharmacy, may count as promotion of that medicine to the public. And professional confidentiality governs the reply, because acknowledging a reviewer's treatment discloses health information about an identifiable person.

A pharmacy can therefore follow the review platform's own rules to the letter while breaching all three. That is why a marketing team working without pharmacy input regularly produces material a superintendent would not have approved.

What did the Act ban, and when?

The consumer protection provisions of the Digital Markets, Competition and Consumers Act 2024 came into force on 6 April 2025. The Competition and Markets Authority published its guidance on fake reviews on 4 April 2025. Schedule 20 to the Act lists thirty-two commercial practices treated as inherently unfair, and so prohibited in all circumstances — whatever their effect on any individual consumer. Several concern reviews.

The Authority allowed a three-month adjustment period, focused on supporting compliance rather than enforcement, which ended on 6 July 2025. That period has long expired. The enforcement position is set out below.

What follows if the pharmacy hosts reviews itself?

Beyond the prohibitions, the Act imposes a positive duty on anyone publishing or providing access to consumer reviews — the Authority calls them a publisher. They must take reasonable and proportionate steps to prevent and remove banned reviews and false or misleading review information.

A pharmacy displaying reviews on its own website, rather than merely linking to an external platform, is a publisher for this purpose. The obligation is active, not passive. The Authority's guidance says reasonable and proportionate measures include a published policy that clearly prohibits fake reviews and states the approach to incentivised ones. They also include risk assessment, proactive detection and investigation of suspicious material, and periodic review of the procedures adopted. What is proportionate varies with the size and risk profile of the business.

For most pharmacies the practical conclusion is straightforward. Display reviews collected and published by an external platform, and link to them, and the publisher obligation sits with that platform. Republish selected reviews on your own site and the obligation is yours — and the selection itself engages the ban on misleading presentation. If you want to display reviews without acquiring a compliance programme, an embedded feed showing the platform's full and current picture beats a curated selection assembled by whoever built the website.

How may reviews lawfully be requested?

Requesting reviews remains entirely legitimate. As the local visibility guide sets out, it materially affects whether a pharmacy appears in local results. Three constraints govern how.

Ask everyone rather than the satisfied. Choosing which patients you invite, to shape what appears, engages the ban on presenting reviews in a misleading manner. The request should go to patients generally. A pharmacy that finds that prospect uncomfortable has identified an operational problem, not a marketing one.

Disclose any incentive. Incentivised reviews are not prohibited — publishing them without clearly disclosing the incentive is. Disclosure considerably reduces the value of the review, so the simpler course for most pharmacies is not to incentivise at all. Some service specifications separately prohibit inducements, as the MenB vaccination arrangements do for free gifts. That restriction applies whatever the consumer law position.

Do not condition or steer. Some requests suggest the desired content. Others route dissatisfied respondents into a private channel while sending satisfied ones to a public platform. Both are exactly what the ban on misleading presentation exists to address. A private feedback route is entirely appropriate — offer it to everybody rather than using it as a filter.

When does a review become an advertisement?

Two related points complete the position. Claims within a displayed review are treated as claims the pharmacy makes. A testimonial asserting an outcome the licence does not support carries the same difficulty as the pharmacy asserting it directly. And the advertising rules apply across every surface equally — including the business profile discussed in the local visibility guide, as well as the website.

What of displaying, selecting and aggregating?

Where reviews are displayed, three practices deserve attention. Each is ordinary in retail marketing, and each is now expressly addressed.

Selection. Displaying a chosen subset, whether by rating or by content, presents reviews in a misleading manner unless the basis of selection is disclosed and the presentation remains fair. A full feed avoids the question entirely.

Currency. Relying on feedback that is materially out of date is among the practices the guidance identifies. That catches the testimonial page assembled three years ago and never revisited — particularly where the service it praises has since changed.

Aggregation. A star rating or summary figure must not mislead. An average that excludes categories of review, or is presented without saying what it covers, creates exposure. Where a pharmacy publishes its own figure rather than displaying a platform's, it has assumed responsibility for the calculation.

How should a pharmacy reply?

Replying is good practice, visible to later readers and encouraged by every platform. It is also where the confidentiality difficulty examined in the local visibility guide arises. It bears restating, because it is the error most often made with the best intentions.

A reply thanking a reviewer for comments about their treatment, or apologising for a delay to their supply, publicly confirms that an identifiable person is a patient. It also references their care. That the reviewer disclosed the information first does not alter the pharmacy's position. The pharmacy's confirmation is the pharmacy's disclosure. Confidentiality obligations do not lapse because a patient was indiscreet about themselves.

The uniform reply thanks the reviewer, addresses any service matter in general terms and offers a private route for anything specific. It neither confirms nor denies that any individual is a patient. Applied consistently, it also resolves the difficult negative review. A reply that declines to discuss an individual's care publicly, while providing a direct route to address it, reads to every later reader as the discretion they would want for themselves.

Negative reviews, and what may not be done

Concealing negative reviews is among the banned practices. That removes several responses which were previously merely unwise.

A pharmacy may not filter unfavourable feedback from a review facility it operates. It may not delay publication selectively. And it may not build a system that routes dissatisfied respondents away from the public channel while directing others toward it. What a pharmacy may do is reply, correct factual inaccuracy in general terms, and report to the platform any review that breaches that platform's own rules. That includes material which is defamatory, identifies staff inappropriately or is not from a genuine customer.

The distinction is between removing what is unfavourable and reporting what is impermissible. The second requires the pharmacy to say which rule is engaged, not merely that the review is unwelcome. Where a review concerns a genuine clinical or service failure, the response belongs in the complaints process as well as the reply. A review is frequently the first notification a pharmacy receives of an incident it should be investigating.

What is the enforcement position?

It has developed rapidly, and in one direction. After the adjustment period ended, the Authority reviewed more than one hundred businesses' websites during July 2025. It found that over half could be failing to comply. In January 2026, its Executive Director for Consumer Protection said businesses should expect further action. In March 2026, the Authority opened its first investigations specifically into fake and misleading reviews — the third set of investigations under the Act. That brought the total number of businesses under investigation using the enhanced powers to fourteen, with an update expected in September 2026.

The Authority has also said it proactively monitors business websites for compliance. It has published guidance on how to make a consumer law complaint, which increases the likelihood of detection from sources beyond its own monitoring.

The penalties available explain why this deserves attention from businesses of every size. The Authority may determine a breach and impose a penalty directly, without first obtaining a court order, of up to ten per cent of global annual turnover. Failures to comply with information requests carry penalties of up to five per cent, with daily penalties in addition. A turnover-based penalty is a materially different exposure from the position before the Act. And it applies to the same regime which, as our refunds guide sets out, also governs a pharmacy's cancellation and refund information.

What does the compliance position look like in practice?

Six arrangements settle the matter for most pharmacies.

Request reviews from every patient rather than selected ones, through a single standard route. Offer no incentive, or disclose it plainly wherever a review it produced is displayed. Display reviews as a full and current feed from the platform, not a curated selection — that avoids both the misleading-presentation ban and the publisher obligation. Make sure nothing displayed by the pharmacy names a prescription medicine or asserts a claim beyond the licence. Reply to everything with a form of words that never confirms an individual is a patient. And route reviews describing service or clinical failures into the complaints and incident processes, rather than treating a reply as the whole response.

Where the pharmacy runs its own review facility rather than relying on a platform, add the published policy, the risk assessment and the periodic review the publisher obligation expects. Then consider whether the facility earns that extra burden.

Key takeaways

FAQs