Which three regimes govern a review?
Generic guidance concerning online reviews addresses one body of law. A pharmacy encounters three, and the two which generic guidance omits are the two most likely to produce difficulty.
Consumer protection law governs whether a review may be solicited, published, selected or aggregated as the business proposes, and since April 2025 that regime has been substantially stricter and considerably better enforced. Medicines advertising law governs the content of what is displayed, since a review naming a prescription medicine and republished by the pharmacy may constitute promotion of that medicine to the public. And professional confidentiality governs the reply, since acknowledging a reviewer's treatment discloses health information about an identifiable person.
A pharmacy may therefore comply entirely with the review platform's own rules whilst breaching all three, which is the reason a marketing function operating without pharmacy input regularly produces material a superintendent would not have approved.
What did the Act ban, and when?
The consumer protection provisions of the Digital Markets, Competition and Consumers Act 2024 came into force on 6 April 2025, and the Competition and Markets Authority published its guidance concerning fake reviews on 4 April 2025. Schedule 20 to the Act lists thirty-two commercial practices treated as inherently unfair and therefore prohibited in all circumstances, irrespective of their effect upon any individual consumer, and several concern reviews.
| Banned practice | What it looks like in a pharmacy |
|---|---|
| Submitting, commissioning or facilitating fake reviews | Staff or family posting reviews, or engaging a service which supplies them |
| Publishing incentivised reviews without disclosing the incentive | A prize draw or discount offered for a review, with the review then displayed without stating that it was incentivised |
| Presenting reviews in a misleading manner | Displaying selected positive reviews, or relying upon feedback which is materially out of date |
| Concealing negative reviews | Filtering, delaying or suppressing unfavourable feedback upon a site the pharmacy controls |
| Misleading star ratings or aggregated information | An average which excludes categories of review, or a rating presented without its basis |
The Authority permitted a three-month adjustment period, during which it focused upon supporting compliance rather than upon enforcement, concluding on 6 July 2025. That period has long expired, and the enforcement position is set out below.
What follows if the pharmacy hosts reviews itself?
Beyond the prohibitions, the Act imposes a positive obligation upon anyone publishing or providing access to consumer reviews, whom the Authority terms a publisher, to take reasonable and proportionate steps to prevent and remove banned reviews and false or misleading review information.
A pharmacy displaying reviews upon its own website, rather than merely linking to an external platform, is a publisher for this purpose, and the obligation is active rather than passive. The Authority's guidance indicates that reasonable and proportionate measures include a published policy which clearly prohibits fake reviews and states the approach to incentivised reviews, risk assessment, proactive detection and investigation of suspicious material, and periodic review of the procedures adopted, whilst recognising that what is proportionate varies with the size and risk profile of the business.
For most pharmacies the practical conclusion is straightforward. Displaying reviews collected and published by an external platform, and linking to them, places the publisher obligation upon that platform. Republishing selected reviews upon the pharmacy's own site brings the obligation, and the selection itself engages the prohibition upon misleading presentation. A pharmacy which wishes to display reviews without acquiring a compliance programme is better served by an embedded feed presenting the platform's full and current picture than by a curated selection assembled by whoever built the website.
How may reviews lawfully be requested?
Requesting reviews remains entirely legitimate and, as the local visibility guide sets out, materially affects whether a pharmacy appears in local results. Three constraints govern how.
Ask everyone rather than the satisfied. Selecting which patients are invited, in order to shape what appears, engages the prohibition upon presenting reviews in a misleading manner. The request should go to patients generally, and a pharmacy which finds that prospect uncomfortable has identified an operational problem rather than a marketing one.
Disclose any incentive. Incentivised reviews are not prohibited, whilst publishing them without clearly disclosing the incentive is. Since disclosure reduces the value of the review considerably, the simpler course for most pharmacies is not to incentivise at all. Where a service specification separately prohibits inducements, as the MenB vaccination arrangements do in respect of free gifts, that restriction applies irrespective of the consumer law position.
Do not condition or steer. Requests which suggest the desired content, or which route dissatisfied respondents into a private channel whilst directing satisfied ones to a public platform, are the mechanism the prohibition upon misleading presentation exists to address. A private feedback route is entirely appropriate, and it should be offered to everybody rather than deployed as a filter.
When does a review become an advertisement?
This is the difficulty which generic review guidance does not address and which pharmacy encounters constantly. A patient writes that a named prescription medicine, obtained through the pharmacy's service, transformed their circumstances. Displayed upon the pharmacy's website, quoted within a social media post or reproduced in a leaflet, that testimonial is material published by the pharmacy which promotes a prescription-only medicine to the public, and the prohibition upon such promotion does not distinguish between the pharmacy's own words and words it selected and republished. The patient may write whatever they wish. The pharmacy determines what it displays. The safe construction follows directly, in that reviews displayed by a pharmacy should concern the service, the staff and the care rather than naming prescription treatments, and where an otherwise excellent review names a medicine it should be left upon the platform rather than promoted onto the pharmacy's own surfaces. This is also why curated testimonial walls attached to prescription services are among the failures our analysis of agency-built pharmacy sites identifies, since the agency applied a pattern which is unremarkable in retail and unlawful here.
Two related points complete the position. Claims within a displayed review are treated as claims the pharmacy makes, such that a testimonial asserting an outcome the licence does not support carries the same difficulty as the pharmacy asserting it directly. And the advertising rules apply across every surface equally, which includes the business profile discussed in the local visibility guide as well as the website.
What of displaying, selecting and aggregating?
Where reviews are displayed, three practices warrant attention because each is ordinary within retail marketing and each is now expressly addressed.
Selection. Displaying a chosen subset, whether by rating or by content, presents reviews in a misleading manner unless the basis of selection is disclosed and the presentation remains fair. A full feed avoids the question entirely.
Currency. Relying upon feedback which is materially out of date is among the practices the guidance identifies, which affects the testimonial page assembled three years ago and never revisited, particularly where the service it praises has since changed.
Aggregation. A star rating or summary figure must not mislead, which means an average excluding categories of review, or presented without indicating what it covers, creates exposure. Where a pharmacy publishes its own figure rather than displaying a platform's, it has assumed responsibility for the calculation.
How should a pharmacy reply?
Replying is good practice, visible to subsequent readers and encouraged by every platform. It is also where the confidentiality difficulty examined in the local visibility guide arises, and it warrants restating because it is the error most frequently made with the best intentions.
A reply which thanks a reviewer for their comments concerning their treatment, or which apologises for a delay to their supply, has confirmed publicly that an identifiable person is a patient and has referenced their care. That the reviewer disclosed the information first does not alter the pharmacy's position, since the pharmacy's confirmation is the pharmacy's disclosure and confidentiality obligations do not lapse because a patient was indiscreet about themselves.
The uniform construction thanks the reviewer, addresses any service matter in general terms, offers a private route for anything specific, and neither confirms nor denies that any individual is a patient. Applied consistently it also resolves the difficult negative review, since a reply declining to discuss an individual's care publicly whilst providing a direct route to address it reads to every subsequent reader as the discretion they would wish extended to themselves.
Negative reviews, and what may not be done
Concealing negative reviews is among the banned practices, which removes several responses which were previously merely unwise.
A pharmacy may not filter unfavourable feedback from a review facility it operates, may not delay publication selectively, and may not construct a system which routes dissatisfied respondents away from the public channel whilst directing others toward it. What a pharmacy may do is reply, correct factual inaccuracy in general terms, and report to the platform any review which breaches that platform's own rules, including material which is defamatory, which identifies staff inappropriately or which is not from a genuine customer.
The distinction is between removing what is unfavourable and reporting what is impermissible, and the second requires the pharmacy to be able to articulate which rule is engaged rather than merely that the review is unwelcome. Where a review concerns a genuine clinical or service failure, the response belongs within the complaints process as well as within the reply, since a review is frequently the first notification a pharmacy receives of an incident it should be investigating.
What is the enforcement position?
It has developed rapidly and in one direction. Following the conclusion of the adjustment period, the Authority reviewed more than one hundred businesses' websites during July 2025 and found that over half could be failing to comply. In January 2026 its Executive Director for Consumer Protection indicated that businesses should expect further action. In March 2026 the Authority opened its first investigations specifically concerning fake and misleading reviews, being the third set of investigations under the Act, bringing the total number of businesses under investigation using the enhanced powers to fourteen, with an update expected in September 2026.
The Authority has additionally stated that it monitors business websites proactively for compliance and has published guidance concerning how to make a consumer law complaint, which increases the likelihood of detection from sources other than its own monitoring.
The penalties available explain why this warrants attention from businesses of every size. The Authority may determine a breach and impose a penalty directly, without first obtaining a court order, of up to ten per cent of global annual turnover, with penalties of up to five per cent available for failures to comply with information requests and daily penalties in addition. A turnover-based penalty is a materially different exposure from the position preceding the Act, and it applies to the same regime which, as our refunds guide sets out, also governs a pharmacy's cancellation and refund information.
What does the compliance position look like in practice?
Six arrangements settle the matter for most pharmacies.
Request reviews from every patient rather than selected ones, through a single standard route. Offer no incentive, or disclose it plainly wherever a review it produced is displayed. Display reviews as a full and current feed from the platform rather than as a curated selection, which avoids both the misleading-presentation prohibition and the publisher obligation. Ensure that nothing displayed by the pharmacy names a prescription medicine or asserts a claim beyond the licence. Reply to everything using a construction which never confirms that an individual is a patient. And route reviews describing service or clinical failures into the complaints and incident processes rather than treating a reply as the whole response.
Where the pharmacy operates its own review facility rather than relying upon a platform, add the published policy, the risk assessment and the periodic review which the publisher obligation contemplates, and consider whether the facility earns that additional burden.
Key takeaways
- Three regimes govern a pharmacy review, comprising consumer protection law over solicitation and display, medicines advertising law over content, and professional confidentiality over the reply.
- Since April 2025 several review practices are automatically unfair, including fake reviews, undisclosed incentivised reviews, misleading presentation, concealment of negative reviews and misleading aggregate ratings.
- A pharmacy displaying reviews upon its own site becomes a publisher, acquiring a positive obligation to prevent and remove banned reviews through a published policy, risk assessment and proactive detection.
- Requests must go to patients generally rather than to those expected to respond favourably, and incentives must be disclosed wherever a resulting review is displayed.
- A testimonial naming a prescription medicine, republished by the pharmacy, may constitute promotion of that medicine to the public, which is why displayed reviews should concern the service rather than the treatment.
- Replies must never confirm that an identifiable person is a patient, irrespective of what the reviewer disclosed, and negative reviews may be replied to or reported but not concealed.
- Enforcement has intensified through 2026, with first review investigations opened in March, fourteen businesses under investigation using the enhanced powers, and penalties of up to ten per cent of global turnover available without recourse to a court.
FAQs
Reviews that survive three regimes.
A review describing a service failure is frequently the first notification of an incident, and it belongs in the complaints process rather than only in a reply. Dataforge PMR captures that route alongside the clinical record, and our publisher builds review display which shows a full current feed rather than the curated wall which the rules now catch.
See Dataforge PMR