In England it is a criminal offence to give cosmetic Botox or dermal filler injections to anyone under 18, and it is also an offence for a business to arrange or book them. That means the age check cannot wait until the client is in the treatment chair. It has to happen at booking, whether the booking comes by phone, online, by WhatsApp or through Instagram DMs, and then again on the day.
What does the 2021 Act actually say?
The Botulinum Toxin and Cosmetic Fillers (Children) Act 2021 came into force on 1 October 2021. It creates two offences that matter to clinics:
- Section 1: it is an offence to administer botulinum toxin, or a filler by injection for a cosmetic purpose, to a person under 18 in England, unless you are an approved person (section 1).
- Section 2: a business owner commits an offence if, in the course of the business, such a treatment is given to an under-18 by someone other than an approved person, or if arrangements are made, in England, by or on behalf of the business owner for that to happen (section 2).
An "approved person" is a registered doctor, or a regulated health professional (nurse, dentist or pharmacist) acting on a doctor's directions. That route exists for genuine medical use and is not a way to offer cosmetic treatment to teenagers.
The second offence is the one that catches clinics out. Government guidance gives "making an appointment, or agreeing via digital or social media to undertake the procedure" as examples of making arrangements, and says a prosecution can follow even if the under-18 never has the treatment, for example because they changed their mind (DHSC guidance for enforcement officers, 2021).
Why does reception matter so much?
Because the government's own worked example is a receptionist. In it, a 16-year-old phones an aesthetics clinic to book nose filler. The receptionist books the appointment without establishing the caller's age. At the appointment, the nurse asks the client's age and refuses to treat. The receptionist says they did not know about the law, and the owner had not told staff or trained them. The guidance concludes that an offence has been committed by the business owner (DHSC guidance, scenario 5).
Note what happened. No under-18 was treated. The nurse did the right thing. The offence was the booking, plus the absence of a system.
What is the defence for a business?
Section 2 gives a business owner a defence if they can prove they "took all reasonable precautions and exercised all due diligence" to avoid the offence. The government guidance gives examples of what that looks like:
| Precaution | What the guidance suggests |
|---|---|
| Age verification | Ask to see an identity card bearing the PASS hologram |
| Staff training | Written procedures for dealing with people who may be under 18, training on them, records of training, regular updates |
| Dual checking | Require proof of age before booking (face-to-face, phone or online), then verify age again on the day |
| Online bookings | Consider age verification systems compliant with PAS 1296:2018 |
| Prompts | Use system or till prompts to remind staff to check age |
The guidance's own example of a successful defence is a business with a strict policy requiring proof of age before any appointment can be booked, properly implemented, that was beaten only by a high-quality fake ID that would fool a reasonable person.
Consent is not a defence. A parent saying they are happy for their 16-year-old to have lip filler changes nothing.
How do you check age on a phone or DM booking?
You cannot see ID down a phone line, so the practical answer is to build the check into the process:
- Ask date of birth for every toxin or filler enquiry, every time, as a standard booking question, not only when someone "sounds young".
- Book a consultation, not a treatment. Cosmetic Botox already needs an in-person consultation with a prescriber first. Make that consultation the point where photo ID is seen and recorded.
- Say so at booking. "We'll need to see photo ID at your consultation" puts off most under-18s before an appointment is made.
- If a caller says they are under 18, do not book. Explain politely that the law does not allow it, even with a parent's permission.
- For online booking, make date of birth a required field for these services, and consider a proper age verification step, as the guidance suggests.
- Check again on the day, before any treatment, and record it.
Write this down as a procedure, train everyone who takes bookings on it, and keep the training records. Those records are your due-diligence evidence.
What about out-of-hours enquiries and DMs?
The guidance is explicit that agreeing to a procedure via digital or social media counts as making arrangements. So the same rule applies to WhatsApp replies at 10pm, Instagram DMs and any automated booking flow. Whoever, or whatever, replies on your behalf is acting for you.
If you use Remi to answer calls and messages when the clinic is closed, set it up to follow the same written procedure as your team: book only the in-person consultation for toxin and filler enquiries, or send your booking link and take a message for a person to review. It never gives clinical advice. You can see how that fits a consultation-first diary on this page about an AI receptionist for aesthetics clinics.
Checklist: under-18 compliance at booking
- Written age-check procedure covering phone, online, WhatsApp and social media bookings
- Date of birth asked for every toxin or filler enquiry
- New clients booked into a consultation, where photo ID is seen and recorded
- Clients told at booking that ID will be needed
- Under-18 enquiries declined politely, with no exceptions for parental consent
- Online booking requires date of birth for these services
- Age checked again on the day before treatment
- Staff trained, training recorded and refreshed
The short version
In England, the 2021 Act makes it an offence not only to inject cosmetic Botox or filler into an under-18, but for a business to arrange or book it, and the government's own example is a receptionist who booked a 16-year-old without asking their age. Parental consent is no defence. Protect the business with a written procedure: ask date of birth at every booking, see ID at the in-person consultation, check again on the day, and train and record everyone who takes bookings, including whatever answers your messages after hours.