Ecommerce Age Verification Policy: Requirements by Category (2026)

Selling alcohol, vapes, knives, aerosols, supplements or any other age-restricted product online puts you in a category where a checkbox is not enough. Regulators, payment processors and carriers each impose their own age check, and a store that fails any one of them loses the order, the chargeback defense, or the merchant account.

This guide covers the categories that actually trigger legal age verification, the US state patchwork and the EU rules that govern minors, what Stripe and the major carriers require in practice, how age gates differ from real verification, and the policy language that holds up when a regulator or processor asks questions. If you need the surrounding documents, generate a policy set for your store and add the age verification section described below, or read our guide to ecommerce legal requirements for the full document checklist.

1. Which Product Categories Actually Trigger Legal Age Verification

Age verification is not a single obligation with a single trigger. Different product categories activate different statutory requirements, and conflating them causes stores to either over-engineer their compliance or, more dangerously, miss a category entirely.

Alcohol is the oldest and most regulated category. Every US state and the District of Columbia treats online alcohol sales as a licensed activity, and nearly all of them require the seller to verify that the buyer is 21 or older before completing the transaction. The EU follows a patchwork of national rules, but the baseline across France, Germany, Ireland, and the Netherlands is 18.

Tobacco and nicotine products, including e-cigarettes and all vaping hardware and liquid, are governed federally in the US by the FDA deeming rule (21 CFR Part 1140 and the Family Smoking Prevention and Tobacco Control Act as amended). The federal floor is 21. In the EU, the Tobacco Products Directive 2014/40/EU, Article 18, requires member states to ensure online sales platforms implement age verification for cross-border purchases.

Vaping and e-cigarettes sit inside the tobacco category for FDA purposes since the August 2016 deeming rule took effect. Many state attorneys general treat vape products as a separate enforcement priority, so a store that handles only e-liquids and no combustible tobacco still carries the full 21+ verification burden.

Knives are more fragmented. The federal Switchblade Knife Act (15 U.S.C. 1241-1245) prohibits interstate sale of automatic knives to persons under 21 in states that ban them, but the age restriction is embedded in state possession laws rather than a single federal floor. California Penal Code 17235 and 21510, New York Penal Law 265.01, and Massachusetts General Laws Chapter 269 Section 10 each define what a minor may not possess, which effectively requires any online seller shipping into those states to apply an age check. In the EU, the UK (post-Brexit) introduced the Offensive Weapons Act 2019, requiring age verification for bladed article deliveries; Germany and several other member states impose similar duties under their weapons laws.

Aerosols are frequently overlooked. California's AB 887 (now codified at Business and Professions Code 22961) prohibits selling aerosol paint containers to anyone under 18. Texas Health and Safety Code Chapter 485 restricts the sale of abusable volatile chemicals, which covers certain aerosol products, to buyers under 18. Any store shipping spray paint, certain cleaning aerosols, or inhalant-risk products into those states needs an age verification step.

Dietary supplements marketed with sexual health, hormone-modifying, or performance claims sit in a gray zone. No federal age floor exists for supplements as a category, but the FTC Act and FDA regulations on labeling create indirect pressure. More practically, major payment processors flag certain supplement categories as restricted, which means the contractual verification duty arrives from your merchant agreement rather than from statute.

Adult content, meaning sexually explicit material, triggers age verification obligations under state obscenity laws and, increasingly, under specific statutes. Louisiana's HB 142 (Act 440, 2022), Texas HB 1181 (2023), and similar laws in Mississippi, Montana, Virginia, Arkansas, and Utah require any commercial website publishing more than 33.3 percent adult content to verify that visitors are 18 or older. These laws are aimed at content publishers but they sweep in ecommerce stores that bundle downloadable adult material with physical products.

Gambling-adjacent products require attention where a product's primary function enables wagering. Loot boxes, certain trading cards sold with randomized prize elements, and sweepstakes merchandise have attracted regulatory scrutiny. Belgium and the Netherlands have explicitly classified randomized loot mechanics as gambling, requiring age verification at 18. In the US, the Wire Act and UIGEA do not directly mandate seller-side age verification, but several state gambling statutes could expose a seller who ships prize-mechanic products to minors.

CBD and hemp-derived products occupy a complicated regulatory space following the 2018 Farm Bill. The Farm Bill removed hemp from the Controlled Substances Act but did not create a lawful pathway for CBD in food or dietary supplements under FDA authority. Many states have added their own age floors: Arkansas, for instance, restricts hemp-derived THC products to buyers 21 and older under Act 629 (2021). Any store selling CBD edibles, high-potency hemp extracts, or delta-8 THC products should apply a 21-plus verification for states that have enacted thresholds, and at minimum an 18-plus screen nationally.

2. The US State Patchwork

The federal government sets floors; states build walls, and sometimes those walls reach into your checkout flow regardless of where your warehouse sits.

The FDA's deeming rule under 21 CFR Part 1140.14 requires that retailers verify purchaser age before completing a sale of any covered tobacco or vaping product. For remote sales, the Prevent All Cigarette Trafficking Act (PACT Act, 15 U.S.C. 376a), amended in 2021 to include e-cigarettes, requires age verification, age-verified delivery, registration with the ATF, and state tax collection. A PACT Act violation carries civil penalties up to 5,000 USD per violation for a first offense and 10,000 USD for subsequent violations. The amendment explicitly covers all nicotine vapor products, so no store selling vape products online can avoid this framework by claiming the products are not cigarettes.

California has created two distinct age-related compliance obligations that affect online stores. The California Age-Appropriate Design Code Act (AB 2273, effective July 2024) requires businesses likely to be accessed by children under 18 to complete a Data Protection Impact Assessment, apply the highest privacy settings by default, and avoid collecting data not necessary to provide the service. It is modeled on the UK Age Appropriate Design Code. A violation of the California AADC carries civil penalties of 2,500 USD per affected child per negligent violation and 7,500 USD per intentional violation. AB 2511, signed in 2024, extends these obligations to cover commercial platforms and adds a requirement that online platforms that sell or facilitate the sale of products in restricted categories implement technical age verification before allowing a minor to complete a purchase.

Texas has a different structure. Texas HB 1181 (2023), codified at Texas Business and Commerce Code Chapter 129A, requires any website that publishes substantial amounts of sexual content to verify the age of Texas users. More directly relevant to general ecommerce, Texas Health and Safety Code 161.0901 requires retailers of tobacco products, including e-cigarettes, to verify that a purchaser is 21 or older at the point of online checkout, and the carrier must confirm age at delivery. Non-compliance can result in permit revocation in addition to civil penalties.

Louisiana takes an especially aggressive enforcement posture. Under Louisiana RS 14:91.14 and the subsequent digital amendments, online sellers of alcohol must use a third-party verification service, not merely a date-of-birth checkbox, to confirm the purchaser is 21 or older. The state Alcohol and Tobacco Control office has sent warning letters to out-of-state ecommerce operators who shipped alcohol into Louisiana without a licensed third-party verification process in place.

Utah's laws on restricted products are sweeping. Utah Code 32B-8a requires direct wine and spirits shippers to verify purchaser age at checkout using a commercially reasonable method and again at delivery via signature. Utah HB 311 (2023) extended similar requirements to online tobacco and vaping retailers. Utah's age verification for adult content sites (SB 287, 2023) requires digital ID verification, not self-declaration, which sets a higher technical standard than most states.

Several states use the three-tier alcohol system to place the age verification obligation on a licensed shipper rather than the seller, which means your legal exposure in those states comes through your shipper-partner agreement, not directly from the state ABC regulator. But if your shipper fails to verify and the state penalizes the licensed party, that party will seek indemnification from you under the shipping agreement. Read those indemnification clauses.

Michigan, Ohio, and Florida require online tobacco retailers to collect and remit state excise taxes and maintain age verification records for a minimum of three years. A record gap is treated as evidence of a non-compliant sale.

3. The EU Picture

EU law approaches age verification as part of a broader child safety and product safety framework, and the obligations operate at multiple levels simultaneously.

The Digital Services Act (Regulation 2022/2065), in force for all platforms since February 2024, is the most significant recent development. Article 28 prohibits providers of online platforms accessible to minors from presenting advertising based on profiling when the platform knows or should know that the recipient is a minor. It further requires that platforms likely to be accessed by minors implement appropriate and proportionate technical and organisational measures to achieve a high level of privacy, safety, and security. The DSA applies directly in all member states without transposition, so any ecommerce store with EU customers is subject to it regardless of where the store is incorporated. The DSA fine ceiling is 6 percent of global annual turnover, and the European Commission can impose those fines directly on very large online platforms. Smaller operators face enforcement by national Digital Services Coordinators, and Germany's Bundesnetzagentur and Ireland's Coimisiun na Mean have both signaled active enforcement intent for 2024 and 2025.

The Audiovisual Media Services Directive (AVMSD), revised in 2018 as Directive 2018/1808, requires member states to ensure that video-sharing platforms and on-demand media services apply effective age verification for content that might seriously impair the physical, mental, or moral development of minors. For ecommerce stores that bundle streamed or downloadable adult video content with physical product purchases, this directive applies. Each member state has its own transposing legislation: the UK passed the Online Safety Act 2023 (technically post-Brexit but setting a standard EU operators watch closely), Germany transposed via the Jugendschutzgesetz as amended in 2021, and France through the ARCOM framework established under the Law of 30 July 2020.

Germany deserves individual attention because of the Jugendschutzgesetz (JuSchG) and the Interstate Treaty on the Protection of Minors in the Media (JMStV). The JuSchG, as amended effective May 2021, applies to online retailers supplying German consumers. Under paragraph 14a and related provisions, commercial distributors of age-restricted media (USK-rated games, age-restricted films, publications on the Bundesprufstelle list) must apply technical age verification before completing a transaction. The KJM (Commission for the Protection of Minors in the Media) has made clear that a self-declared date of birth does not satisfy the technical age verification requirement under German law. A commercially accepted method such as PostIdent, VideoIdent, credit card combined with address verification, or a recognized age estimation service is required. Stores that sell USK 18-rated video games to German customers and use only a checkbox are in direct violation. Penalties under the JuSchG reach 50,000 EUR per violation.

The General Product Safety Regulation (EU) 2023/988, which replaces the General Product Safety Directive from December 2024, includes Article 9 obligations for online marketplaces and direct sellers to ensure that product listings include all safety information, including age restrictions. The Toy Safety Directive 2009/48/EC, currently under revision, sets mandatory labeling requirements for toys unsuitable for children under specified ages, and the European Commission's product safety database records compliance failures. While these instruments do not themselves require online checkout age verification in the same way that content regulations do, a documented pattern of selling age-restricted toys or unsafe products to children can constitute an unfair commercial practice under Directive 2005/29/EC, which carries its own enforcement track.

For CBD specifically in the EU, the Court of Justice ruling in Case C-663/18 (Kanavape, 2020) established that CBD is not a narcotic under EU law when derived from the whole hemp plant, but member states can still restrict sales. France restricts CBD flower sales entirely; Germany requires CBD products with health claims to go through novel food authorization. Age restrictions for CBD in the EU are set at member-state level, ranging from 16 in some jurisdictions to 18 in most.

4. What Payment Processors and Carriers Require in Practice

Your legal compliance with state and federal age verification law does not insulate you from contract-level obligations imposed by the parties who move your money and your packages. These contractual obligations often set a higher or faster-moving standard than statute.

Stripe classifies tobacco, e-cigarettes, and vaping products as restricted businesses under its Prohibited and Restricted Businesses policy. To process payments for these products on Stripe, you must submit to pre-approval review and agree to specific conditions, which include maintaining a compliant age verification system and records of verification. If Stripe discovers that you are selling nicotine products without an approved age verification mechanism in place, it can terminate your merchant account and hold a reserve. The same applies to CBD and hemp products, which Stripe treats as restricted and subjects to case-by-case approval based on jurisdiction of sale and product composition. PayPal's Acceptable Use Policy prohibits transactions involving products that present a risk to consumer safety where age restrictions apply, which in practice means PayPal can freeze funds from alcohol or nicotine sales if its risk team flags the account.

The practical consequence is this: if a chargeback is filed on an age-restricted product sale, and the processor determines you lacked a compliant age verification mechanism at the time of sale, the processor will find in favor of the cardholder under Visa reason code 10.4 or Mastercard reason code 4853, and you absorb the loss plus a chargeback fee typically between 15 and 100 USD per dispute. In categories where chargebacks are frequent, this compounds quickly. More seriously, Visa's and Mastercard's merchant monitoring programs will flag your account if your chargeback ratio exceeds 1 percent (Visa) or 1.5 percent (Mastercard) in any rolling month, which can result in fines from the networks and eventual account termination.

UPS requires an Adult Signature Required service level for shipments of tobacco products, alcohol, and other age-restricted goods shipped under its Terms and Conditions of Service. The carrier verifies age at delivery (21 for alcohol and tobacco, 18 for other restricted categories depending on state) and records the recipient's name, date of birth, and signature. If you ship an alcohol order without requesting Adult Signature Required service, UPS can refuse delivery, return the package at your expense, and potentially suspend your account for the product category under its restricted commodities terms. FedEx operates under a materially identical framework through its FedEx Adult Signature Required option, and its Alcohol Shipping Agreement requires that the shipper has obtained all necessary licenses and that all recipients are of legal drinking age in the destination state.

USPS prohibits the shipment of cigarettes and smokeless tobacco to consumers entirely under the Prevent All Cigarette Trafficking Act and its own Domestic Mail Manual Section 601.10.3. E-cigarettes and vaping products are also prohibited for consumer shipment via USPS as of April 2021. This means if you are selling vape products and using USPS for any portion of your fulfillment, you are in violation of both the PACT Act and the Postal Service's own regulations, exposing you to criminal liability under 18 U.S.C. 1716E in addition to civil penalties.

Carriers also bear their own regulatory obligations. Under the PACT Act, carriers who knowingly transport cigarettes or smokeless tobacco in violation of the Act face penalties. To protect themselves, UPS and FedEx have implemented their own compliance verification steps, including periodic audits of shipper manifests for flagged product categories. If your manifest description does not match a restricted product category but your order contents do, both carriers treat this as a material misrepresentation in their shipping agreements, which voids your coverage under their declared value and liability programs.

For marketplace sellers on Amazon, Walmart Marketplace, and eBay, the platform itself may impose age verification obligations contractually. Amazon's Restricted Products Policy prohibits the sale of electronic cigarettes and related products on its marketplace entirely, regardless of your own verification practices. eBay prohibits tobacco sales to buyers under 18 and requires sellers to state their age verification method in product listings for alcohol-related items. Non-compliance results in listing removal and potential account suspension, which is a revenue impact separate from any regulatory fine.

The operational upshot is that your age verification infrastructure must satisfy the most demanding requirement in this stack: statute, processor contract, and carrier contract simultaneously. Meeting only one of the three creates gaps that enforcement or a single chargeback dispute can expose.

Section 5: Implementation: Age Gates, Verification Methods, and What to Log

A policy document is worth nothing if the technical implementation behind it cannot survive regulatory scrutiny or a carrier audit. The first thing to understand is that an age gate and age verification are not the same thing, and regulators know the difference.

Age Gate vs. Age Verification

An age gate is a screen that asks a visitor to confirm their age, usually by entering a birth date or clicking a button that says "I am 18 or older." It produces no record, checks no identity, and blocks no determined user. Every major regulator now treats a pure age gate as legally insufficient for restricted products. The UK Age Appropriate Design Code explicitly rejects it. Germany's JuSchG (Jugendschutzgesetz), as amended in 2021, requires what it calls "effective" age verification (Article 4, Section 2), which the KJM (Commission for the Protection of Minors in the Media) has interpreted to mean a system that cannot be defeated by entering a false date. California's Age Appropriate Design Code Act (AB 2273, effective July 2024) does not accept self-certification as verification of age for children under 18. For alcohol, the FDA deeming rule and state ABLE regulations treat a checkbox as no verification at all. If you are selling any product in Sections 1 through 4 of the first part of this guide, an age gate alone exposes you to the same liability as having no gate.

Age verification, by contrast, produces a positive confirmation tied to a real identity signal. There are three practical tiers.

Self-declaration means the user enters a date of birth and the system records it, timestamps it, and links it to the account. This is marginally better than a checkbox because it creates an audit trail and shifts some moral hazard to the user. However, self-declaration is legally sufficient only in a narrow set of circumstances: for low-risk supplemental notices (not as the primary barrier), for age-gating marketing email opt-ins in jurisdictions that have not yet mandated technical verification, and for products like certain herbal supplements that require an 18+ notice but carry no federal criminal penalty for a sale to a minor. Do not rely on self-declaration alone for alcohol, tobacco, vape, or firearms accessories.

ID upload verification requires the user to photograph or scan a government-issued ID, which a software layer or human review team then checks against the claimed age. This is legally sufficient for nearly every product category in every US state and EU member state, provided you use a vendor whose process satisfies the specific technical standard in the jurisdiction. Texas Health and Safety Code Section 161.0875 (added by SB 500, the age-verification law for vape products) specifically requires that an online retailer verify age "using an independent, third-party age verification service" and maintain records of each verification. ID upload from a reputable vendor satisfies this. Louisiana RS 14:91.14, covering online pornographic content, requires verification through "a digitized identification card" or comparable method, and civil penalties of up to 10,000 dollars per violation apply for non-compliance.

Third-party age-estimation vendors use facial analysis or device-side signals (browser fingerprinting, credit header data, mobile carrier confirmation) to produce a probabilistic age estimate. These are commercially available from providers like AgeID, Yoti, and Veriff. The EU's Digital Services Act Article 28 calls for "best efforts" proportionate to risk, and recital 71 acknowledges that age estimation using technical means can satisfy the obligation for general platforms. However, for the highest-risk categories (live alcohol sales, vape, adult content sold directly), most EU national regulators and the KJM in Germany require a confirmed identity match, not a probability estimate. Use estimation-layer vendors only as a supplement, or in jurisdictions where the statutory standard is explicitly "reasonable technical measures" rather than a specific methodology.

What to Log

Every verification event should generate a log entry containing: the timestamp in UTC, the user account or session ID, the verification method used, the outcome (pass or fail), the vendor or system version that performed the check, and the jurisdiction of the user based on IP geolocation or shipping address. You do not log the ID document itself unless your vendor stores it in a compliant data vault, because retaining raw ID images creates GDPR Article 9 special-category data obligations in the EU and state biometric privacy exposure in Illinois under BIPA. Log the result, not the document.

Retention periods vary. Texas SB 500 requires records for at least two years. The FDA's deeming rule, 21 CFR Part 1140, does not specify a retention period for age-verification logs explicitly, but FDA enforcement letters have referenced two years as the de facto standard. For EU compliance under the DSA and GDPR, retain logs for the duration of the user relationship plus 12 months, and document your retention policy in your privacy notice. California AB 2273 requires that records supporting a child risk assessment be retained for the lifetime of the product feature, meaning if your age-verification method changes, you archive records of the prior method rather than deleting them.

Section 6: Policy Language: What a Defensible Age Verification Policy Must State

Your public-facing age verification policy should appear as a standalone page on your store, linked from the footer, from every restricted product page, and from the checkout flow. It should not be buried inside a privacy policy or terms of service. The following elements are required.

First, identify the restricted categories and the legal basis for each restriction. A clause that works: "We sell [alcohol / tobacco / vapor products / adult content]. Sale of these products to persons under [21 / 18, specify by category] is prohibited by [cite the specific law: e.g., the Family Smoking Prevention and Tobacco Control Act, 21 U.S.C. Section 387f(d)(3); California Business and Professions Code Section 22963; or applicable state alcohol beverage code]."

Second, describe your verification method in enough detail that a regulator can assess it. A clause that works: "Before completing a purchase of a restricted product, you must verify your age through [name your vendor or method]. We use [Veriff / Yoti / manual ID review, etc.] to confirm that each purchaser is at least [age] years old. Verification is required at the time of account creation for customers who indicate intent to purchase restricted items, and again at checkout if more than 90 days have elapsed since the last verification."

Third, state what happens on failure. "If your age cannot be verified, we will not process the order. We will not retain incomplete verification data beyond 30 days. You may contact [support email] to dispute a failed verification." This clause matters because it shows proactive compliance rather than a passive system that silently rejects orders with no record.

Fourth, address delivery verification separately. "For shipments requiring adult signature under UPS Service Guide Section 6.4 or FedEx Terms and Conditions Article 9, the carrier will collect a signature from a person 21 years of age or older at the delivery address. We cannot waive this requirement. If no qualifying adult is available after [number] attempts, the shipment will be returned and we will refund the product cost less the return shipping fee." Spell out the return handling because inconsistent returns policies on age-restricted products are a documented failure mode (see Section 7).

Fifth, add your marketing and email policy. "We send promotional communications only to subscribers who have completed age verification. If you subscribed before our verification system was implemented, we will ask you to verify before sending restricted-product promotions. You can request removal from our list at any time by [method]." This clause directly addresses CAN-SPAM compliance and, in the EU, GDPR Article 6(1)(a) consent validity, because consent obtained without verifying that the data subject met the minimum age is not valid consent.

Sixth, cover marketplace sales. If you sell on Amazon, eBay, or Etsy in addition to your own store, note: "Our age verification standards apply to sales on third-party marketplaces to the extent the marketplace platform permits. Where a marketplace does not support our standard verification, we restrict our listings to non-age-restricted product variants." This protects you from the argument that your policy is inconsistent because a minor could buy the same product from your Amazon storefront.

Seventh, disclose your data handling for verification records. Cite your privacy policy but also state the retention period directly: "We retain records of successful age verifications for [two / three] years. We retain records of failed verifications for 30 days. Verification records are stored with [vendor name] under a data processing agreement that complies with GDPR Article 28 / California Consumer Privacy Act obligations."

Section 7: Seven Common Failures

Failure 1: No Age Gate at All

This is the most straightforward violation and also the most common for stores that add restricted products incrementally. A store launches selling kitchen knives, adds a vape accessory category six months later, and no one updates the compliance setup. The FDA Office of Compliance has sent civil money penalty complaints to online retailers with no age verification for tobacco or vape products, with penalties starting at 11,182 dollars per violation under the adjusted civil monetary penalty schedule. In state enforcement, Texas DSHS can refer online vape sellers without compliant age verification to the attorney general for injunctive relief. The fix is to audit every product category against the trigger list in Part 1 of this guide and gate every restricted product page before launch.

Failure 2: Gate on the Homepage Only

Some stores place an age gate on the landing page but leave individual product URLs unprotected. A user who navigates directly to a product URL via a search engine or a social link bypasses the gate entirely. Your gate must fire at the session level and at the product page level, and the verification status must be tied to the user's session or account, not to whether they passed through the homepage. Shopify themes that implement age gates through a single homepage script are systematically vulnerable to this failure.

Failure 3: Trusting a Checkbox

As discussed in Section 5, a checkbox that says "I confirm I am 18 or older" creates no verified record. If an FDA inspector or state regulator asks you to produce evidence that a given purchaser was verified, a checkbox produces nothing. Worse, several state laws now explicitly name self-attestation as insufficient: Texas SB 500 requires a "third-party" service, and Louisiana RS 14:91.14 requires a "digitized identification card" or credit card with address match. A checkbox does not satisfy either standard.

Failure 4: No Record Retention

You pass a customer's age verification check at purchase, ship the product, and then delete the log. Six months later, you receive a civil investigative demand from a state attorney general or a chargeback dispute alleging the purchaser was a minor. Without the verification log, you cannot defend the sale. The FDA explicitly expects retailers to be able to produce age-verification records during an inspection. Stores on Shopify often rely on third-party apps that delete event logs when a subscription lapses, or when the app is uninstalled. Before you rely on any third-party verification app, confirm in writing that your records are exportable and are retained for at least 24 months even if you cancel the subscription.

Failure 5: Inconsistent Returns Handling

A minor who is denied at checkout but whose parent or older sibling completes the purchase can simply return the product, and then the family repurchases later. More commonly, a store's return policy does not address whether a returned age-restricted item requires re-verification of the original purchaser. The FTC has flagged inconsistent return handling as a misleading practice when a written policy says verification is required but the returns team accepts returns and re-ships without any check. Your policy must state that any re-shipment of a returned restricted product requires new verification.

Failure 6: Marketing Emails to Unverified Lists

You send a promotional email advertising a new vape flavor to your full subscriber list. That list includes subscribers acquired through a pop-up that asked only for an email address with no age check. GDPR Article 8 provides that consent from a child under 16 (or under 13 in some member states) is not valid without parental authorization. Sending marketing for restricted products to an unverified list also creates exposure under state tobacco marketing laws: California Business and Professions Code Section 22962 prohibits marketing tobacco products to anyone under 21, and "marketing" includes email. Segment your list. Subscribers who have not completed age verification must never receive restricted-product promotions.

Failure 7: Ignoring Marketplace Sales

You run a compliant verification system on your Shopify store but also list the same products on Amazon, where you cannot enforce your own age gate. Amazon's Marketplace policies for tobacco and vape products prohibit listings entirely for most categories, so this failure often manifests as a seller listing a product under a miscategorized SKU to avoid the restriction, or listing in a marketplace that does not enforce its own rules. If you are caught selling age-restricted products through a marketplace without verification, you cannot point to your own website's compliance as a defense. The FDA, state regulators, and carriers look at where the actual transaction occurred. Audit your marketplace listings quarterly and either confirm the marketplace's own verification is legally sufficient in your target jurisdictions or pull the listings.

Section 8: Payment Processors and Carriers

Stripe's restricted business list identifies "age-restricted goods and services" as a category requiring pre-approval through Stripe's legal team. Specifically, Stripe prohibits processing payments for tobacco, e-cigarettes, and vape products sold without a verified age check in the buyer's jurisdiction. If a chargeback is filed and Stripe investigates and finds you have no verification records, Stripe can shift chargeback liability entirely to you and, in repeat-violation scenarios, terminate the account. PayPal's acceptable use policy similarly prohibits transactions involving the sale of tobacco products to minors, and PayPal has closed accounts for violations discovered through chargeback patterns.

The practical consequence is that chargeback liability for an unverified sale is almost always yours. Card network rules under Visa's dispute resolution framework and Mastercard's Chargeback Guide place the burden on the merchant to show that the purchaser was age-verified when a restricted-product dispute is filed. Without a log entry from a third-party verification vendor, you lose the dispute automatically.

UPS requires Adult Signature Required service for shipments of alcohol, which adds a per-package fee and requires the carrier to collect a signature from a person 21 or older. UPS Service Guide Section 6 also restricts tobacco products and e-cigarettes. FedEx suspended residential delivery of cigarettes and smokeless tobacco to comply with the PACT Act, and its policy on vapor products requires compliance documentation from the shipper. FedEx reserves the right to refuse or return any shipment that cannot be verified as compliant.

USPS has prohibited mailing cigarettes and smokeless tobacco to consumers since the PACT Act (15 U.S.C. Section 376a), and the Preventing Online Sales of E-Cigarettes to Children Act (2021) extended that prohibition to electronic nicotine delivery systems. Mailing a vape product through USPS is a federal violation, not just a terms-of-service issue, with criminal penalties for knowing violations.

If your carrier requires adult signature and you do not set that service level for a restricted shipment, the carrier can return the package at your expense, or deliver it without the signature and expose you to PACT Act liability. The cost of the adult signature service is not optional compliance overhead; it is a legal requirement for certain product categories, and the shipping policy page of your store should state it explicitly so customers understand that someone 21 or older must be present for delivery.

Frequently Asked Questions

Does a birth-date entry field count as age verification?

No. A birth-date field is a form of self-declaration, and self-declaration is legally insufficient for tobacco, vape, alcohol, and explicit adult content in any US state with a specific age-verification statute, and in any EU member state that has implemented the AVMSD or JuSchG requirements. It creates an audit-trail record, which is slightly better than a checkbox, but it does not confirm that the person entering the date actually holds that identity. Use a third-party verification vendor for any product category that carries a civil or criminal penalty for sale to a minor.

Can I use Google's age verification tool or an Apple Screen Time block as my compliance solution?

No. Device-side parental controls are the responsibility of the device owner, not the retailer. No US regulator and no EU authority has accepted a retailer's argument that a platform-level age restriction satisfies the retailer's own compliance obligation. Your duty to verify runs from you to the buyer, not from a third-party platform to the buyer's device.

My Shopify app handles age verification. Am I covered?

Only if you have confirmed the following: the app uses a verification method that meets the legal standard in each jurisdiction where you ship, you can export and retain logs for at least 24 months, the app has a data processing agreement that covers GDPR Article 28 if you ship to the EU, and the app gates at the product level rather than only at the homepage level. Many Shopify age-verification apps satisfy none of these conditions. Read the app's documentation and contact the developer in writing before relying on it for compliance.

What do I do if a carrier delivers a restricted shipment without collecting the adult signature I paid for?

File a service failure claim with the carrier immediately and retain the documentation. More importantly, contact the recipient and confirm the product reached an adult. If you cannot confirm this, log the incident as an unverified delivery and consult with counsel about whether you need to report it to the relevant state alcohol or tobacco authority. Some state ABLE agencies require retailers to report known delivery failures. The carrier's service failure does not transfer regulatory liability away from you.

Do I need a separate age verification policy page, or can it go inside my terms of service?

A separate page is strongly preferable and, in several jurisdictions, effectively required. The DSA Article 14 transparency requirements expect age-related restrictions to be "clear and unambiguous" and "easily accessible," which regulators have interpreted to mean a user should not have to read several thousand words of terms to find the age policy. California's AB 2273 requires that privacy and age-related disclosures be "prominent" and "accessible." A dedicated policy page linked from the footer, every restricted product listing, and the checkout flow satisfies these standards. A clause buried on page four of a terms-of-service document does not.

Age verification is one of the few compliance areas where the store owner is exposed on three fronts at once: consumer protection law, payment processing, and carrier liability. Treat the policy as a description of what you actually do, then make the store do it. If the gate, the retention rule and the returns workflow do not match the policy text, the document becomes evidence against you rather than a defense.

Related reading: our subscription cancellation policy guide covers the recurring-billing rules that interact with age verification on subscription products, and the processor policy requirements guide explains what Stripe and PayPal expect to see in your published pages.