Most store owners running age-restricted products online discover compliance problems the same way: a letter from a regulator, a failed mystery shop audit, or a chargeback dispute that surfaces a missing age check in the transaction record. By that point, the exposure already exists. The fine or license suspension is just the confirmation.
This guide covers what age verification actually requires in practice — not what a checkbox on a payment processor form implies, but what regulators expect to see when they look at how you’re selling alcohol, vaping products, CBD, adult content, or firearms online. The difference between those two things is where most compliance gaps live.
The checkbox problem
A date-of-birth entry field and a self-attestation — “I confirm I am 18 or older” — satisfy exactly nothing in most regulated markets. They exist because they’re easy to implement and easy to point to. They don’t constitute verification of anything.
In the UK, the Gambling Commission’s age verification standards require that customers are positively verified before they can deposit or play — not after a grace period, not with a self-declaration. The US is messier: age verification requirements for alcohol vary by state, with some states requiring carriers to verify age at delivery and others placing the burden entirely on the seller. Vaping products sold online in the US are subject to FDA regulations that require third-party age verification at the point of sale. In the EU, adult content platforms operating in member states covered by the Digital Services Act face age assurance requirements that make “tick a box” legally insufficient by definition.
The common thread: regulators are increasingly specific about what “reasonable steps” means, and self-attestation doesn’t make the cut in most product categories where the stakes matter.
What category you’re in changes what you owe
Age verification requirements aren’t uniform across product types, and mixing them up creates its own compliance risk. The thresholds, methods, and documentation standards differ enough that what satisfies alcohol regulations may not satisfy gambling ones, and what works for vaping may fall short for firearms.
Alcohol and tobacco: Most jurisdictions require age verification at point of sale, with many also requiring carrier confirmation at delivery. In practice this means your checkout flow needs a positive verification step, your shipping instructions need to trigger ID checks on delivery, and your records need to show both. Several US states require delivery personnel to scan a physical ID — a process your e-commerce checkout can’t substitute for.
Vaping and CBD: The FDA’s PACT Act brought online vaping retailers under the same requirements previously applied to tobacco: age verification at the point of sale, shipping only via carriers that verify age at delivery, state tax reporting, and customer lists available to tax authorities on request. CBD sits in a separate regulatory category that varies considerably by jurisdiction, but platforms selling any product marketed for age-restricted use are increasingly expected to verify rather than rely on buyer representations.
Gambling: The strictest verification standards of any category. The UK requires positive age and identity verification before a customer can deposit. Several EU member states require operators to verify identity before a player can access any real-money product at all. The consequence of getting this wrong isn’t just a fine — it’s license exposure in the jurisdiction where the breach occurred.
Adult content: Age verification for performers has been a legal requirement in many markets for years. Age verification for consumers is catching up: the UK’s Online Safety Act 2023 includes requirements for “robust” age verification on platforms publishing pornography, and similar legislation is moving through several US states and EU member states. “Robust” is a deliberate word choice — it means document verification or equivalent, not date of birth.
Firearms Online sales in the US require the buyer to complete the federal background check process through a licensed dealer before taking possession, which effectively builds age verification in. But marketplaces selling accessories or ammunition operate in a murkier space, and the burden of demonstrating that a buyer meets age requirements sits with the seller.
What “reasonable steps” actually means in an audit
When a regulator reviews a compliance failure in an age-restricted category, the question they’re asking is whether the operator took steps that could reasonably have been expected to prevent a minor from accessing the product. The answer to that question comes down to documentation and process design.
Three things consistently make the difference between a warning and an enforcement action:
Audit trail per transaction: Every verified customer session should produce a record showing what was checked, when, and what the outcome was. Self-attestation produces no useful audit trail. Document verification produces a timestamped record that can be produced to a regulator on request. The difference becomes obvious when you’re sitting in front of an inspector explaining a sale that went wrong.
Verification before access, not after: “Verify first, fulfill later” sounds obvious but a surprising number of platforms still allow customers to browse, select, and even checkout before a verification step appears. In most regulated categories, the verification needs to happen before any restricted content or product is delivered, not as an afterthought. Some platforms have learned this lesson from enforcement actions; others are still learning it.
What happens when verification fails? The failure path matters as much as the success path. If a document is rejected, what does your system do? If a customer submits a low-quality image that can’t be read? If the name on the document doesn’t match the billing name? Platforms that can show a regulator a coherent failure-handling process look like they took compliance seriously. Platforms that have no documented answer to these questions look like they were hoping not to get caught.
What to look for in an age verification solution
The technical requirements for age verification have converged enough that most platforms claiming to offer it cover the basics: document OCR, a liveness check to confirm a real person is present, and some form of age extraction from the document data. The differences that affect compliance outcomes are less obvious.
Document coverage is one. A solution that covers a narrower set of documents will produce more failures among users with passports, national IDs, or driving licenses from jurisdictions outside the primary markets. Those failures either push the user out of the flow entirely — abandonment you can’t recover — or create pressure to add a manual fallback that introduces inconsistency into your audit trail. The verification process also needs to account for document fraud, since altered or counterfeit identification can undermine an otherwise well-designed age-checking process.
Human review capacity is another. Automated systems handle the straightforward cases. The edges — damaged documents, unusual ID formats, lighting conditions that affect image quality — end up either failing or routed for review. If review goes back to your internal team, you’ve created an operational dependency. Platforms that maintain their own 24/7 review layer keep those cases inside the verification workflow instead of pushing them back to you.
Integration surface matters more than it sounds. If your product runs on Shopify, WooCommerce, or a similarly common e-commerce stack, a native plugin is more reliable than a custom API build that requires ongoing maintenance. Custom builds introduce points of failure that native integrations don’t, and they put the compliance risk on your engineering team rather than the platform’s.
Billing model affects the real cost of compliance at scale. Most verification platforms charge per completed attempt — every session that goes through the flow costs the same regardless of whether the document is rejected, the session is abandoned, or the user passes. At meaningful rejection rates, that model adds up quickly. Platforms that charge only on successful verification — the pay-per-approved model used by some age verification software providers — produce a cost structure that’s more predictable and more aligned with compliance outcomes rather than attempt volume.
The compliance gap most operators don’t notice until it’s too late
Most compliance failures in age-restricted e-commerce aren’t the result of operators who didn’t care — they’re the result of operators who implemented something at launch, never revisited it, and didn’t notice when regulatory standards moved. A checkbox that was acceptable practice five years ago may be an enforcement target today. A verification step that met standards in one jurisdiction may not meet them in a new market where the business recently expanded.
The practical implication: age verification isn’t a setup task. It’s a recurring review. As the markets you sell into change their requirements — and they are changing, consistently, toward stricter standards — the question isn’t whether you have something in place. It’s whether what you have in place still meets the bar.
Regulators aren’t yet coordinated enough to surface every failure, which is why many operators assume they’re compliant longer than they are. The ones who find out differently usually find out at the worst possible time. Building the audit trail now — document-based verification, timestamped records, a coherent failure-handling flow — is the operational equivalent of fixing the roof before it rains.