US online sellers of alcohol, tobacco, vape products, nicotine pouches, cannabis where legal, and other restricted goods face a different problem from ordinary ecommerce. A generic age popup may look familiar, but it does not give a retailer much to show if a state attorney general, ATF, a payment partner, a marketplace, or a carrier asks how underage access is prevented.
The useful model is not "age gate the whole website." It is product-level verification: identify restricted SKUs, verify the buyer at the right point in checkout, keep a narrow audit record, and avoid turning the store into an identity database. Start from the restricted ecommerce age verification overview for category thresholds and checkout vs delivery proof.
Quick answer
- Nicotine (vape, e-liquid, pouches, cigarettes): federal minimum age is 21 (Tobacco 21, December 2019). Remote sales of vaping products fall under the PACT Act, which since March 2021 requires database age and identity verification, adult signature and proof of age at delivery, ATF and state registration, monthly reports, and excise tax compliance. USPS refuses consumer shipments of vaping products.
- Alcohol: 21 everywhere in the US; no single federal shipping rule. Direct-to-consumer shipping is governed state by state (permits, volume caps, wine vs spirits vs beer), and carriers require an adult signature at delivery.
- Cannabis: legal delivery only in specific states, usually with an ID check at checkout and at the door.
- Checkout age verification is the control that stops underage orders being placed and gives you an audit record. It does not replace the delivery, registration, and reporting steps that the PACT Act or a state liquor authority prescribes.
Self-declaration is not a compliance control
An "I am 21+" checkbox can still be useful as a warning, but it should not be the only control for products that require reliable proof of age. Treat it as copy, not verification.
Why restricted-goods ecommerce needs more than a popup
Regulated-product retailers usually have three overlapping duties. They need to block underage buyers before the order is accepted, satisfy category-specific rules such as tobacco or alcohol restrictions, and prove later that a reasonable verification process happened.
Those duties are getting harder because ecommerce no longer fits a simple store-counter model. A single cart can include normal merchandise, vape products, alcohol accessories, and a subscription item. A customer can buy from a phone, ship to a different state, and return next week from a new device. A checkbox cannot handle those conditions.
The exact rule depends on your product, license, shipping route, and customer location, and in the US the two biggest categories are regulated very differently.
What US rules actually require
Vape and tobacco: Tobacco 21 and the PACT Act
The federal minimum age for all tobacco products, including e-cigarettes, has been 21 since December 2019. That sets the threshold your checkout must enforce, but the heavier obligations for online sellers come from the Prevent All Cigarette Trafficking (PACT) Act, which the Preventing Online Sales of E-Cigarettes to Children Act extended to vaping products from March 2021. For anyone selling vaping products remotely to consumers, the ATF's PACT Act guidance lays out what "delivery seller" status means in practice:
- Verify age and identity through one or more commercially available databases, collecting the buyer's full name, birth date, and residential address (15 U.S.C. 376a(b)(4)).
- Ship by a method that obtains an adult signature and proof of age from the signer at delivery.
- Register with ATF (Form 5070.1) and with the tobacco tax administrator of every state and locality you ship into, and file monthly reports of every shipment by the 10th of the following month.
- Comply with state and local law as if the sale happened entirely inside the destination state, including excise taxes, and label packages as containing tobacco products.
- Keep records of each delivery sale until the end of the fourth full calendar year after the sale, available to ATF, state tax administrators, and attorneys general.
- Do not count on USPS: vaping products are nonmailable, so you need a private carrier that offers adult-signature delivery.
Violations can bring fines, civil penalties, and up to three years' imprisonment. Several states layer their own rules on top, from flavor bans to licensing and additional delivery requirements.
A checkout age check is a layer, not the whole PACT Act
The PACT Act prescribes its own verification method and its own record set. A privacy-first age gate at checkout keeps underage orders from being placed and gives you an auditable 21+ result, and that is worth having. It does not by itself satisfy the database verification, the buyer information, the adult-signature delivery, the registration, or the monthly reports. Keep those records separately and treat the checkout gate as the first control in the chain.
Alcohol: 21 everywhere, shipping state by state
Every US state sets the drinking age at 21, so the threshold is simple. Shipping is not. Direct-to-consumer alcohol shipping is a patchwork of state permits, product-type limits (wine is widely allowed; spirits and beer much less so), volume caps per customer, and reporting to state alcohol authorities. Carriers that handle alcohol require the shipper to hold the right licenses and require an adult signature at delivery. Before you build the checkout flow, confirm which states you can legally ship each product category into, because the age gate is pointless for an order that cannot be fulfilled.
Cannabis
Delivery is legal only in specific states, usually under a state-issued license, and typically requires an ID check at checkout and again at the door. Rules differ between medical and recreational markets.
That is why the best checkout flow starts with the catalog, not the age modal.
Build the flow around product-level rules
Start by tagging every product that could trigger an age requirement. Do not rely only on a store-wide setting. Useful fields include product category, required minimum age, allowed shipping states or countries, whether delivery-time proof is required, and whether the product can be mixed with ordinary SKUs in the same cart.
Common examples:
- Alcohol: often 21+ in the US, with state-specific shipping and adult-signature requirements.
- Tobacco and vape: usually 21+ in the US, with stricter online sale and carrier rules.
- Cannabis: age and identity rules depend on medical or recreational status and local law.
- Knives, solvents, adult products, or other restricted items: rules vary by market and category.
Once the catalog is tagged, checkout can make a narrow decision. If the cart has no restricted SKU, no age check is needed. If the cart has a restricted SKU, trigger verification before payment or order placement. If the destination is unsupported, block the order before the buyer wastes time.
Checkout verification vs delivery proof
Checkout verification and delivery verification solve different problems. Checkout verification answers: "Should this order be accepted?" Delivery proof answers: "Was the restricted product handed to an eligible recipient?"
For many retailers, the first one is the control they can implement fastest. The buyer reaches checkout, the store detects a restricted SKU, and the buyer completes a privacy-first age check. The store receives a signed result such as age_verified: true, min_age: 21, and an Audit ID. If the result fails, checkout stops.
Delivery proof is still required for most of these categories. The PACT Act requires an adult signature and proof of age for vaping products, alcohol carriers require an adult signature, and cannabis delivery rules require an ID check at the door. Your ecommerce system should keep those events separate:
- Checkout age verification: before payment or order placement.
- Delivery confirmation: carrier, driver, or fulfillment proof where required.
- Audit record: order ID, product category, threshold, timestamp, verification outcome, and delivery proof reference if available.
Keep the proof narrow
The store does not need to keep the buyer's ID image to prove an age check happened. A verification outcome plus Audit ID is usually a safer operational record.
WooCommerce and custom checkout patterns
For WooCommerce, the cleanest first version is a checkout rule. When the cart contains a restricted product category, the plugin redirects the buyer to verify age and then returns them to checkout. The store stores the outcome and Audit ID against the order. Content gates can use the same model for restricted product pages, wholesale pages, or members-only sections.
For custom ecommerce stacks, the API pattern is similar. The store creates an age verification session, redirects the buyer, receives an authorization code or callback, exchanges it server-side, and then applies the result to checkout logic. That same result can be used to unlock restricted product access, permit payment, or mark the order as age-verified.
Use the plugin when the store runs on WordPress or WooCommerce and the workflow is mostly checkout gating. The AgeOnce WordPress age verification plugin handles product-category rules, the redirect, and storing the result on the order. Use the API when you have a headless storefront, mobile app, marketplace logic, custom seller rules, or multiple touchpoints.
See also: API vs WordPress plugin for age verification.
What to store for audits
Retailers should avoid collecting more age data than they can justify. That is both a privacy issue and a breach-risk issue. The audit record should prove the control happened, not recreate the user's identity.
A practical audit record includes:
- Order ID or cart session ID.
- Restricted product category or SKU group.
- Minimum age threshold applied, such as 18+ or 21+.
- Jurisdiction rule used, if your checkout supports region logic.
- Verification result and timestamp.
- Verification provider and Audit ID.
- Delivery proof reference, if the category needs it.
Do not store raw document images, face photos, full birth dates, or extra identity fields unless a law specifically requires them. For vaping products, the PACT Act does require the buyer's name, date of birth, and address and the delivery signature record; keep those in your order system with a defined retention period, separately from the age-check receipt. For alcohol and other categories, the age result plus Audit ID is usually enough.
How AgeOnce fits the ecommerce workflow
AgeOnce is built for the part of the flow retailers need most: prove the buyer meets the age threshold without forcing the store to hold sensitive documents.
In a WooCommerce setup, the AgeOnce plugin can gate checkout when the cart includes age-restricted products. In a custom stack, the AgeOnce API can sit behind your checkout step or product access rule. In both cases, the store receives a signed age result and Audit ID instead of storing IDs or face images.
For returning buyers, the same model reduces friction. A repeat customer should not need to upload a document every time they buy the same regulated product. A quick reverification or reusable age token can confirm eligibility while keeping the checkout short.
To evaluate the flow before wiring it into checkout, try the AgeOnce demo, review the integration docs, or compare verification volumes on the pricing page.
1
age result per restricted checkout
For most stores, the target is not a full identity profile. It is a reliable age outcome tied to the order and product threshold.
Retailer checklist before launch
Use this checklist before you switch on verification in production:
- Audit your catalog and tag every restricted SKU.
- Define the required age threshold for each product group (21 for nicotine and alcohol in the US).
- Map the states you can legally ship each category into, and block unsupported destinations before checkout.
- For vaping products, complete PACT Act registration with ATF and state tax administrators, set up monthly reporting, and choose a carrier that offers adult-signature delivery.
- Decide whether verification happens at product view, cart, checkout, or all three.
- Add checkout verification before order placement for restricted carts.
- Configure delivery proof where the category or carrier requires it.
- Store only the verification outcome, Audit ID, order reference, and policy version, plus any buyer fields a statute requires, each with a retention period.
- Update your privacy notice and checkout copy.
- Test failed verification, expired token, return-to-checkout, and mobile camera permission flows.
- Add support instructions so customer service can look up an Audit ID without seeing sensitive identity data.
Age verification should feel like a checkout control, not a separate compliance project. The more precisely it follows the cart, the less friction your ordinary buyers see.
Frequently asked questions
No. A checkbox is only self-declaration. For regulated products, retailers usually need a verifiable age check before checkout, and some categories also need adult-signature or delivery-time proof.
Since the 2021 amendment covering e-cigarettes, remote sellers of vaping products must verify the buyer's age and identity through a commercially available database, collect the buyer's name, date of birth, and address, use a delivery method that obtains an adult signature and proof of age at the door, register with ATF and state tax administrators, and file monthly shipment reports. USPS will not carry vaping products to consumers.
Not on its own. A checkout age check keeps underage orders from being placed and gives you an audit record, but the PACT Act prescribes its own database verification, buyer information, delivery, registration, and reporting steps. Treat the checkout gate as one layer and keep the PACT Act records separately.
Many stores need both. Checkout verification prevents underage orders from being placed, while delivery checks or adult signatures may still be required for alcohol, tobacco, vape, or cannabis depending on the jurisdiction.
Yes. A product-level rule can trigger verification only when the cart contains restricted SKUs, so ordinary products continue through checkout without an extra age step.
Store the verification outcome, threshold, timestamp, order or cart reference, and Audit ID. Avoid storing ID images, selfies, dates of birth, or extra personal data unless a law specifically requires it.
Use a signed age token or quick reverification flow. The buyer proves age once, and future purchases can use a fresh result without asking for the same document again.
