Age verification for tobacco & vaping
Online nicotine sales face some of the strictest age-verification mandates anywhere — including the US PACT Act's explicit verification and delivery requirements. Stay compliant while keeping checkout smooth.
Book a 20-minute demoNicotine is uniquely regulated online. In the US, federal "Tobacco 21" set the minimum age at 21, and the PACT Act extends to e-cigarettes — requiring age verification at purchase and adult-signature delivery, plus state registration and reporting. The EU's TPD and the UK's rules impose 18+ controls, with the UK moving toward a generational sales ban.
These regimes demand verifiable, auditable age checks — not a checkbox. Xident provides a fast, on-device age signal for the majority of buyers and a documented, auditable verification trail where regulators require proof, all without becoming a store of customer identity data.
Why now
Age-verification law for tobacco & vaping, by country
How the major markets regulate age assurance in this sector — and what each one requires of operators.
| Country | Law / Regulator | Min. age | Requirement | Status |
|---|---|---|---|---|
| United States | Tobacco 21 + PACT Act | 21 | Verify 21+ at sale AND adult-signature on delivery; state registration/reporting. | In force |
| United Kingdom | Tobacco & Vapes legislation | 18 | Age verification for sales; generational sales ban progressing through Parliament. | Phasing in |
| European Union | Tobacco Products Directive (TPD) | 18 | Member states require 18+ verification; cross-border online restrictions. | In force |
| Germany | JuSchG | 18 | Age verification for tobacco/e-cigarettes at sale and delivery. | In force |
| Australia | Vaping reforms (TGA) | 18 | Prescription/pharmacy model for vapes; strict age controls. | In force |
| Canada | Tobacco and Vaping Products Act | 18 / 19 | Age verification online; varies by province. | In force |
- Law
- Tobacco 21 + PACT Act
- Min. age
- 21
- Requirement
- Verify 21+ at sale AND adult-signature on delivery; state registration/reporting.
- Law
- Tobacco & Vapes legislation
- Min. age
- 18
- Requirement
- Age verification for sales; generational sales ban progressing through Parliament.
- Law
- Tobacco Products Directive (TPD)
- Min. age
- 18
- Requirement
- Member states require 18+ verification; cross-border online restrictions.
- Law
- JuSchG
- Min. age
- 18
- Requirement
- Age verification for tobacco/e-cigarettes at sale and delivery.
- Law
- Vaping reforms (TGA)
- Min. age
- 18
- Requirement
- Prescription/pharmacy model for vapes; strict age controls.
- Law
- Tobacco and Vaping Products Act
- Min. age
- 18 / 19
- Requirement
- Age verification online; varies by province.
The cost of getting it wrong
- US: PACT Act violations carry federal penalties; FDA/state enforcement, plus loss of shipping/payment access.
- Carrier refusal — major couriers decline non-compliant nicotine shipments, cutting off fulfilment.
- UK/EU: fines and trading bans for sales to minors; licence/registration loss.
- Test-purchase failures triggering enforcement and brand damage.
How on-device works
How Xident verifies age for this sector
The same privacy-first flow underpins every vertical: clear most users on-device, fall back to documents only when needed, and re-use the credential for returning visits.
Age is estimated on the device
An on-device model runs in the user's browser and estimates whether they clear the required age threshold. No upload, no server round-trip for the image.
Nothing leaves the device
No selfie, no biometric template, no raw frame is transmitted. Only a pass/fail age signal reaches your backend — so there is no biometric honeypot to breach or disclose.
Document fallback only for borderline cases
Ambiguous ages step up to a document check, which is processed for extraction and deleted immediately. Verified users get a reusable age credential, so returning visits resolve with a one-tap Check.
The face never becomes data you hold. That is the difference between meeting an age-assurance duty and becoming the next breach headline.
The benefits
Why operators choose Xident for tobacco & vaping
Meet your age-assurance obligations without becoming a store of biometric or identity data.
PACT-grade, auditable verification
Combine fast on-device age estimation with a document fallback and an auditable result trail, supporting the "verify at sale" requirement with evidence regulators expect.
Configurable Tobacco-21 threshold
The +21 US threshold and +18 elsewhere are applied automatically by jurisdiction — no manual rule juggling across markets.
Reusable age credential — returning users never re-verify
After a user verifies once, returning visits resolve with a token lookup (a "Check") instead of a full re-verification. Conversion stays high and your per-event cost drops up to 80% versus repeating document checks.
Delivery hand-off re-confirmation
Support adult-signature / age-at-delivery requirements by re-confirming a returning user with a quick Check at the doorstep.
Frequently asked questions
Does Xident meet PACT Act age-verification requirements?
Can it enforce 21+ in the US but 18 in Europe?
Do you store the customer's ID?
Related solutions
Ready to verify age the privacy-first way?
Integrate in minutes. Clear most users on-device in seconds. Re-use the credential so returning users never re-verify.
Book a 20-minute demoThis page is provided for general information only and does not constitute legal advice. Age-verification law in this sector changes frequently and varies by jurisdiction. Operators are responsible for confirming their current obligations in each market with qualified legal counsel.