Identity verification for online sales of age-restricted goods

What shops that sell age-restricted goods ask of identity checks

A shop that ships tobacco or e-cigarettes to other countries meets two problems at checkout. The buyer must be old enough under the law of the place where the goods will be delivered, not of the place where the shop sits. And the data collected to prove it has to stay narrow: the shop gets an answer, not a dossier. A tick box saying "I am an adult" answers neither.

Checkout has a particular constraint: a buyer who is stopped and asked for a passport is a buyer who may leave. The check therefore has to be quick, on a phone, and it has to ask for nothing that the shop does not need. Where the same buyer returns, the second purchase should not repeat the first. And where the shop sells into several countries, the rule that applies is the rule of the country of delivery, which differs from market to market.

• Compare the date of birth on the document with the minimum age of the destination market.
• Confirm that the buyer is the person on the document.
• Keep the buyer's data out of the callback to the shop system where it is not needed.
• Show the regulator, on request, how the age check works and what it did.
• Compare a returning buyer with a stored reference face.

The flow

1. Destination and registration. Before any age check, your shop decides whether it may supply the destination at all. Under Article 18 it may not supply these products to a Member State where cross-border distance sales are prohibited, and it may start such sales only after it has received confirmation of its registration with the competent authority. Where the destination prohibits the sale or the registration is missing, the order stops here, and a passed age check cannot authorise it. This rule is yours.
2. Checkout. The cart contains a restricted product, so your shop asks for the check before it takes payment. This rule is yours.
3. Start. Your backend creates a session and picks the scenario for the destination market. The buyer continues in the web widget on a phone, or scans a QR code to move from a desktop.
4. Document and age. The buyer photographs an identity document. The date of birth is read from the document and compared with the age window of the scenario, which is configurable from 16 to 100.
5. Same person. The selfie is matched to the document portrait and active liveness confirms a live person.
6. Gate. Your shop reads the session status or receives a webhook, and its own rule lets the order go on to payment or refuses it. The callback can be set up to carry no personal data.
7. Record. Retention is a setting you choose per scenario, and erasure on request is available through the API. The Directive's data rule limits the use of the buyer's data to the purchase, so your system keeps the outcome of the check for that purpose and does not pass it on.
8. Next order. A returning user is compared with a stored reference face.
9. Evidence. The dashboard keeps the session log, reports and export, so the way the check works and the way it was used can be shown.

Where this differs from the marketplace page

The e-commerce and marketplaces page is about knowing the seller. This page is about the buyer, and about a single product class: goods that may be sold only to adults. The check moves from account onboarding to the moment of sale, the rule comes from the destination, and the data left behind is limited by the same law that requires the check.

Modules used

• Age check and the age verification use case.
• Document verification, face verification and liveness.
• Scenario editor for a window per destination market.
• Data controls for retention, erasure and the callback without personal data.
• Dashboard for the session log, reports and export.
• Web SDK and widget with QR hand-off.
• REST API and webhooks.

Regulatory frame

One European Union text: Directive 2014/40/EU of 3 April 2014 on tobacco and related products, in the text published on 29 April 2014. Later amendments are not covered here. Article 18 concerns cross-border distance sales of tobacco products, and Article 20(6) extends it to electronic cigarettes and refill containers.

• Article 18(1) allows Member States to prohibit cross-border distance sales of tobacco products to consumers, and requires Member States that do not prohibit them to have retail outlets register with the competent authorities in the Member State where the outlet is established and in the Member State where the actual or potential consumers are located.
• Article 18(1) also provides that retail outlets may not supply these products to consumers in Member States where such sales have been prohibited, and Article 18(2) provides that they may only start such sales when they have received confirmation of their registration with the relevant competent authority.
• Article 18(4) requires retail outlets engaged in cross-border distance sales to operate an age verification system, which verifies, at the time of sale, that the purchasing consumer complies with minimum age requirements provided for under the national law of the Member State of destination.
• It requires the retail outlet, or the natural person nominated under Article 18(3), to provide the competent authorities of that Member State with a description of the details and functioning of the age verification system.
• Article 18(5) allows retail outlets to process the consumer's personal data only in accordance with Directive 95/46/EC, which the General Data Protection Regulation repealed with effect from 25 May 2018 and whose references it construes as references to itself (its Article 94), so a shop reads the rule today as a reference to that Regulation, provides that the data shall not be disclosed to the manufacturer of tobacco products, to companies in the same group or to other third parties, and provides that the data shall not be used or transferred for purposes other than the actual purchase.
• Article 20(6) provides that Article 18 applies to cross-border distance sales of electronic cigarettes and refill containers.

This block describes the text, not our service. For information; not legal advice.

Sources

• Directive 2014/40/EU of the European Parliament and of the Council of 3 April 2014 on the approximation of the laws, regulations and administrative provisions of the Member States concerning the manufacture, presentation and sale of tobacco and related products, Official Journal text, fetched 27 October 2026.
• Regulation (EU) 2016/679 of the European Parliament and of the Council, Article 94, Official Journal text, fetched 26 October 2026.

Next

Try the interactive tour, read the age verification use case or see the marketplace flow.