Online Age Verification Checklist for Retailers Selling Age-Restricted Products

Selling age-restricted products online requires more than adding an “I am over 18” checkbox to a website.

Retailers need to identify which products are restricted, apply the correct age threshold, verify customers at an appropriate point in the purchase journey, coordinate delivery controls, protect personal data, and retain evidence that the process worked as intended.

The exact requirements depend on the product and jurisdiction. Categories may include alcohol, tobacco and vaping products, knives, fireworks, certain medicines, lottery products, and other locally restricted goods.

This checklist helps online retailers review the complete process, from product listing to delivery.

Why a basic age gate may not be enough  

An age gate usually asks users to enter a birth date or confirm that they are above a stated age. It can discourage accidental access, but it does not necessarily establish that the information is true.

Retailers should distinguish between four related concepts:

• Age declaration: The customer states their date of birth or confirms they meet an age requirement.
• Age estimation: Technology estimates whether someone appears to be above or below a threshold.
• Age verification: A reliable source, credential, or identity document confirms the customer’s age.
• Age assurance: The broader set of methods used to establish a person’s age or age range.

UK trading guidance warns that self-declared birth dates, tick boxes, disclaimers, and payment-card ownership may not provide sufficient positive proof of age when used alone. It recommends selecting checks that are appropriate for the product and the way it is sold.

Online age verification checklist  

1. Identify every age-restricted product  

Start by reviewing the complete product catalog rather than relying only on broad store categories.

• Flag every restricted product at SKU level.
• Record the minimum purchase age for each destination market.
• Identify baskets containing both restricted and unrestricted goods.

The applicable age may vary between products and jurisdictions. A retailer selling internationally should not rely on one global “18+” setting.

Product restrictions should connect to shipping destination, store configuration, fulfilment provider, and checkout logic. When a customer changes their delivery country or state, the applicable rules may also need to change.

2. Map every route to purchase  

Customers may reach checkout through more than one path.

• Review registered accounts and guest checkout.
• Include websites, mobile apps, marketplaces, and subscription orders.
• Test saved baskets, repeat purchases, and alternative payment routes.

Verification should be placed where it prevents unlawful or prohibited sales without creating unnecessary checks for customers who are not purchasing restricted products.

Checking everyone at site entry may add friction too early. Waiting until after payment may create refunds, cancelled orders, and fulfilment problems. For many retailers, verification near checkout provides a better balance, but the correct point depends on the product and applicable rules.

3. Choose a proportionate verification method  

There is no single method that is appropriate for every age-restricted purchase.

• Match the method to the product, jurisdiction, and potential harm.
• Avoid relying only on an unverified birthday or checkbox.
• Define when stronger documentary or biometric evidence is required.

Lower-risk scenarios may permit a reusable digital credential or reliable database check. Higher-risk products may justify government-issued ID verification, especially where the retailer must demonstrate that it took reasonable steps to confirm age.

4. Check that the ID belongs to the customer  

Reading a date of birth from an identity document does not always prove that the person using it is the document holder.

• Validate the document and extracted date of birth.
• Add face matching or liveness where impersonation is a material risk.
• Provide a fallback route for inconclusive checks.

A minor may attempt to use a parent’s, sibling’s, or another adult’s document. Face matching can compare the customer with the portrait on the ID, while liveness detection can help confirm that a real person is present rather than a photograph or replay.

These controls should be proportionate. Not every purchase requires the same level of identity assurance, and no single check eliminates every form of misuse.

5. Connect verification to the order decision  

Age verification should affect whether the order can proceed.

• Prevent restricted orders from being released after a failed check.
• Hold inconclusive cases for review where appropriate.
• Record the result against the customer or order.

A successful payment should not automatically trigger fulfilment when the required age check is incomplete.

Retailers should also test for bypass routes. A customer should not be able to avoid verification by switching from delivery to collection, using guest checkout, creating another account, or purchasing through a less controlled sales channel.

The order-management system should clearly distinguish between verified, failed, expired, and manually reviewed results.

6. Coordinate checkout and delivery controls  

Online verification may not remove the need for a second check when the goods are handed over.

• Confirm whether age must also be checked at delivery or collection.
• Use couriers that support appropriate proof-of-age procedures.
• Define what happens when the intended recipient is unavailable.

UK guidance recommends procedures that require delivery drivers to request valid proof of age where appropriate. It also warns that a third-party courier may not automatically accept responsibility for age verification. The retailer should confirm the service rather than assume it is included.

Some product categories have additional handover requirements. UK guidance for remotely sold bladed products, for example, states that relevant packages must be clearly marked and handed to a person aged 18 or over.

Delivery instructions should address unattended delivery, parcel lockers, collection points, substitute recipients, and failed handovers.

7. Protect customer identity data  

Document-based verification can involve sensitive personal information.

• Collect only the data needed for the stated purpose.
• Restrict access to documents and verification results.
• Set clear retention and deletion periods.
• Review the security practices of verification providers.

A retailer may need evidence that a successful age check took place, but that does not always mean it must store a complete copy of the customer’s identity document indefinitely.

Privacy information should explain why the check is required, what information is processed, who receives it, and how long it will be retained.

8. Maintain evidence and test the process  

An age-verification workflow should be reviewable after the order has been completed.

• Record the product, market, threshold, method, and outcome.
• Document failed and manually reviewed cases.
• Track the version of the rules applied to each decision.
• Retest the process after changes to the store or fulfilment journey.

Testing should cover more than the main desktop checkout. Retailers should review mobile browsers, apps, guest checkout, saved accounts, marketplace orders, subscriptions, returns, replacements, and collection options.

The process should also be reviewed when the retailer launches a product, enters a new market, changes courier, or updates its payment and checkout technology.

Common online age-verification mistakes  

One of the most common mistakes is treating a site-entry pop-up as the retailer’s entire control. It may communicate that the store contains restricted products, but it usually does not prove the purchaser’s age.

Other frequent weaknesses include applying one age threshold worldwide, checking the account holder but ignoring the person receiving the order, and allowing a failed verification to proceed because payment has already been accepted.

Finally, outsourcing verification or delivery does not mean the retailer can ignore how the process works. The business should understand which party performs each check, what happens when it fails, and what evidence is retained.

Example retailer workflow  

Consider an online retailer selling a product restricted to customers aged 18 or over in the buyer’s location.

The customer adds the product to their basket and begins checkout. The store detects the restricted SKU and applicable destination rule, then requests age verification before the order is released.

The customer submits a supported government-issued ID. The system validates the document and confirms that the date of birth meets the threshold. When required by the retailer’s risk policy, the customer also completes a liveness and face-matching check.

A successful result is connected to the order. The package is then assigned to a delivery method that supports age verification at handover. If the online check fails or is inconclusive, the order is stopped or routed for review.

This example is illustrative. The correct procedure depends on the product, location, delivery model, and applicable legal requirements.

US tobacco sales illustrate the need for product-specific rules  

In the United States, federal law prohibits retailers from selling covered tobacco products to anyone under 21. Since September 30, 2024, retailers must use photo identification to verify the age of anyone under 30 who attempts to purchase covered tobacco products. FDA also investigates online sales and has issued warning letters involving unlawful online sales to underage purchasers.

This does not mean the same procedure applies to every restricted product. It shows why retailers need product-specific rules rather than one generic age gate.

How Identomat supports online age verification  

Identomat helps online retailers confirm a customer’s age using government-issued identity documents and configurable verification workflows.

The Age Verification solution can:

• capture and validate supported identity documents
• extract and assess date-of-birth information
• apply configurable age thresholds
• add face matching and liveness where required
• return pass, fail, or review outcomes
• produce verification logs for audit and operational review

Identomat is an all-in-one identity verification and KYC platform, bringing together a wide range of identity verification solutions that can be tailored to your specific workflow needs.

Review your online age-verification workflow  

A defensible process connects product classification, checkout, customer verification, fulfilment, delivery, privacy, and recordkeeping.

Retailers should not add the greatest possible amount of friction to every order. They should use a proportionate method that provides sufficient confidence for the product and jurisdiction while keeping the purchase journey clear for legitimate customers.

Identomat can help retailers verify customer age, configure different thresholds, introduce biometric checks where needed, and maintain consistent verification records.