Age verification for online vape shops in the UK: what the Tobacco and Vapes Act 2026 means for you

From 29 October 2026 it is an offence anywhere in the UK to sell a vaping product or nicotine product, including nicotine pouches, to anyone under 18, and the Department of Health and Social Care (DHSC) says this applies to "retailers, including online retailers" (s. 10 Tobacco and Vapes Act 2026, DHSC guidance). In England and Wales an underage sale can be dealt with by a £200 fixed penalty notice or a fine of up to level 4 (currently £2,500) on conviction, and repeat offences can lead to a sales ban of up to a year.

What the Tobacco and Vapes Act 2026 changes for online sellers

The Act received Royal Assent on 29 April 2026 and comes into force in stages:

Note that the Act defines a "vape" without any reference to nicotine, so nicotine-free devices and e-liquids fall under the age-18 rule too (s. 50).

Is there a separate online rule?

No. The Act contains no separate statutory age-check procedure for online sales in England, Wales or Northern Ireland. Section 10 makes it an offence "to sell" to a person under 18, and a sale through a web checkout is a sale.

The defence is the same for a web shop as for a corner shop. Under s. 10(2) you avoid conviction if you prove either that you took the steps "specified in regulations" to verify the customer was at least 18 (those regulations have not been made yet), or that you "otherwise took all reasonable steps to avoid the commission of the offence". Until the regulations exist, "all reasonable steps" is what an online seller relies on. The Local Government Association puts it plainly: "If you sell online, check your age verification and delivery processes against the same rules" (LGA, 23 September 2026).

Two regional points:

• Scotland requires tobacco and nicotine vapour product businesses to operate an age verification policy that triggers whenever a customer "may be under the age of 25" (s. 4B Tobacco and Primary Medical Services (Scotland) Act 2010). Pure despatch premises are excluded from that policy duty (s. 4B(2)); the sale offence still applies.
• Wales has a prospective offence of handing over tobacco or nicotine products to an under-18 on delivery or collection (s. 52 Public Health (Wales) Act 2017). It is not yet in force.

Challenge 25 is not a legal requirement for vapes in England, Wales or Northern Ireland. It is an industry policy that can form part of your reasonable steps (OneID summary).

What "reasonable steps" look like online

A self-declaration checkbox is not a reasonable step. An "I am over 18" tick box or a typed date of birth proves nothing about the person placing the order; a 15-year-old test purchaser passes it in seconds. The same goes for a pop-up age gate; see Shopify age-gate pop-ups versus real ID checks.

Verify at the point of purchase. A document check (passport or driving licence) with a face match, an age estimation from a selfie, or a database check against an authoritative record. Hold the order until it passes.

Age-verified delivery. Use a carrier service that checks ID at the door and disable safe-place, locker and neighbour delivery for vape orders. It matters most in Wales once the delivery offence commences, but it is good evidence everywhere.

Keep records. Log which check ran, when, with what result, tied to the order number. A verification log is what you show a Trading Standards officer.

Write it down as a policy. A short, dated age verification policy (what you check, when you refuse, how you handle suspected proxy purchases) is the first document you will be asked for. Challenge 25 belongs in it.

Trading Standards test purchases and enforcement

Enforcement sits with local weights and measures authorities, in practice Trading Standards (s. 32). Their standard tool is the test purchase by an under-18 volunteer. A test order placed through your checkout and handed to a minor at the door is the same evidence as a sale over the counter.

In Telford, a shop worker who sold a nicotine vape to a 16-year-old volunteer was ordered to pay more than £2,700 in March 2026, his second underage sale within twelve months (Telford & Wrekin Council). From 29 October 2026 the same facts allow a £200 fixed penalty for a first incident, a level 4 fine on prosecution and a restricted premises order after the third relevant offence in two years. For other product categories, see fines for selling age-restricted products online.

How OneGuard fits

OneGuard gives an online vape shop the evidence it needs for the "all reasonable steps" defence.

• ID scan, face match and liveness. The customer photographs an official ID document and takes a short selfie. OneGuard matches the face to the document photo and checks for a live person. A full automatic verification usually takes under 20 seconds.
• Face ID age estimation. With Face ID, OneGuard estimates the customer's age from a selfie in under 5 seconds. Only if the estimate is not clearly above 18 does the document check follow.
• Order hold until verified. The Shopify app and the WooCommerce plugin keep the order on hold until the check succeeds, then update it automatically. Reminder e-mails nudge customers who have not finished.
• Human review for unclear cases. Failed or ambiguous results are re-checked manually.
• Privacy by design. Your shop never receives raw ID images or selfies. ID images, selfies, videos and biometric raw data are deleted after 30 days at the latest. You keep the result and timestamp as your record.

The same checks are available over the OneGuard Platform API for custom storefronts. For vape-specific flows, see our page for vape and tobacco retailers.

FAQ

Do I need age verification to sell vapes online in the UK?

Yes. From 29 October 2026 selling a vaping or nicotine product to an under-18 is an offence under s. 10 of the Tobacco and Vapes Act 2026, and DHSC guidance states that this covers online retailers. Your protection is the statutory defence: proving you took all reasonable steps to verify the customer's age.

Is a tick-box age gate enough?

No. A checkbox or self-typed date of birth verifies nothing, and it is hard to call that "all reasonable steps" when document checks and age estimation are readily available.

What is the fine for selling vapes to under-18s?

In England and Wales a £200 fixed penalty notice (s. 37 and s. 40), or on summary conviction a fine of up to level 4 on the standard scale, currently £2,500 (s. 10(5)). In Northern Ireland the fine is up to level 5; DHSC says a £250 fixed penalty is planned. Repeat offences at the same premises can lead to a sales ban of up to a year (s. 23).

Does the generational ban apply to vapes?

No. The generational ban in s. 1 applies from 1 January 2027 to tobacco products, herbal smoking products and cigarette papers sold to anyone born on or after 1 January 2009. Vapes and nicotine products stay at a fixed minimum age of 18.

Do nicotine pouches count?

Yes. DHSC guidance lists nicotine pouches, nicotine strips and nicotine pearls as nicotine products covered by the age-18 rule from 29 October 2026, including synthetic nicotine. Nicotine-free vapes are also covered because the Act defines a "vape" without reference to nicotine.

Does the Online Safety Act apply to my vape shop?

Normally not. The Online Safety Act 2023 regulates user-to-user services, search services and providers of pornographic content, not ordinary online shops. Your duty for vapes comes from the Tobacco and Vapes Act 2026. We explain the difference in Does the Online Safety Act require age verification for your online shop?.

This article is not legal advice. Check the current commencement regulations and guidance for your part of the UK and take advice on your specific setup.

Try the check before 29 October

See how a OneGuard verification feels from the customer's side: try the free demo check. Questions about Shopify, WooCommerce or the API? Contact us or compare plans on the pricing page.