Does the Online Safety Act require age verification for your online shop?
Lukas Deward
Managing Director, OneGuard GmbH
Usually not. The Online Safety Act 2023 regulates user-to-user services, search services and providers of pornographic content (s. 3, Part 5). An ordinary online shop selling vapes, alcohol or knives is not a regulated service under the Act unless it also runs community features. Your duty to check age comes from product law instead: the Tobacco and Vapes Act 2026, the Licensing Act 2003 and the Criminal Justice Act 1988.
The distinction matters: the two regimes have different regulators, tests and penalties, and the mistake costs money in both directions.
What the Online Safety Act actually regulates
A user-to-user service is "an internet service by means of which content that is generated directly on the service by a user of the service" may be encountered by other users; a search service is one that includes a search engine (s. 3). Part 5 adds providers that publish pornographic content themselves.
The age-assurance duties attach to those services: user-to-user services likely to be accessed by children must use "highly effective" age verification or estimation for the most harmful content (s. 12), and Part 5 providers must do the same for pornography (s. 81). Ofcom enforces, with fines of up to £18 million or 10 % of qualifying worldwide revenue, whichever is greater (Ofcom guide for services).
Nothing in that list is about selling a product. A checkout is not user-generated content; a product page is provider content.
When could a shop be in scope?
Only through features that let customers publish content to each other. Even then, the Act exempts "limited functionality services" where users can only post comments or reviews on provider content, or apply likes, emojis or ratings (Schedule 1, para. 4). Standard product reviews on a Shopify or WooCommerce store fall outside the Act.
A forum, community section, user-to-user messaging or user uploads visible to other customers can change that. If you run anything like it, use Ofcom's Check if the Online Safety Act applies to you tool. Any resulting duties relate to the community feature, not to the products you sell.
Where the real age-check duties come from
For product sales the obligations sit in sector-specific criminal law. The offence is the sale or the handover; the seller's defence is to prove reasonable steps or due diligence.
| Product | Law | Online duty | Penalty (England and Wales) |
|---|---|---|---|
| Alcohol | Licensing Act 2003, s. 146 and s. 151 | Sale to an under-18 is an offence; defence if you asked for evidence of age that "would have convinced a reasonable person". Delivery to an under-18 is a separate offence. | Fine up to level 5, uncapped since 2015 (LASPO 2012, s. 85) |
| Knives | Criminal Justice Act 1988, s. 141A, amended by the Offensive Weapons Act 2019 and the Crime and Policing Act 2026 | Sale to an under-18 is an offence; due diligence defence. The 2026 Act adds a passport or driving licence plus buyer photo at purchase and a courier ID check at delivery (commencement phased by regulations). | Currently up to 6 months and a level 5 fine; rising to 2 years, an unlimited fine or both |
| Vapes and nicotine products | Tobacco and Vapes Act 2026, s. 10 | From 29 October 2026 an offence to sell to an under-18, online retailers included (DHSC). Defence: specified steps (regulations pending) or all reasonable steps. | £200 fixed penalty (s. 37), fine up to level 4 (£2,500), sales ban of up to a year (s. 23) |
| Tobacco | Children and Young Persons Act 1933, s. 7, superseded by Tobacco and Vapes Act 2026, s. 1 from 1 January 2027 | Sale to an under-18 is an offence (due diligence defence). From 2027: no sale to anyone born on or after 1 January 2009. | Fine up to level 4; under the 2026 Act also £200 fixed penalties and sales bans |
For vapes in detail see age verification for online vape shops in the UK; for knives, selling knives online in the UK and US.
Why vendors say the OSA applies to shops
Because "Online Safety Act" is the phrase people search for. "OSA compliant age verification" has become a marketing label that some providers attach to every age-restricted sale, whether or not the Act applies. The standard the Act sets for platforms is a useful benchmark, not a legal requirement for a shop that sells vapes or gin. The risk is misplaced effort: a splash-screen age gate installed to "satisfy the OSA" while the real exposure is a Trading Standards test purchase.
What you should actually do
- Verify at checkout. An "I am over 18" checkbox is not evidence of age. Use a document check with face match, a selfie-based age estimation or a database check. The OneGuard Platform completes a full ID check in under 20 seconds and a Face ID age estimation in under 5 seconds.
- Hold the order. The OneGuard Shopify app and WooCommerce plugin keep the order on hold and update it automatically when the check succeeds.
- Check at delivery. Alcohol already has a delivery offence (s. 151), knives will get courier ID checks under the Crime and Policing Act 2026, and Wales has a prospective offence for handing nicotine products to under-18s. Use age-verified carrier services and disable safe-place delivery.
- Keep records. Log method, result and timestamp per order. OneGuard sends no raw ID images to your shop and deletes ID images, selfies and biometric data after 30 days at the latest.
FAQ
Do I need to register with Ofcom to sell age-restricted products?
No. Ofcom regulates user-to-user services, search services and pornography providers. Selling vapes, alcohol or knives online does not make your shop a regulated service; your duties come from product law and are enforced by Trading Standards and the police.
My Shopify store has product reviews. Is it a user-to-user service?
Normally not. Schedule 1, paragraph 4 exempts services where users can only post comments or reviews on provider content or use likes, emojis and ratings. A forum, community or messaging feature is different; check with Ofcom's tool if you run one.
Is "highly effective age assurance" required for an online shop?
Not by statute. That standard applies to platforms and pornography providers. For product sales the test is whether you took all reasonable steps or exercised due diligence; a check that would meet Ofcom's standard is good evidence for that defence.
Which law applies if I sell vapes and alcohol in the same shop?
Both. From 29 October 2026 vapes and nicotine products fall under s. 10 of the Tobacco and Vapes Act 2026; alcohol stays under s. 146 and s. 151 of the Licensing Act 2003. The minimum age is 18 for both, so one checkout verification plus age-verified delivery covers both. See our pages for vape and tobacco and alcohol and spirits retailers.
This article is not legal advice. Confirm the current position for your products and your part of the UK with a qualified adviser.
See the check your customers would see
Whichever law applies, the practical step is the same: a real age check at checkout that holds the order until it passes. Try the free demo check or contact us about your product mix.