Shopify age verification: popup vs. ID check — which one keeps you compliant in 2026?

A Shopify age verification popup does not verify anything. It records that a visitor clicked "I am over 18". If you sell vapes, alcohol, knives or other restricted goods, UK, US and German law expects you to take reasonable steps to establish the buyer's age, and in several cases to check an ID document and the person holding it. Only an ID check with liveness, or an equivalent method, does that.

Why Shopify's native tools are not an age verification

Shopify ships no age verification feature. What you get out of the box is a password page, theme sections, custom Liquid and the App Store. Every "age gate" built from those parts, whether a theme popup, a cart-page checkbox or a relabelled form field, works the same way: the visitor declares an age and the shop believes them. Nothing is compared with a document, a database or a face.

The checkout itself is hosted by Shopify. Theme code does not run there, and checkout UI extensions on the information, shipping and payment steps are limited to Shopify Plus (shopify.dev). That is why serious verification apps run directly after checkout and hold the order while the check happens.

The methods compared

The first three methods never establish who is ordering, so they cannot show that you took reasonable steps. The delivery check is mandatory in several markets, but it does not replace the check at the time of order.

What the law expects by market

United Kingdom. For vapes and nicotine products, the Tobacco and Vapes Act 2026 makes selling to under-18s an offence from 29 October 2026, with a defence only if you took the steps specified in regulations or "otherwise took all reasonable steps" (s. 10); underage sales attract a £200 fixed penalty notice (s. 37). For alcohol, the Licensing Act 2003 covers remote sales and offers a defence only where the seller "had taken all reasonable steps to establish the individual's age" (s. 146). For knives, the Crime and Policing Act 2026 goes furthest: online sellers must check a photographic ID document plus a current photograph of the buyer, and the courier must check photo ID at the door (gov.uk factsheet). That is a document-plus-selfie check written into law; commencement is being phased in by regulations. See our guides on UK vape shops and selling knives online.

United States. Online vape, cigarette and smokeless tobacco sellers fall under the PACT Act. Before accepting an order you must verify the buyer's name, date of birth and address against a commercially available database built primarily from government sources, and ship with a method that requires an adult of at least the minimum age, 21 under federal law, to sign and show photo ID (15 U.S.C. § 376a(b)(4)). Civil penalties run up to $5,000 for a first violation and $10,000 for each later one, or 2 % of gross sales if that is higher (15 U.S.C. § 377). Alcohol and knife rules are set state by state.

Germany. The Youth Protection Act bans mail-order sales of tobacco, nicotine products and e-cigarettes, including their containers, to minors unless technical measures ensure that nothing is shipped to under-18s (§ 10 JuSchG, § 1 Abs. 4 JuSchG). In March 2026 the Federal Court of Justice held that even an empty replacement tank needs an age check and that shipping without one is an unfair commercial practice competitors can sue over (BGH, I ZR 106/25). Fines reach €50,000 (§ 28 JuSchG). Our vape and tobacco and alcohol and spirits pages list the thresholds.

How an ID-check app works on Shopify

The OneGuard app from the Shopify App Store attaches verification to the order rather than to the storefront. The Shopify integration works like this:

1. Checkout as usual. The customer pays through the normal Shopify checkout. No theme changes, no checkout customisation.
2. Verification after checkout. If the order contains a restricted product, a guided popup takes the customer through the check: ID document front and back, face match against the document photo, liveness check. The automatic verification usually takes under 20 seconds.
3. Order hold. Affected orders stay on hold in Shopify until a successful result arrives. You set a cancellation window, for example 3 to 14 days.
4. Reminders. Customers who abandon the check receive a daily reminder until they finish or the window closes.
5. Manual review. Failed and inconclusive automatic results are checked again by a real person, so a blurry photo does not cost you a genuine customer.
6. Release. Once verified, the order is released for fulfilment. Shopify never receives raw ID images, selfies or biometric data; OneGuard deletes them after 30 days at the latest.

Shops with higher volumes can switch on Face ID, the selfie age estimation step: a clear estimate above the threshold finishes in under 5 seconds, and only borderline results go on to the full ID check. Everything runs on the OneGuard platform, which also exposes the flow through an API and webhooks.

Conversion: keeping the check short

Any check adds friction; there is no honest way around that. What you can control is how long it takes, how often it triggers and how many genuine customers get stuck.

• Trigger per product, not per store. Only orders containing restricted items should start a verification.
• Keep it short. Under 20 seconds for a full ID check, under 5 seconds for Face ID.
• Keep results usable. More than 99.5 % of OneGuard checks return a usable result; unclear cases go to manual review rather than an automatic decline.
• Speak the customer's language. The flow is available in more than 13 languages.

Checklist before you install an app

1. List every restricted SKU and the minimum age for each market you ship to.
2. Confirm which markets need a delivery-stage check on top of the order-stage check (UK knives, US vapes, German alcohol).
3. Ask the vendor what the check actually proves: a click, a database match or a live person holding a genuine document.
4. Check that the app holds the order rather than only showing a popup.
5. Ask where raw images are stored, who can see them and when they are deleted, and whether unclear results get a human review.
6. Place a test order with a restricted product and watch what happens to fulfilment, e-mails and your 3PL.

FAQ

Is Shopify's age verification popup legally sufficient?

No. A popup or checkbox records a self-declaration. The UK defences in the Tobacco and Vapes Act 2026 and the Licensing Act 2003 require "all reasonable steps" to establish age, the US PACT Act requires a database check plus adult-signature delivery, and German courts expect a reliable check at order and handover.

Does Shopify have built-in age verification?

No. Shopify offers no native age verification feature. Merchants use theme popups, custom code or an app from the Shopify App Store. Only an app that verifies age or identity and holds the order until the result is in gives you evidence for a regulator.

What is the difference between age verification and ID verification?

Age verification establishes that a person is above a threshold, for example by estimating age from a selfie. ID verification establishes who the person is by checking a government document and matching the face to it. OneGuard combines both: Face ID clears obvious adults in seconds, and the ID check with liveness covers everyone else.

Will an ID check hurt my conversion rate?

Some customers will abandon a check. The levers that matter are triggering only for restricted products, a flow under 20 seconds, manual review for unclear results and reminders for customers who stop halfway. Compared with a fine or a delisting, a short post-checkout check is the cheaper option.

Which Shopify plan do I need?

OneGuard installs from the Shopify App Store and works with standard Shopify plans. Because verification runs after checkout, it does not depend on the checkout customisation reserved for Shopify Plus. The integration page lists the current setup steps.

This article is not legal advice.

Ready to replace the popup? Install the OneGuard app from the Shopify App Store, or try the demo to see a full ID check in under 20 seconds.