Age Verification Laws for Adult, Vape and Alcohol Sellers: Federal and State Requirements

Age verification rules vary across adult websites, vape shops, alcohol retailers, and cannabis dispensaries. Some businesses must check identification before a sale, while others must verify a visitor's age before granting website access. State laws can also determine which verification methods are acceptable and what customer data may be retained.

For regulated brands operating across multiple markets, an effective process must account for the product, jurisdiction, and sales channel. This guide covers major federal requirements and selected state examples, alongside considerations for marketing in regulated industries.

Key Takeaways

• Age verification depends on the industry and jurisdiction: Covered adult-content websites commonly verify users are 18 or older, while tobacco and alcohol sales generally require customers to be at least 21
• State requirements can go beyond federal baselines: Alabama requires approved ID scanning at covered specialty vape retailers, and Utah revised alcohol ID-checking requirements in March 2026
• Privacy rules matter as much as verification methods: Some adult-content laws prohibit retaining identifying information, and a September 2026 court order blocked part of Utah's location-related amendment
• Herb Agency supports eligible marketing for regulated brands: Paid media, SEO, editorial content, and first-party audience development can support acquisition within industry-specific restrictions
• Herb Agency connects acquisition with retention: Herb Mail and Herb Dashboard support consent-based engagement and measurable campaign performance beyond the initial verification step

Understanding Federal and State Age Verification Requirements

The United States does not have one age verification rule that applies to every age-restricted product or website. Federal tobacco rules establish nationwide retail requirements, while state laws govern many adult-content websites, alcohol transactions, and cannabis purchases.

Selected State Requirements

• Louisiana: R.S. 9:2800.29 requires covered adult-content websites to use reasonable methods to verify users are at least 18
• Texas: Chapter 129B covers qualifying adult websites and certain publicly accessible tools for creating artificial sexual material harmful to minors
• Florida: Section 501.1737 requires covered adult-content websites to offer both anonymous and standard age-verification options
• Virginia: Section 8.01-40.5 permits qualifying commercial databases or other commercially reasonable methods for covered adult websites
• Alabama: State rules require approved electronic ID scanning for everyone entering a covered specialty vape retailer
• Utah: Its 2026 changes distinguish alcohol ID-checking rules by license type, while a September court order affects a specific adult-site location provision

These examples illustrate how requirements differ. This is not a complete state directory.

Age Verification Methods: Photo IDs, Digital Credentials and Online Checks

Verification methods depend on the transaction and applicable law.

Common Verification Options

• Government-issued ID: A driver's license, state ID, passport, or another document accepted under the relevant rule
• Electronic ID scanning: Technology that reads identifying details or checks authenticity and age, where accepted or required
• Commercial database checks: Services that compare submitted information with qualifying records
• Digital credentials: Mobile IDs or age-confirmation credentials accepted by the relevant jurisdiction
• Facial age estimation: Technology that estimates age from an image without necessarily confirming identity
• Third-party verification: A provider verifies eligibility and returns an age-confirmation result to the business

Facial age estimation and credit-card ownership should not be assumed to satisfy legal age or identity verification. Acceptance varies, and additional privacy or biometric-data rules may apply.

Adult-Content Website Age Verification Laws

Covered adult websites may need to confirm a visitor is at least 18 before permitting access to material legally classified as harmful to minors. Coverage and retention rules vary.

Texas: Adult Websites and Certain AI-Generated Content Tools

Texas Chapter 129B requires covered commercial websites containing more than one-third sexual material harmful to minors to verify access by adults. It permits digital identification or qualifying commercial verification using government ID or transactional data.

A September 2025 amendment also expanded age verification to certain publicly accessible tools for creating artificial sexual material harmful to minors, including defined AI-generated material involving recognizable real people. Exceptions apply to services with qualifying policies and technical safeguards.

Businesses and verification providers covered by the statute cannot retain identifying information obtained through the required checks.

Florida, Louisiana and Virginia

Florida's 2026 statute requires qualifying sites to give users a choice between anonymous and standard age verification. The anonymous option has specific third-party and privacy requirements.

Louisiana permits specified digital identification or commercial age-verification systems, while Virginia allows qualifying database-based or other commercially reasonable age and identity checks. Coverage varies by state.

Utah: What the September 2026 Injunction Changes

Utah's 2026 law requires qualifying adult-content websites to perform reasonable age verification. It also added an actual-location provision addressing visitors physically in Utah who disguise their location through VPNs or similar tools.

On September 24, 2026, a federal court preliminarily enjoined the actual-location provision, Utah Code Section 78B-3-1002(3). The order did not invalidate the underlying age-verification requirement. Other provisions remain relevant.

Potential Penalties and Privacy Obligations

Texas authorizes potential civil penalties of up to:

• $10,000 per day for covered age-verification violations
• $10,000 per instance for prohibited retention of identifying information
• An additional $250,000 if a qualifying violation results in one or more minors accessing prohibited material

These are statutory ceilings, not automatic charges. For adult brands developing marketing strategies, age verification affects website access, audience targeting, and conversion flows.

Vape and Tobacco Age Verification Requirements

Federal Tobacco 21 rules prohibit sales of covered tobacco products, including e-cigarettes and e-liquids, to people younger than 21.

Federal FDA Rules

The FDA's retail guidance specifies that tobacco retailers must:

• Sell covered tobacco products only to customers aged 21 or older
• Check photo identification for customers under 30 who attempt to purchase tobacco products
• Follow vending-machine restrictions in facilities where people under 21 may enter
• Comply with applicable product-specific sales and advertising requirements

Federal rules do not mandate scanning nationwide.

Alabama: Mandatory Scanning for Specialty Vape Retailers

Alabama's specialty retailer rules, effective October 13, 2025, require covered electronic nicotine delivery system retailers to:

• Restrict entry to people aged 21 or older
• Scan every entering patron's driver's license or nondriver ID using approved third-party software
• Retain evidence that a scan occurred and its result without retaining or selling the patron's personal data in the scanning system

These rules do not apply to all smoke shops nationally.

Online Vape Sales and the PACT Act

The PACT Act imposes additional registration, reporting, age-verification, labeling, delivery, and recordkeeping rules on covered remote sellers of electronic nicotine delivery systems. Sellers must comply with applicable state and local restrictions, and USPS mailing of these products is generally prohibited subject to limited exceptions.

Nicotine marketing strategies must account for channel restrictions even when the underlying retail business is properly licensed.

Alcohol Age Verification and State Retail Rules

The minimum legal purchase age for alcohol is 21 across the United States. States regulate licensing, acceptable identification, retail checks, delivery sales, and permitted operating hours.

California: Checking Identification

The California Department of Alcoholic Beverage Control explains acceptable identification and provides guidance on spotting altered or borrowed IDs. Sellers can refuse a transaction when adequate proof of age is unavailable and may apply stricter internal checking policies.

Utah: March 2026 Changes to ID Checks

Utah updated its alcohol identification rules on March 18, 2026. The Department of Alcoholic Beverage Services distinguishes requirements by license type:

• Bars and taverns: Must check and electronically scan every patron's ID before entry, regardless of apparent age
• Off-premise beer retailers: Must check ID for every alcohol purchaser, but electronic scanning is not generally required for in-store purchases; additional scanning rules apply to curbside and drive-through transactions
• Restaurants: Must check and electronically scan the IDs of alcohol purchasers who appear to be 35 or younger
• Other licensees: Follow their applicable category-specific requirements rather than a universal 100% ID-check rule

The March changes supersede parts of the January 2026 approach.

Alcohol Delivery and Online Orders

Age checks may be required at purchase, handoff, or both, depending on the jurisdiction and license. Retailers should confirm who can receive a delivery, which IDs are accepted, and whether the delivery worker must inspect or electronically scan identification.

For alcohol marketing programs, those retail rules sit alongside age-targeting, advertising, and responsible-marketing requirements.

Cannabis Age Verification: A California Example

California's Department of Cannabis Control distinguishes between:

• Adult-use cannabis: Buyers must be at least 21
• Medicinal cannabis: Qualifying patients can purchase at 18 or older with the required physician's recommendation

Licensed retailers must check acceptable identification and verify age and identity before completing purchases. Requirements differ in other states.

Choosing Age Verification Software

Verification software should be evaluated against the actual statutes and sales workflows involved.

What to Look For

• Jurisdiction support: Accepted methods for each product, state, and transaction
• Identity controls: Relevant document checks, electronic scanning, or database verification
• Age settings: Configurable age thresholds and appropriate treatment of uncertain results
• Data protection: Clear policies on collecting, sharing, storing, and deleting identity information
• System integration: Compatibility with ecommerce checkout or point-of-sale tools
• Auditability: Evidence of the verification result without collecting prohibited personal data

Vendors do not automatically assume the seller's legal responsibilities.

Verification Evidence Is Not the Same as ID Retention

A business may need proof that a check occurred without keeping an image of the customer's ID. Texas limits identifying-information retention for its covered adult-site checks, while Alabama requires specialty vape scanning systems to retain scan results but not patrons' personal data. Record policies should reflect these differences.

Building an Age Verification Compliance Program

A reliable process combines appropriate technology with staff training and regular reviews.

1. Identify applicable rules: Map the product, location, website, and sales or delivery method
2. Select permitted checks: Confirm that the verification system meets legal requirements
3. Train the team: Establish procedures for uncertain results, refused sales, and failed checks
4. Protect information: Collect and retain only what the law and legitimate operations permit
5. Review updates: Reassess statutes, court orders, vendor policies, and checkout practices

Analytics and attribution tools can help evaluate customer experience and campaign performance, but they do not replace required age checks or legal review.

How Herb Agency Supports Marketing for Age-Restricted Brands

Age verification affects customer acquisition, checkout experiences, and retention, but marketing and legal compliance have different responsibilities. Herb Agency helps regulated businesses develop eligible marketing programs while specialized verification providers and legal advisers handle their respective requirements.

Herb Agency's marketing services include:

• Herb Paid Media: Campaign planning across eligible advertising channels
• Herb Mail: Consent-based first-party audience development and email marketing
• Herb Editorial: Educational and content marketing, particularly for cannabis and hemp
• Herb Dashboard: Reporting on acquisition, engagement, and attributed performance

Herb Agency's strongest documented experience is in cannabis and hemp. Other categories require tailored marketing strategies. Brands can book a strategy call with Herb Agency to explore appropriate acquisition and retention channels.

Frequently Asked Questions

What happens when a seller fails to comply with age verification laws??

Consequences vary by jurisdiction and product. Adult websites can face civil penalties or lawsuits under applicable statutes. Tobacco retailers may receive FDA warning letters, civil money penalties, or no-tobacco-sale orders; alcohol and cannabis retailers can face licensing and enforcement consequences. The maximum amounts in one state's law should not be applied to other industries automatically.

Can digital verification replace physical ID checks?

Sometimes. Covered adult-content laws may accept digital IDs or qualifying commercial verification systems, while some retail transactions require inspection or electronic scanning of particular ID documents. Businesses should confirm the accepted methods for each jurisdiction and transaction rather than assume any digital credential meets every requirement.

How did Utah's 2026 changes affect age verification?

In March 2026, Utah changed alcohol ID requirements by license type, preserving universal checks for bars, taverns, and off-premise beer purchases while applying different rules elsewhere. Separately, a September 24 court order temporarily blocked the adult-website law's actual-location provision, not the core requirement to verify age on covered sites.

Do online stores need to verify age again at delivery?

That depends on the product and state. Covered PACT Act delivery sales involve age-verification and adult-signature obligations, while alcohol delivery rules vary by jurisdiction and license. A verification at online checkout should not be assumed to satisfy every requirement at handoff.

How can websites verify age without retaining unnecessary personal data?

Qualifying third-party services, digital credentials, and certain database checks can return an eligibility result without transferring full identity documents to the seller. Businesses should confirm that the method is legally acceptable and that retention practices follow the relevant statute. Some adult-content laws expressly prohibit retaining identifying data used for verification.

Schedule a call with us to learn more about our services.

Learn more