Age fabrication is a widespread issue: as noted by the Journal of Studies on Alcohol and Drugs, underage customers in the United States consumed 11.73% of all alcoholic drinks sold in the U.S. market in 2016. And according to a recent JAMA research letter, 49.8% of tobacco and vape shops in California failed to check the ID of underage decoys in 2018.
The problem: if you sell age-restricted goods or services to minors, your business could face both fines and legal ramifications that could negatively impact ongoing operations.
And simply incorporating any old age verification system isn’t enough — you also need to ensure your process is simple and seamless to help reduce friction. If users are forced to wait more than three seconds for any function or response, they’re far more likely to abandon your site and find another business that offers a better user experience.
But what does age verification look like in practice? In this piece, we’ll examine some of the current compliance standards of age verification policies, how they’re applied at state and federal levels, which businesses are required to implement these controls, the potential impact to your business if these processes aren’t in place, and how to implement a comprehensive and user-friendly process.
How does age verification work?
Age verification works by requiring customers to prove their age before giving them access to products or services, such as alcohol or lotto tickets. It can look very different depending on whether a person’s age is being verified in person or electronically.
In-person age verification
If an age-restricted item or service is being purchased in person — for example, at a brick-and-mortar liquor store — the buyer will usually be required to present the seller with a government-issued photo ID, such as a driver’s license or passport, that lists their birthdate.
The seller will then typically check the ID for signs of tampering and to ensure that any special design features (such as holographic foils and text) are present. They will also check the photo on the ID to make sure it matches the face of the person in front of them.
Some IDs include security features, such as barcodes or NFC chips, which are specifically designed to help weed out fake or forged IDs. These can be scanned to help the seller determine whether or not an ID is legitimate.
Electronic age verification
When a customer wants to purchase an age-restricted item or service electronically, such as through a website or mobile app, the seller must still verify their age. This is usually accomplished through government ID verification.
Government ID verification usually works like this:
- The user is prompted to take a photo of their driver’s license (or other accepted ID).
- The ID is analyzed for authenticity.
- The user is prompted to take a selfie or series of selfies.
- The photo in the ID is compared against the selfie(s) to ensure that it was not stolen.
- Information is extracted from the ID and checked against the information provided by the user. The system automatically determines whether or not the person is of legal age to purchase the good or service.
In states where mobile driver’s licenses (mDLs) are issued and accepted, a customer can use these instead of taking a photo of their physical ID.
Meeting age verification compliance standards
Both federal- and state-level compliance regulations exist to help ensure consistency in age verification expectations and processes. In many cases, federal rules establish a broad framework for compliance around certain goods — such as tobacco — while state rules provide more specific guidance.
State and federal regulations
Let’s break down a few examples of state and federal interaction around age verification compliance.
Consider the example of tobacco mentioned above. Under the Tobacco 21 legislation signed into law on December 20th, 2019, “it is now illegal to sell any tobacco product — including cigarettes, cigars, and e-cigarettes — to anyone under 21.” The law applies to all persons and retailers without exceptions. According to the FDA, sellers must now check the photo ID of anyone under 27 who attempts to purchase a tobacco product. Businesses are also only permitted to sell tobacco products in vending machines located within adults-only facilities and cannot give away free samples of any tobacco product.
Age minimums for alcohol sales have also been established. As noted by the CDC, under the National Minimum Drinking Age Act of 1984, the required age for the sale of alcohol was raised to match the minimum legal drinking age (MLDA) of 21 years.
Along with federal laws, many states have enacted their own age-related sales restrictions. In New York, for example, businesses are not only responsible for sales made directly to underage individuals but are also responsible for “indirect deliveries,” which occur when another person purchases alcohol and then passes it on to a minor. If businesses do not comply with these regulations, the New York Liquor Authority can issue temporary or permanent bans on liquor licenses or assess fines of up to $10,000 per violation.
In California, Bill 2511 now requires that all online businesses selling age-restricted products or services such as fireworks, firearms, tobacco, or ammunition must “take reasonable steps, as specified, to ensure that the purchaser is of legal age at the time of purchase or delivery, including, but not limited to, verifying the age of the purchaser.” Businesses that fail to comply with this legislation may be subject to a $7,500 fine per violation.
Is age verification required at your business?
Any business that sells age-restricted products, provides access to age-gated activities, or delivers services that require adult consent must verify ages. Some of the business types include:
Tobacco and alcohol sales
As mentioned earlier, both tobacco and alcohol sellers must make an effort to verify the age of online purchasers. In the case of tobacco, this verification includes everything from cigarettes to smokeless tobacco, cigars, hookah pipes, e-cigarettes, nicotine gels, and dissolvables. Tobacco can only be sold to those over 21. Cannabis laws are slightly different: Many states permit the use of medical marijuana for those over 18, but businesses can only sell cannabis to people over 21. As noted above, the minimum age for alcohol sales is 21 across the United States.
Gambling operations
The United States legalized online gambling sites in 2011, and the market was worth nearly $2 billion in 2020. Along with success, however, comes more stringent restrictions that require online gaming sites to verify the age of potential players. The legal gambling age varies by state. Some, like Montana and Oklahoma, have set the minimum age at 18, while the majority of states have opted for 21.
Gaming sites
As noted by Business Insider, the pandemic created an opportunity for a new type of online wagering: video games. Platforms emerged that allowed players to bet real money on the outcomes of their favorite video games, but many of these new platforms did little to keep out underage bettors, despite requirements to do so. (Gaming sites generally follow the same rules as casino gambling, with legal ages set at either 18 or 21 by state.) As this market evolves, businesses should expect stronger restrictions and steeper penalties if they fail to follow these rules.
Medical services
Companies that offer medical services are also required to verify ages — a task that has become even more critical thanks to the rise of telemedicine. According to Forbes, most medical practices currently lack the ability to verify identity online. But with telemedicine here to stay, both age and identity verification expectations will rapidly evolve. Generally speaking, patients must be at least 18 to give informed consent for medical procedures or services.
eCommerce businesses
Any online business that sells age-restricted products or services must implement an age verification system. These products may include alcohol, tobacco, firearms, ammunition, or adult content. Failure to do so could result in fines, legal challenges, and a damaged reputation. Depending on the product being purchased, the legal age may range from 18 to 21.
Food delivery services
Food delivery services are also required to verify ages if consumers purchase alcohol. Regardless of whether alcohol is part of a larger food purchase or ordered on its own, delivery drivers must see proof of legal age before releasing any alcohol to customers. Anyone ordering alcohol must be 21 or older.
Adult entertainment
In the United States, companies operating in the adult entertainment space, such as those that sell or distribute pornography online, have always been required to ensure that a person was at least 18 years of age before they could access the website. This was typically achieved via age gating (discussed below) which was fairly easy to bypass.
Recently, Louisiana passed a law requiring more stringent age verification before a person can access online pornography. The law requires businesses to verify users’ ages via a “commercially reasonable method,” and calls out government ID verification and database verification as potential solutions.
Social media
While not regulated in the US on a national level yet, there has been bipartisan support for social media legislation aimed at protecting children. In the meantime, some states are taking matters into their own hands. For example, in March 2023, Utah's governor signed two bills into law that restrict children's use of social media platforms and requires social media companies to verify the ages of all users in the state.
What is age gating?
Age gating refers to the process of placing web content behind a form that requires a user to either enter their birthday, select their age, or indicate that they are old enough to legally consume the content.
For example, a user attempting to visit a website selling cannabis products may have to answer the question “Are you over 21 years of age?”
Age gates have been around on the internet for decades, but they really don’t qualify as a form of age verification because they don’t actually verify that the information provided by the user is accurate. They take the user at their word. With this in mind, they’re very easy to bypass, as the individual can simply lie about their age.
As a result, age gates are no longer enough in most countries to confirm age. Now, businesses must actively take steps to confirm customers’ ages before selling them an age-restricted product or service. In practice, this means obtaining and confirming valid documentation that clearly demonstrates a customer’s age.
What are examples of age gating?
On websites, “age gates” typically take the form of checkboxes or form fields that ask customers to either confirm that they’re over a certain age — such as 18 or 21 — or enter their birth date to prove their age.
Some examples of age gating include:
- A beer company asking "Are you over 21 years of age?" and the individual having to click "yes" to enter the site.
- An online betting platform asking the individual to enter their birthday before they're allowed access.
- An adult entertainment site requiring individuals to select their age from a drop-down menu before the individuals can proceed.
Online age verification regulations to know
In the United States, businesses must abide by both the state and federal laws and regulations that dictate age verification requirements for the sale, distribution, and delivery of age-restricted goods like alcohol and tobacco.
At the Federal level, for example, the National Minimum Drinking Age Act of 1984 requires businesses to verify that a customer is at least 21 years old before they can purchase or receive alcohol. Prior to that law, each state was allowed to enact its own, sometimes differing, laws — similar to marijuana laws today.
At the state level, Louisiana and California both recently passed laws requiring certain online businesses to perform age verification.
The Louisiana law, Act 440, specifically applies to companies that sell or distribute pornography online. The law requires that those businesses verify a user is at least 18 years of age before being granted access to adult content. While Act 440 doesn’t require all businesses to use a specific type of verification, it does call out government ID verification and database verification as two potential options.
The California Law, California Age-Appropriate Design Code Act (AADC), applies to any business that is likely to be accessed by children. It requires those businesses to implement more robust privacy policies for any user younger than 18 years. Companies that fail to comply with the requirements of the law could face penalties as high as $7,500 per violation, per child.
While the law doesn’t specifically require age verification, many industry experts believe that businesses will turn to age verification to comply with the requirements of the law and avoid such steep penalties. AADC goes into effect in July 2024.
Cutting out complexity: why you need an online age verification solution
The simplest form of online age verification is the familiar “are you ___ years old?” pop-up seen on many websites. The problem? While this approach is streamlined, it relies entirely on trust; users can simply lie if they’re underage. Because of this, simply asking users if they’re a certain age doesn’t usually satisfy due diligence, which requires companies to implement steps that actually reduce overall risk.
The other side of the age confirmation coin is complexity. If your age verification process is cumbersome and slow, users will simply take their business somewhere else.
If you need an age verification system, your best bet is to find one that bridges the gap between speed and security to help reduce risk and ensure regulatory due diligence. With Persona, users can verify their identity in seconds, and you can specify everything from which forms of verification you’ll require to how many attempts users can attempt verification in a row.
The Persona age verification process is simple: First, users take a picture of their ID. Then, Persona verifies the authenticity of the ID, extracts the birth date, and approves or denies the request based on the calculated age. If there’s concern that individuals may be using someone else’s ID (such as a child using their parent’s ID), you can also request a selfie for extra verification.
Persona also helps reduce user drop-off by guiding users through the verification process, leveraging auto-capture to minimize data entry errors, empowering easy device switching, and supporting more than 200 countries and territories and 20 languages. With our trusted identity infrastructure, age verifications typically take around 5 seconds — much faster than traditional identity verification providers who use manual review processes, which can take hours or days to return results.
The bottom line: age verification is essential for online businesses and retailers. But complexity can cause customer frustration, while oversimplification can introduce security risk. Persona’s market-leading age verification solution empowers easy age verification that’s compliant, accurate, and comprehensive.
Need robust, reliable, and streamlined age verification? Contact us to learn more or get started for free.
