Age Verification for Restricted Products on Shopify: What the UK Online Safety Act Actually Requires

If you sell vapes, alcohol or anything else age-restricted on Shopify in the UK, a verification vendor has probably told you the Online Safety Act now forces you to replace your "I am over 18" checkbox with their widget, or face an £18 million fine. Some of that is true. Most of it is sales copy.

This is a plain guide to Shopify age verification in the UK in late 2026: which law actually applies to your store, which methods regulators accept, and how to put a check into checkout without wrecking a conversion rate you spent years building. We write it as an agency weighing compliance against conversion, not as a vendor with a widget to sell.

What the Online Safety Act does and does not cover

The Online Safety Act regulates user-to-user services and search engines: platforms where people post content other people see. Ofcom enforces it. The age-check duties that made headlines in July 2025 apply to services hosting pornography or other content harmful to children. A Shopify store selling e-liquid or craft gin is not that kind of service.

Where it can touch you is user-generated content. If your store runs product reviews, a Q&A section or an app that lets customers publish photos and comments, you have a user-to-user element and some duties may apply. Even then, those duties concern illegal and harmful content in what users post. They are not a requirement to age-gate a product sale.

So why does every vendor cite the Act? Because Ofcom's guidance defines "highly effective age assurance", and that standard has become the benchmark the whole UK system is converging on. The actual duty to check age before you sell a vape or a bottle of whisky comes from different legislation.

The laws that actually bind a UK Shopify vape or alcohol retailer

Vapes and nicotine: the Tobacco and Vapes Act 2026

The Tobacco and Vapes Act received Royal Assent on 29 April 2026. From 29 October 2026 it is an offence to sell any vaping or nicotine product to anyone under 18, and the offence applies to online retailers in full. From 1 January 2027 the generational tobacco ban begins: no sales to anyone born on or after 1 January 2009. An "over 18" pass will not cover tobacco for long, so tobacco and vapes need separate tests.

The Act lets regulations set out verification steps that give a retailer a statutory defence. Those regulations have not been made yet. Until they are, you must show you took all reasonable steps. The Local Government Association's guidance for trading standards says a tick box, a typed date of birth or a credit card is unlikely to meet that test, and recommends an age check at checkout and another on delivery.

Alcohol: licensing law, not Ofcom

Alcohol is governed by the Licensing Act 2003 in England and Wales and the Licensing (Scotland) Act 2005 here in Scotland. For online orders in Scotland the sale is treated as taking place at the despatch premises, and licensing boards increasingly require an age-verified, signed-for delivery. In England and Wales the Home Office confirmed in July 2026 that it is amending the mandatory licensing conditions so certified digital identity services count as proof of age. The direction is the same everywhere: a checkbox is not a check.

What highly effective age assurance means in practice

Ofcom's final guidance, published in January 2025, lists the methods it considers capable of being highly effective: open banking, photo ID matching, facial age estimation, mobile network operator checks, credit card checks, digital identity services and email-based age estimation. Whatever you use must be technically accurate, robust, reliable and fair. Read Ofcom's guidance on age checks directly rather than a vendor's summary of it.

Just as important is what Ofcom rules out: self-declaration, payment methods that do not require the user to be 18 (a debit card proves nothing), age limits buried in your terms, and warnings or disclaimers. If that describes your current setup, you have a notice, not a verification.

Facial age estimation. A selfie, and a model estimates age. No document, no typing, works well on a phone. Yoti's July 2025 white paper reports a mean absolute error of around 2.1 years for 18 to 24 year olds, so estimation normally runs with a buffer (pass at 25, send anyone younger-looking to a fallback).ID document plus liveness check. A passport or driving licence matched to a live selfie. The most robust method and the most friction. Best as the fallback, not the first step.Background data checks. Name, address and date of birth checked against credit reference and electoral data. Invisible when it passes. It fails for young adults with thin files and for anyone whose details do not match, so plan for the fallback rate.

Where to put the check in Shopify (and where not to)

Not a storefront popup. The "Are you over 18?" modal on every landing is self-declaration, which no regulator accepts, and it costs you bounces on every paid click. Theme JavaScript also does not run inside checkout, and Shop Pay and other accelerated checkouts skip your storefront entirely, so a gate living in the theme is bypassed by exactly the customers most likely to buy.

At checkout, triggered by the basket. Tag your restricted products and run the check only when one is in the cart. On Checkout Extensibility this is done with a checkout UI extension and a validation function that blocks progress until the customer is verified. If your current app relies on injected scripts it has probably already stopped working: we covered why in our piece on blocked legacy script tags.

Once per customer, then remembered. Store verified status against the customer record (a customer metafield is the clean way) so a logged-in returning customer never sees the check again. Pair it with Shopify's passwordless customer accounts and login is one tap. For subscription vape brands this is the biggest conversion saver: verify at the first order, bill every month, never ask again.

At the door as well. Trading standards expect a check on delivery, not just at checkout. Royal Mail and the major couriers offer age-verified delivery. It costs more per parcel, but for restricted baskets it should be the only shipping option, enforced with a delivery customisation function so nobody can pick a letterbox or safe-place service.

Protecting conversion while you add friction

Be honest about the trade-off. Any real age check adds a step, and a step costs completions. We have not seen a credible published study of how much it costs in ecommerce; vendors say their method "minimises drop-off" without a number. So measure it in your own store:

Record checkout completion for restricted and non-restricted baskets for two weeks before launch, so you know what the check actually cost.Run estimation first and ID second. Most adults pass the selfie in seconds and never see the document step.Design for mobile. The camera permission prompt is where you lose people. Clear copy on why you need the camera, and what happens to the image, matters more than button colour.Explain before you ask. One line such as "UK law requires us to confirm you are over 18. It takes about ten seconds and we do not keep your photo" is worth testing against nothing.Treat a failed verification as its own event, with a different recovery email from a normal abandoned checkout.

Most Shopify brands do not have a traffic problem, they have a conversion problem. Bolting a legal check onto a checkout you never properly optimised does not create that problem. It makes it visible.

If your checkout was already leaking before the check went in, fix that first. Our guide to reducing drop-off at the final step covers the usual culprits.

The penalty exposure, honestly

The £18 million figure is the Online Safety Act's ceiling: up to £18 million or 10% of qualifying worldwide revenue, whichever is higher. The fines Ofcom has actually issued under the age-check rules, in February and May 2026, were £800,000, £1.35 million and £500,000, all against adult content providers. None has been against a retailer.

The exposure that should worry a vape or alcohol brand is closer to home. Under the Tobacco and Vapes Act it is fixed penalty notices and prosecution by trading standards, and once the Act's retail licensing scheme is switched on, the risk of losing the right to sell at all. For alcohol in Scotland it is a premises licence review. In every category, Shopify Payments and PayPal restrict or close accounts in restricted sectors, and weak age controls are a common reason cited.

The realistic failure mode is not an £18 million Ofcom fine. It is a test purchase by a 16-year-old, a fixed penalty, a licence review and a frozen payments account in the week before Christmas.

What to do this quarter

Tag your restricted products. Move the check from a storefront popup to checkout, triggered by the basket. Remember verified customers so you only ask once. Make age-verified delivery the only shipping option for restricted orders. Measure checkout completion before and after.

Most of that is a fixed-scope piece of development. We do it for UK brands through our Shopify store improvements and upgrades service, and where the flow needs testing and refining after launch it folds into the Conversion Growth Retainer. Uncover Commerce is a senior-only Shopify agency in Glasgow, working with brands across Scotland and the UK for over 12 years. If you sell age-restricted products and want a straight answer on what your store needs, get in touch.