Skip to content 
Understanding when age verification is legally required and how to implement it effectively.
Introduction
Certain goods, services, and content are subject to age restrictions under UK law. Selling age-restricted products to minors, or failing to implement adequate age verification measures, can result in criminal prosecution, regulatory enforcement, and substantial fines. For online businesses, the challenge is particularly acute because the seller cannot physically verify the buyer’s age at the point of sale.
The legal landscape around age verification is evolving rapidly. The Online Safety Act 2023 has introduced new obligations for websites and platforms that provide content harmful to children, and regulatory bodies are developing increasingly detailed guidance on what constitutes effective age assurance. Businesses that sell age-restricted products or host age-restricted content need to understand their obligations and implement measures that are proportionate, effective, and legally compliant.
This article examines the categories of products and content subject to age restrictions, the legal obligations on online sellers and platforms, the available methods of age verification, and the practical steps businesses should take to comply.
Categories of Age-Restricted Products
UK law restricts the sale of a wide range of products to persons below specified ages. Alcohol may not be sold to anyone under 18. Tobacco products, including e-cigarettes and vaping products, may not be sold to anyone under 18. Knives and bladed articles may not be sold to anyone under 18, with specific additional requirements for online sales. Fireworks may not be sold to anyone under 18, with certain categories restricted to those over 21. Lottery tickets and scratch cards may not be sold to anyone under 16, while other forms of gambling are restricted to those over 18. Certain solvents and aerosol products are restricted. Offensive weapons are subject to absolute prohibitions on sale.
The age at which a product becomes restricted varies by category, and some products are subject to additional restrictions that go beyond simple age verification. For example, the sale of knives online is subject to specific requirements under the Offensive Weapons Act 2019, including a requirement that delivery is made to the purchaser in person and that the delivery company verifies the purchaser’s age at the point of delivery.
Age-Restricted Content and the Online Safety Act 2023
The Online Safety Act 2023 has significantly expanded the regulatory framework for online content. The Act imposes duties on providers of user-to-user services and search services to protect children from harmful content. This includes content that is harmful to children by nature, such as pornographic content, content that promotes self-harm or eating disorders, and violent content.
Providers of services that publish or host pornographic content are required to use age verification to prevent children from accessing it. The Act gives Ofcom the power to set standards for age verification and to take enforcement action against services that fail to comply. While the detailed guidance from Ofcom continues to develop, the direction is clear: effective age verification for age-restricted content is not optional.
Even businesses that do not deal in obviously age-restricted content should consider whether any part of their website or service might fall within the scope of the Online Safety Act’s protections for children. The Act’s definition of content harmful to children is broad, and businesses should seek specific advice if there is any doubt.
Methods of Age Verification
Self-Declaration
The simplest form of age verification is self-declaration, where the user confirms their age by ticking a box or entering a date of birth. This method is widely used but provides the weakest level of assurance. For low-risk products and content, self-declaration may be proportionate, but it is increasingly unlikely to satisfy regulatory expectations for products and content where the risk of harm from underage access is significant.
Database Verification
Database verification involves checking the user’s claimed identity and age against external databases, such as the electoral roll, credit reference data, or mobile network records. This provides a higher level of assurance than self-declaration and can be implemented relatively seamlessly within the checkout process. Several commercial providers offer age verification services that perform these checks in real time.
Document Verification
Document verification requires the user to upload or present an identity document, such as a passport or driving licence, which is then checked either manually or using automated document analysis and facial matching technology. This provides a high level of assurance but introduces friction into the user journey and raises additional data protection considerations, as you will be processing sensitive identity documents.
Estimation Technology
Facial age estimation technology uses artificial intelligence to estimate a user’s age from a photograph or video. This is an emerging technology that is gaining acceptance as a legitimate age assurance method, though it is not without controversy. The accuracy of estimation varies, and there are concerns about bias and privacy. However, when calibrated conservatively, it can provide a reasonable level of assurance without requiring the user to share identity documents.
Legal Obligations for Online Sellers
The legal obligations on online sellers of age-restricted products are primarily found in the specific legislation governing each product category. For alcohol, the Licensing Act 2003 makes it an offence to sell alcohol to a person under 18. For tobacco, the Children and Young Persons Act 1933, as amended, prohibits the sale of tobacco products to anyone under 18. For knives, the Criminal Justice Act 1988 and the Offensive Weapons Act 2019 set out the restrictions.
In each case, the offence is committed by selling the product to an underage person. The fact that the sale took place online does not provide a defence. The due diligence defence, where available, requires the seller to demonstrate that they took all reasonable precautions and exercised all due diligence to avoid committing the offence. For online sales, this means implementing an effective age verification system.
What constitutes reasonable precautions will depend on the nature of the product, the risk of underage purchase, and the available technology. A simple date-of-birth entry is unlikely to be considered a reasonable precaution for high-risk products. The more serious the potential harm from underage access, the more robust the verification measures need to be.
Data Protection Considerations
Age verification necessarily involves the collection and processing of personal data. Depending on the method used, this may include names, dates of birth, identity document numbers, photographs, and biometric data such as facial geometry. This processing must comply with UK GDPR, and the lawful basis for processing will depend on the specific circumstances.
Where age verification is a legal requirement, the lawful basis for processing is likely to be legal obligation or legitimate interests. Where identity documents or biometric data are processed, additional safeguards may be required, including a data protection impact assessment. The data should be retained only for as long as necessary to complete the verification, and identity documents should ideally not be stored after the verification is complete.
Transparency is essential. Your privacy policy should explain that age verification is carried out, what data is collected, how it is used, who it is shared with if a third-party verification provider is used, and how long it is retained. Users should be informed before the verification process begins.
Delivery and Fulfilment
For physical products, age verification at the point of purchase is only part of the obligation. For certain products, particularly knives and bladed articles, there are specific requirements for age verification at the point of delivery. The Offensive Weapons Act 2019 requires that when a knife is sold remotely, delivery arrangements must ensure that the item is delivered into the hands of a person aged 18 or over, and the delivery company must verify the recipient’s age.
For alcohol, while there is no specific statutory requirement for age verification at delivery, responsible retailers and delivery companies typically include an age check as part of their delivery process. This is both good practice and a potential defence in any prosecution arising from a sale to a minor.
Businesses that sell age-restricted products online should ensure that their fulfilment and delivery processes include appropriate age checks and that their contracts with delivery partners address this requirement.
Penalties for Non-Compliance
The penalties for selling age-restricted products to minors vary by product category but can be severe. Selling alcohol to a minor can result in a fine of up to £20,000 and the loss of your premises licence. Selling tobacco to a minor can result in a fine and a restricted premises order that prohibits the sale of tobacco from the premises. Selling a knife to a person under 18 is a criminal offence punishable by imprisonment and an unlimited fine. Under the Online Safety Act, Ofcom has the power to impose fines of up to £18 million or ten per cent of qualifying worldwide revenue, whichever is greater, for failures to comply with age verification duties.
Beyond the legal penalties, selling age-restricted products to minors carries significant reputational risk. Negative publicity, loss of payment processing facilities, and damage to customer trust can have long-lasting consequences for a business.
Practical Steps for Compliance
Begin by identifying which of your products, services, or content is subject to age restrictions. Map the specific legal requirements for each category, including the age threshold, the applicable legislation, and any specific requirements for online sales or delivery.
Select an age verification method that is proportionate to the risk. For lower-risk products, database verification or robust self-declaration with supporting checks may be sufficient. For higher-risk products and content, document verification or estimation technology may be necessary. Consider using a specialist third-party age verification provider that can manage the process and provide evidence of compliance.
Integrate age verification into your checkout process and, where required, your delivery process. Ensure that your privacy policy addresses the age verification data you collect. Train your staff to understand the legal requirements and the consequences of non-compliance. Review your age verification processes regularly to ensure they remain effective and proportionate.
Conclusion
Age verification is a legal obligation for businesses that sell age-restricted products or host age-restricted content. The regulatory landscape is tightening, with the Online Safety Act introducing new duties and Ofcom developing detailed standards for compliance. Businesses that implement effective, proportionate age verification protect themselves from prosecution, regulatory enforcement, and reputational harm, while demonstrating a responsible approach to the sale of restricted products and the protection of children.
Need help with age verification compliance?
Lawdit Solicitors’ StayLegal package can help you identify your age verification obligations and implement compliant solutions. Visit staylegal.co.uk to learn more.
Next in this series: Article 10 – Ongoing Compliance and Auditing: Why Compliance Is Not a One-Off
