Online tobacco age verification laws and penalties: EU

The European Union has required an age verification system for cross-border tobacco sales since the Tobacco Products Directive became applicable on 20 May 2016. In 2021 the Commission reviewed how that was going. Its report records that "age verification systems do not seem to be effective, with Member States calling for improved age verification systems", and footnotes a mystery shopping exercise finding that "80% of retailers reviewed use self-reporting as age verification, and age is not verified at the point of delivery."

A binding requirement, five years in force, satisfied by a tick-box at four retailers in five. That gap is the useful starting point, because the obligation itself is unusually specific — and unusually easy to get wrong in a way nobody notices until an enforcement authority asks.

The requirement, in its own words

Article 18(4) of Directive 2014/40/EU reads:

Retail outlets engaged in cross-border distance sales shall operate an age verification system, which verifies, at the time of sale, that the purchasing consumer complies with minimum age requirements provided for under the national law of the Member State of destination.

Three phrases in that sentence do all the work. At the time of sale rules out a check at delivery. Complies with minimum age requirements rules out a check against your own threshold. And the Member State of destination is the part that makes this different from every other age check an online retailer runs.

The same paragraph adds a requirement with no equivalent elsewhere: the retailer, or the responsible person nominated under Article 18(3), "shall provide to the competent authorities of that Member State a description of the details and functioning of the age verification system." The system is not merely operated. It is described, filed, and held against you.

Article 20(6) extends all of Article 18 to "cross-border distance sales of electronic cigarettes and refill containers", so vape retailers are inside the same regime on the same terms.

Why the destination country's age governs

This is not a policy preference. It falls out of a definition.

Article 2(40) provides that "in the case of cross-border distance sales the product is deemed to be placed on the market in the Member State where the consumer is located." The sale legally happens where the buyer is. Article 2(34) then defines a cross-border distance sale as one where, at the moment of ordering, the consumer "is located in a Member State other than the Member State or the third country where that retail outlet is established."

The consequence for a checkout is concrete. The Directive sets no EU-wide minimum age for tobacco — that is left to national law, and it is not uniform. A single "18+" gate applied to all EU traffic is therefore not an implementation of Article 18(4); it is a guess that happens to be right in most places. The compliant design resolves the destination country first and the age threshold second, per order.

The check before the check

Article 18(1) opens with a sentence that outranks everything else: "Member States may prohibit cross-border distance sales of tobacco products to consumers." Retail outlets "may not supply such products to consumers in Member States where such sales have been prohibited."

Most have prohibited them. The Commission's 2021 report states that "more than half of the Member States banned cross-border distance sales of tobacco and/or related products to consumers in their countries."

So for the majority of the Union, the age verification question never arises, because the sale itself is unlawful. An age check that runs correctly on an order bound for a prohibiting Member State has verified the buyer of a sale that should never have been offered. Jurisdiction is the first gate; age is the second.

Where sales are permitted, Article 18(1) requires registration with the competent authorities both in the Member State where the retailer is established and in the Member State where the consumers are located — and retailers established outside the Union must register in the Member State where the consumers are. Article 18(2) then bars trading until confirmation arrives: retail outlets "may only start placing tobacco products on the market via cross-border distance sales when they have received confirmation of their registration."

Article 18(3) lets the destination Member State go further and require the retailer to nominate a natural person responsible for verifying, before the goods reach the consumer, that they comply with that country's national provisions.

What you may do with what you collect

Article 18(5) is a data clause written before the GDPR and sharper than most that came after. Retailers shall only process consumer personal data in accordance with data protection law, and those data "shall not be disclosed to the manufacturer of tobacco products or companies forming part of the same group of companies or to other third parties." Then the operative sentence: "Personal data shall not be used or transferred for purposes other than the actual purchase." The paragraph closes by noting this applies even where the retailer is itself part of a tobacco manufacturer.

The consolidated text still refers to the repealed Directive 95/46/EC. Under Article 94(2) of the GDPR, references to that directive are read as references to the Regulation.

The practical reading: age verification data is single-purpose by statute here, not merely by good practice. Retaining an identity document to enrich a customer profile is a breach of Article 18(5) before it is anything else.

The penalties are not EU penalties

There is no figure to quote, and that is the answer rather than a gap in it.

Article 23(3) requires Member States to "lay down rules on penalties applicable to infringements of the national provisions adopted pursuant to this Directive" and to ensure they are enforced. The penalties "shall be effective, proportionate and dissuasive." One sentence goes further: "Any financial administrative penalty that may be imposed as a result of an intentional infringement may be such as to offset the economic advantage sought through the infringement."

The Directive therefore harmonises the duty and delegates the sanction. A retailer selling into several Member States faces one age verification standard and several penalty regimes, applied by the authority of each destination country, with an express licence for fines calibrated to strip out the profit of a deliberate breach.

The enforcement picture from the Commission's own review is worth holding beside that. It found "insufficient monitoring and enforcement of cross-border distance sales restrictions or bans", Member States discovering "unregistered retailers operating in their countries", and difficulty closing non-compliant websites "especially when the servers were located outside the EU". Weak enforcement is not the same as no exposure — the Commission's stated options were "developing further the current regime, or as an alternative consider banning cross-border distance sales of tobacco and related products, as many Member States have already done."

What sits outside all of this

Article 1 lists what the Directive covers, and cross-border distance sales appear there at point (d). The product scope is cigarettes, roll-your-own and pipe tobacco, cigars, cigarillos, smokeless tobacco, e-cigarettes and refill containers, and herbal products for smoking.

Tobacco-free nicotine pouches are not on that list, which means Article 18 does not reach them and their online sale is governed entirely by national law. That is one of the gaps a revision would close. The Commission published an evaluation of the EU tobacco control framework on 2 April 2026; until a proposal is tabled and adopted, the 2014 text is the text.

What this looks like in practice

• Resolve the destination country before you resolve the age. Both the permissibility of the sale and the threshold depend on it.
• Block prohibiting Member States at the cart, not at fulfilment. Article 18(1) bars supply, and an order accepted is already an offer to supply.
• Verify at the time of sale. A courier checking ID at the door does not satisfy Article 18(4), and the Commission specifically noted its absence.
• Do not ship before registration is confirmed in both countries. Article 18(2) makes confirmation, not application, the trigger.
• Write the description of your age verification system as a document you will hand to a regulator, because Article 18(4) says you will.
• Keep age verification data out of every other system. Article 18(5) permits its use for the purchase and nothing else.

Every other jurisdiction in this series asks whether your age check is strong enough. The EU asks that too — and then asks whose law you were checking against.