Age verification for small businesses: the exemption is in the wrong law

EU law does contain a small-business exemption from its child-protection rules. Article 19 of the Digital Services Act (DSA), which has applied in full since 17 February 2024, provides that the section containing the minors-protection duty "shall not apply to providers of online platforms that qualify as micro or small enterprises". Under Commission Recommendation 2003/361/EC, a small enterprise employs fewer than 50 people and has a turnover or balance sheet of no more than EUR 10 million.

That exemption is real, and it is the one people remember. It is also the wrong one for most small businesses that sell age-restricted goods. It covers online platforms, and it covers a duty to protect minors on the platform. It does not touch the rules that govern selling a bottle of wine, a pack of cigarettes or a vape pod to a stranger over the internet. None of those rules mention the size of the seller.

Two kinds of rule, and only one of them scales

Rules about age online come in two families, and they are drafted on different principles.

Platform rules regulate a service. The DSA's Article 28 asks providers of online platforms accessible to minors to put in place "appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors". Proportionality is built in, and the Article 19 carve-out takes the smallest providers out altogether.

Product rules regulate a sale. They attach to the act of handing over a restricted product, and they are drafted against "a person" or "a retail outlet", with no threshold of any kind:

• In England and Wales, section 146(1) of the Licensing Act 2003 reads in full: "A person commits an offence if he sells alcohol to an individual aged under 18."
• From 29 October 2026, section 10 of the Tobacco and Vapes Act 2026 makes it "an offence to sell a vaping product or nicotine product to a person who is under the age of 18."
• In the EU, Article 18(4) of the Tobacco Products Directive requires every retail outlet engaged in cross-border distance sales of tobacco to "operate an age verification system, which verifies, at the time of sale, that the purchasing consumer complies with minimum age requirements". Article 20(6) applies the same rule to electronic cigarettes and refill containers.
• In the US, the Prevent All Cigarette Trafficking (PACT) Act defines a "delivery seller" in 15 U.S.C. § 375 simply as "a person who makes a delivery sale" — and its definition of "cigarette" includes electronic nicotine delivery systems, with every "component, liquid, part, or accessory".

A shop with one employee and a shop with a thousand are the same "person" under all four. The size exemption sits in the platform law, and a small online shop selling restricted goods mostly lives under the product law.

The defence is proved one order at a time

If the duty does not scale, neither does the way out of it. Each of these regimes either offers a defence or prescribes a check, and in every case the evidence is tied to a single sale.

Under section 146(4) of the Licensing Act, a seller charged with an underage sale has a defence if they believed the buyer was 18 or over and "had taken all reasonable steps to establish the individual's age". Subsection (5) says what that means: the seller "asked the individual for evidence of his age, and the evidence would have convinced a reasonable person." Section 10(2) of the Tobacco and Vapes Act uses a similar structure, allowing the seller to prove that they took steps specified in regulations or "otherwise took all reasonable steps to avoid the commission of the offence."

Both defences belong to the seller, who has to raise them. That happens months after the sale, about one transaction, by the person accused. What has to exist at that point is a record that ties an age check to that specific order: who was checked, what evidence they provided, and when.

The US rule is more prescriptive. 15 U.S.C. § 376a(b)(4) requires a delivery seller to verify the buyer's name, date of birth and address against a commercially available database built primarily from government sources before accepting the order, and to ship by a method that requires an adult to sign for the parcel and show government-issued photo ID. Section 376a(c) then requires a record of every delivery sale, kept "until the end of the 4th full calendar year that begins after the date of the delivery sale". The EU directive asks for something similar at the system level: the retail outlet must give the authorities of the destination country "a description of the details and functioning of the age verification system."

So the real compliance unit is not the policy or the website banner. It is the record per order — and a small business has to produce it with the same completeness as a large one, without a compliance team to build the process.

Why the manual check is the expensive one

The obvious low-cost method for a small shop is manual: ask the customer to email a photo of their ID, look at it, approve the order. It feels cheap because it has no invoice. It has three costs that show up later.

It is weak evidence. A photo in an inbox shows that someone sent an image of a document. It does not show that the document belonged to the buyer, that it was genuine, or which order it was matched to — unless someone files it against the order every time, by hand. The record the defence relies on is only as good as that filing habit on the busiest day of the year.

It is a data-protection liability. A folder of passport and driving-licence photos is personal data held without an end date. Article 5 of the UK GDPR requires personal data to be "limited to what is necessary" (data minimisation), kept "for no longer than is necessary" (storage limitation) and protected with "appropriate technical or organisational measures", and Article 5(2) makes the controller responsible for being "able to demonstrate compliance". A shared mailbox full of identity documents is hard to defend against any of the three.

It is staff time spent at the worst moment. Every manual review is a person reading a document instead of packing an order, and every review is a delay between payment and dispatch. For the customer, a request to email a passport photo to an unknown address is also the moment a legitimate shop looks least like one.

Checks on the doorstep have a different gap. Where the law requires them — the PACT Act's adult signature, for example — they come in addition to the check at the order, not instead of it. Section 376a(b)(4) requires both.

What scales with size is the penalty, not the duty

Size does matter in one place: how much a failure costs relative to the business.

The fine under section 146 is level 5 on the standard scale, which section 85 of the Legal Aid, Sentencing and Punishment of Offenders Act 2012 made unlimited. The section 10 offence carries level 4, which section 122 of the Sentencing Act 2020 sets at £2,500.

The heavier exposure for a small alcohol retailer is repetition. Section 147A makes it an offence for the premises licence holder where alcohol is unlawfully sold to under-18s on the same premises on "2 or more different occasions within a period of 3 consecutive months". On conviction, section 147B allows the court to suspend the part of the licence that authorises retail sales of alcohol "for a period not exceeding three months". A national chain absorbs a suspended site. A business with one warehouse has nothing left to sell from.

The DSA exemption has an edge too. A platform that outgrows the small-enterprise thresholds keeps the Article 19 exemption only "during the 12 months following their loss of that status", so a small business that also runs a community or marketplace should know which side of the line it is on.

What to do as a small shop

• Map each product line to its product rule, not to your headcount. Alcohol, tobacco, vapes and nicotine products each carry an age-of-sale rule that applies from the first order.
• Check the age before the sale is accepted, not after dispatch. Section 146(5) turns on asking for evidence; Article 18(4) says "at the time of sale"; the PACT Act says before accepting the order.
• Keep one record per order: the verification result, the method, the date, and the order it belongs to. Test it by picking a random order from three months ago and seeing how long it takes to produce.
• Stop collecting ID photos by email. Use a method that returns a result and keeps only what you need, and set a retention period you can explain.
• Keep the doorstep layer where the law requires it. For US tobacco and vape deliveries, an adult signature with photo ID is required on top of the order-time check.
• If you sell across borders, check the destination country's rules first. The Tobacco Products Directive lets member states prohibit cross-border distance sales entirely, and requires registration where they do not.

A small business is exempt from the duty to make a platform safe for children. It is not exempt from the duty not to sell restricted goods to them, and that duty is proved one order at a time.