Online tobacco age verification laws and penalties: UK

The United Kingdom has exactly one statutory duty to operate an age verification policy for tobacco, and it is Scottish. Section 4B of the Tobacco and Primary Medical Services (Scotland) Act 2010 makes it an offence to carry on a tobacco or nicotine vapour product business and fail to operate such a policy at the premises where the business is carried on.

Subsection (2) then removes it. The duty does not apply to premises from which products "are, in pursuance of a sale, despatched for delivery to different premises" where no other tobacco business is carried on there. A pure fulfilment operation — an order comes in, a parcel goes out — sits outside the only law in the country that names age verification as a thing a tobacco retailer must have.

That is not a loophole. It is a drafting choice about what a policy is for: the Scottish policy is a Challenge 25 rule, requiring staff to establish age where a customer "may be under the age of 25", and a warehouse has no customer standing in front of it. But it does explain why online sellers routinely conclude that age verification law does not reach them, and why that conclusion is about to become expensive.

What actually binds an online seller

Not a duty to check. An offence to sell.

The Tobacco and Vapes Act 2026, which received Royal Assent on 29 April 2026, recasts the age of sale across the UK. Two of its offences matter to a remote retailer, and they commence on different dates.

Section 10 makes it an offence to sell a vaping product or nicotine product to a person under 18 in England and Wales. Its commencement note puts it in force on 29 October 2026 — six months after Royal Assent, under section 175(1).

Section 1 is the generational provision: an offence to sell a tobacco product, a herbal smoking product or cigarette papers "to a person born on or after 1 January 2009". It comes into force on 1 January 2027 under section 175(3). Nothing about it is limited to a shop counter, and its effect compounds annually — the cohort that can never lawfully be sold tobacco grows by one birth year every year, so a static date-of-birth rule in a checkout will drift out of compliance on its own.

Until section 10 commences, the vape position rests on regulation 3 of the Nicotine Inhaling Products (Age of Sale and Proxy Purchasing) Regulations 2015, which prohibits sale to under-18s subject only to narrow medicinal exceptions.

The defence is the requirement

Neither section commands an age check. Both make one the only exit.

Section 1(2) and section 10(2) are drafted identically. It is a defence for the person charged to prove either that they "took such steps as may be specified in regulations made by the Secretary of State" to verify the customer's age, or that they "otherwise took all reasonable steps to avoid the commission of the offence."

Two consequences follow, and they are the operative ones for anyone building a checkout.

First, the burden is on the seller. The offence itself asks only whether a sale happened to a person in the protected class. Everything about intention, care and process lives in the defence, which the defendant must prove.

Second, the prescribed-steps limb is a placeholder until the regulations arrive. They are subject to the affirmative resolution procedure, and where they touch devolved competence the Secretary of State must first obtain the consent of the Welsh Ministers. Until they are made, an online retailer is relying entirely on the second limb — "all reasonable steps" — with no statutory safe harbour describing what those steps are. Building against the eventual regulations is therefore not the plan. Building something a court would recognise as reasonable is.

For a remote sale that means the check has to interrogate something the customer cannot simply assert, and it has to leave a record attached to the order, because the defence is proved months later against a specific transaction.

The penalties

The fine for both offences is the same: on summary conviction, a fine not exceeding level 4 on the standard scale, which section 122 of the Sentencing Act 2020 sets at £2,500 for offences committed on or after 1 October 1992.

Most enforcement will not reach a court. Section 37 lets an enforcement authority in England issue a fixed penalty notice for the age-of-sale offences, including sections 1 and 10, offering discharge of liability by payment within 28 days. The amount is £200 for those offences. For an offence under section 17 — offences connected with retail licences — the fixed penalty is set at level 4 instead, an order of magnitude higher.

Beyond fines, the Act carries forward the orders that actually stop a business: restricted premises orders and restricted sale orders, with separate offences for breaching them.

The licensing regime is where online sellers land

Having fallen outside the Scottish age verification duty, an English online retailer walks straight into section 16.

Subsection (1) provides that an individual must not sell relevant products in England, expose them for sale, or possess them for the purpose of sale, "except under the authority of and in accordance with a personal licence." Subsection (2) applies the same rule to premises: a person must not use or permit the use of premises in England for the storage of relevant products for the purpose of their sale, or for "the supply of relevant products to retail customers", except under a premises licence.

Read on its face, storage for the purpose of sale and supply to retail customers describe a fulfilment warehouse as readily as a shop. This is a reading of the section rather than a determination about any given operation, and the detail will sit in the regulations the Secretary of State must make under subsection (4). What is already settled is the timing: under section 175(4) the licensing provisions commence on a day appointed by regulations, not on the six-month default. That is the date to watch.

Scotland is moving the other way

While England makes the age check the price of a defence, section 63 of the same Act quietly modernises Scotland's. It amends sections 4 and 4A of the 2010 Act so the defence becomes that "the accused had taken such steps as may be prescribed to establish the customer's age", and repeals the subsections that previously tied the defence to inspecting particular documents.

The direction is the same one the Online Safety Act took for age-restricted services: away from "did you look at a passport" and toward "was your process adequate". A document check remains a way to satisfy that. It is no longer the statutory definition of satisfying it.

What this looks like in practice

• Treat 29 October 2026 and 1 January 2027 as separate projects. Vapes and tobacco commence on different dates with different tests.
• Make the tobacco rule a date-of-birth comparison against 1 January 2009, not an age threshold. An "over 18" check will silently pass ineligible customers from 2027 onward.
• Assume the burden is yours. Design for what you will need to prove, not for what a customer sees.
• Stamp the verification result onto the order. The defence is proved transaction by transaction, long after the sale.
• Do not wait for the prescribed-steps regulations. Until they exist there is no safe harbour, and "all reasonable steps" is judged against what was available at the time of sale.
• Watch the licensing commencement regulations separately from the Act. Section 175(4) leaves that date open.

The Scottish carve-out is a fair description of what an online tobacco sale is: a transaction with nobody in the room. Every other part of the regime treats that as the seller's problem to solve.