Online tobacco age verification laws and penalties: USA

Start with the rule the online channel exists as an exception to. Under 21 CFR 1140.16(c), "a retailer may sell cigarettes and smokeless tobacco only in a direct, face-to-face exchange between the retailer and the consumer." Vending machines and self-service displays are given as examples of what that forbids. Paragraph (c)(2) then permits, by enumeration, "mail-order sales, excluding mail-order redemption of coupons and distribution of free samples through the mail."

That framing explains everything downstream. The United States did not design an online tobacco channel and then regulate it. It preserved a counter-sale model, carved out mail order, and has spent fifteen years bolting the missing counter back on. The result is the only regime in this series that requires the buyer's age to be verified twice, by two different methods, at two different moments.

The two checks

The operative provision is 15 U.S.C. § 376a(b)(4), added by the Prevent All Cigarette Trafficking Act. A delivery seller who mails or ships tobacco products:

At the order. Shall not accept a delivery sale order without "obtaining the full name, birth date, and residential address of that person" and verifying that information "through the use of a commercially available database or aggregate of databases, consisting primarily of data from government sources, that are regularly used by government and businesses for the purpose of age and identity verification and authentication."

Subparagraph (B) closes the obvious hole: "No database being used for age and identity verification under subparagraph (A)(iii) shall be in the possession or under the control of the delivery seller, or be subject to any changes or supplementation by the delivery seller." The check must be run against data the seller cannot touch. A date-of-birth field validated against nothing is not a partial implementation of this requirement; it is none of it.

At the door. The seller shall use a method of shipping that requires the purchaser, or an adult of at least the minimum age, "to sign to accept delivery of the shipping container at the delivery address", and requires that person to provide "proof, in the form of a valid, government-issued identification bearing a photograph of the individual" that they meet the minimum age.

Note what both limbs measure against: "the minimum age required for the legal sale or purchase of tobacco products, as determined by the applicable law at the place of delivery." As in the EU, the governing age is the destination's, not the seller's.

Which age, and for which products

The federal floor is 21. FDA's Tobacco 21 requirement raised the minimum age for sale of tobacco products from 18 to 21 in December 2019, and 21 CFR 1140.14(a) now states plainly that "no retailer may sell cigarettes or smokeless tobacco to any person younger than 21 years of age", with verification by photographic identification required for anyone who is not over 29.

The product scope of the PACT Act comes from a definition rather than a list. 15 U.S.C. § 375(2) provides that "cigarette" includes roll-your-own tobacco and "an electronic nicotine delivery system", and expressly "does not include a cigar". One subparagraph therefore pulls the entire vape category into the delivery-sale regime and leaves cigars outside it. Any compliance analysis that starts from product categories rather than from § 375 will get this backwards.

The shipping problem is a compliance problem

18 U.S.C. § 1716E makes all cigarettes and smokeless tobacco "nonmailable", and bars the Postal Service from accepting or transmitting any package it "knows or has reasonable cause to believe" contains them. Because § 375 folds ENDS into "cigarette", the mail ban reaches vapes; because it excludes cigars, § 1716E(b) leaves them out.

Reasonable cause is defined broadly enough to matter to a marketing team: it includes "a statement on a publicly available website, or an advertisement, by any person that the person will mail matter which is nonmailable under this section in return for payment", and the fact that a person appears on the Attorney General's list of non-compliant delivery sellers under § 376a(e).

So the age check has to survive a shipping method that excludes the Postal Service and requires an adult signature with photo ID at the address. Those two constraints together are why online tobacco fulfilment in the US is expensive in a way the age check alone would not explain.

The state layer arrives automatically

The provision that does the most work for a multi-state seller is § 376a(a)(3). Each delivery seller must comply with "all State, local, tribal, and other laws generally applicable to sales of cigarettes or smokeless tobacco as if the delivery sales occurred entirely within the specific State and place", expressly including excise taxes, "licensing and tax-stamping requirements", "restrictions on sales to minors", and other legal requirements relating to sale, distribution or delivery.

This is a different mechanism from the one in the dating and social media context, where states legislate separately and platforms track fifty statutes. Here a single federal sentence imports each destination's entire tobacco code into the transaction and makes breaching it a federal matter as well as a state one. A seller does not choose which state rules to follow. The address on the order chooses for them — including licensing regimes that some states apply in a way that makes direct-to-consumer shipment impracticable or unavailable.

The penalties

15 U.S.C. § 377 carries both kinds.

Criminal. "Whoever knowingly violates this chapter shall be imprisoned for not more than 3 years, fined under title 18, or both." That exposure is personal, and it attaches to knowing violations of any part of the chapter — including the age verification requirements.

Civil. For a delivery seller, a penalty not exceeding the greater of "$5,000 in the case of the first violation, or $10,000 for any other violation", or "2 percent of the gross sales of cigarettes or smokeless tobacco of the delivery seller during the 1-year period ending on the date of the violation."

The second limb is the one to design around. It converts a per-incident penalty into a percentage of a year's revenue, so the cost of a defective age check does not scale with the number of bad orders caught — it scales with how large the business was while the defect existed. Common carriers and delivery services face a separate and much lower schedule, $2,500 for a first violation and $5,000 within a year of a prior one, and § 377(b)(3)(B) gives them a defence where they have "implemented and enforces effective policies and practices for complying" with the delivery provisions.

Civil penalties are imposed in addition to criminal ones and to any other damages, equitable or injunctive relief, "including the payment of any unpaid taxes".

Separately, FDA enforces the retail requirements in 21 CFR part 1140 against retailers directly, and publishes its retail compliance and enforcement activity.

What this looks like in practice

• Run the database check before accepting the order, not before shipping. The statute conditions acceptance of the order itself.
• Use a third-party database you cannot edit. Subparagraph (B) disqualifies any source the seller possesses, controls, or can supplement.
• Resolve the minimum age from the delivery address. Both limbs of § 376a(b)(4) measure against the law at the place of delivery, over a federal floor of 21.
• Classify products by § 375, not by category. ENDS are in; cigars are out; the same definition drives both the PACT Act and the mail ban.
• Contract for adult-signature delivery with photo ID as a hard requirement, and keep the carrier's proof. It is half the statutory check.
• Keep delivery records to the end of the fourth full calendar year after the sale, as § 376a(c)(2) requires, because the verification you will be asked to prove is years old by then.

The UK asks whether your check was reasonable. The EU asks whose law you checked against. The US asks both, then asks who signed for the parcel.