One register, four rulebooks — and only one clerk to remember them all

On December 20, 2019 the President signed legislation amending the Federal Food, Drug, and Cosmetic Act and raising the federal minimum age for sale of tobacco products from 18 to 21. FDA is explicit that it “applies to all retail establishments and persons with no exceptions,” and covers cigarettes, smokeless tobacco, hookah tobacco, cigars, pipe tobacco, liquid nicotine, e-liquids and ENDS including e-cigarettes — plus nicotine from any source, synthetic included.

Photo ID is required for anyone under 30

FDA’s August 2024 final rule, Prohibition of Sale of Tobacco Products to Persons Younger Than 21 Years of Age (89 FR 70483, effective September 30, 2024), amended 21 CFR 1140.14 in two mechanical steps: “18” became “21” wherever it appeared, and “26” became “29.” So photographic verification is required for anyone buying cigarettes, smokeless tobacco or covered tobacco products, and is not required only for a person over the age of 29. FDA’s plain-language version: use a photo ID for anyone under 30.

That is a judgement made in two seconds about a stranger’s face, which is why many stores stop guessing and check everyone. The same rule barred vending-machine sales of these products where anyone under 21 is present or permitted to enter at any time — for a store the public walks into, effectively a prohibition.

Alabama’s Act 2025-403 created the ABC Specialty Retailer of Electronic Nicotine Delivery Systems permit, effective June 1, 2025, for locations meeting the definition in § 28-11-2(19). Those locations must be restricted to people 21 or older, must post signs saying so, and pay a $1,000 annual permit fee. The part that matters for anyone shopping for a scanner is on the ABC Board’s own permit page, and is worth quoting rather than paraphrasing:

Note what that page does not say. It publishes the requirement and the form, not the criteria the Board applies or a list of pre-approved products. No software vendor — us included — can honestly tell you in advance that its product satisfies it. Put the question to the ABC Board, in writing, before you buy anything. Our Alabama alcohol & vape ID laws guide covers the statute behind the permit; vape shop age verification covers the federal layer above it.

Senate Bill 650, the Deshawn Jagwan Act, took effect September 1, 2025 and added Alcoholic Beverage Code § 109.61(a-1): a person must visually inspect and access electronically readable information on a driver’s license, commercial driver’s license, or identification certificate in any retail sale of an alcoholic beverage on a permitted or licensed premises for off-premises consumption. Manual entry into an electronic reader is allowed where the card cannot be scanned.

It is a general rule with an exclusion list — distillers and rectifiers, wineries, brewers, brewpubs, mixed beverage permittees, restaurants and food-and-beverage-certificate holders operating one, public entertainment facility property during a sporting event, concert, festival or similar temporary event, certain carrier and delivery permits, and sealed-container pickup at an outdoor area. A convenience store selling beer or wine to go appears on none of those, so on the face of the statute it is covered.

Three details change how it lands. TABC may not discipline a permit holder for an (a-1) violation for a sale made before September 1, 2027, and must adopt implementing rules by then. Safe harbors cover a connectivity outage where staff still inspected the ID visually, and a sale where the scan said the card was valid and the buyer 21 or older. And SB 650 rewrote the retention rule: § 109.61(b) now reads, in full, “A person may not retain information accessed under this section” — the old exception for TABC-mandated retention was struck out. Detail in our Texas SB 650 guide.

The same shape recurs across state codes: the state cannot promise you will never sell to a minor, so it offers a defense to the seller who did the check properly. The wording differs; the elements rhyme.

Ohio Revised Code § 4301.611 makes it an affirmative defense that the buyer presented a license or ID card, that a transaction scan indicated the card was valid, and that the sale was made in reasonable reliance on both — while adding that a scan device does not excuse checking that the description and picture match the person holding it. Ohio separately caps what you may record from a scan (name, date of birth, card expiration, card number, no more) and forbids passing it to third parties for marketing, at § 4301.61(D). See our Ohio guide.

Iowa writes the pattern into its lottery statute: § 99G.30(3) sets the age at twenty-one and adds that “it shall be an affirmative defense to a charge of a violation under this section that the retailer reasonably and in good faith relied upon presentation of proof of age in making the sale.” Which is where the lottery trap sits: the lottery age is set by state law, and states disagree — Ohio Revised Code § 3770.08(C) bars selling a ticket to anyone under eighteen. Read your own state’s lottery statute rather than inferring it from the beer cooler.

Every version of the defense turns on what happened at the counter and on your ability to show it later. A defense you cannot evidence months on, when the citation arrives, is not much of a defense.

Convenience retail has its own digital age-verification standard. TruAge describes itself as a privacy-first not-for-profit company and its product as “a not-for-profit solution developed by NACS and Conexxus” — NACS being the National Association of Convenience Stores. It integrates directly into major point-of-sale systems, accepts any valid US driver’s license, a TruAge-enabled mDL or the TruAge app, and logs proof of verification at the point of sale. If your POS supports it, that is a real and well-designed path, and this page is not an argument against it.

Check ID solves a nearer problem: it scans the physical and mobile IDs a clerk is handed today, on an iPhone or iPad you already own, with no integration project and no new hardware. An operator who is not re-platforming the register this quarter can start checking and logging this afternoon. The two are not mutually exclusive.