A plain-English walkthrough of Tobacco 21, the FDA's photo-ID rule, what happens during a compliance check, and how vape and smoke shops build a record that shows good-faith diligence.
Educational guide, not legal advice — see the disclaimer below. Last reviewed August 2026.
On December 20, 2019, the President signed the Further Consolidated Appropriations Act, 2020 (Pub. L. 116-94), which amended the Federal Food, Drug, and Cosmetic Act to raise the federal minimum age to purchase tobacco products from 18 to 21. "Tobacco products" under the FDA's rule covers cigarettes, smokeless tobacco, cigars, hookah tobacco, and Electronic Nicotine Delivery Systems (ENDS) — vapes, e-cigarettes, and vaping devices among them.
This is a federal floor. It applies in every state and territory regardless of what state law says, and a state can set stricter rules (a higher age, mandatory scanning, shorter data retention) but never a lower one.
FDA regulations spell out exactly when a retailer has to look at a photo ID. Under 21 CFR 1140.14, a retailer must verify — by photographic identification that shows the bearer's date of birth — that a tobacco purchaser is not underage. The regulation carves out one exception: "no such verification is required for any person over the age of 29." In practice, that means checking ID for anyone who could plausibly be under 30.
That threshold isn't fixed forever — the FDA raised it in 2024 from under-27 to under-30 as part of a broader rule tightening age-verification and vending-machine restrictions (89 Fed. Reg. 70483). The same regulation also requires cigarette and smokeless-tobacco sales to happen in a direct, face-to-face exchange — no vending machines outside adult-only facilities — and bars breaking a pack to sell loose or single units.
Judging "could this person be under 30" by eye is exactly the kind of guesswork that gets retailers cited. It's also why many shops simply check ID on every purchase rather than trying to eyeball an age threshold.
The FDA contracts with state agencies to run unannounced retail compliance checks: someone who is actually underage (a "decoy") attempts to buy a tobacco or vape product, with store staff given no advance warning. If the sale goes through, that's a violation.
A first violation at a location typically results in a warning letter. Continued or repeat violations escalate to civil money penalties (CMPs) on a statutory schedule that increases with each violation within a rolling multi-year window:
| Violation at the same outlet | Typical outcome |
|---|---|
| 1st | Warning letter (no fine) |
| 2nd (within 12 months) | Civil money penalty, low hundreds of dollars |
| 3rd–4th (within 24 months) | Civil money penalty, several hundred to a few thousand dollars |
| 5th (within 36 months) | Civil money penalty, several thousand dollars — and eligible for a no-tobacco-sale order |
| 6th+ (within 48 months) | Up to $10,000 on the statutory schedule; case-by-case |
Separately, the FDA's overall maximum civil penalty per violation — the ceiling it can seek for serious cases such as unauthorized product sales — is adjusted for inflation annually and now exceeds $20,000. Five or more violations within 36 months at one location can also trigger a no-tobacco-sale order, which bars that outlet from selling tobacco or vape products for a period set by an administrative law judge. Sources: FDA, Advisory and Enforcement Actions and FDA, Civil Money Penalties and No-Tobacco-Sale Orders for Tobacco Retailers.
Federal law is the floor, not the ceiling, and the state layer is moving fast. A growing number of states have added or strengthened their own age-verification and vape-specific rules on top of Tobacco 21, and some are shifting from a simple "check the ID" standard toward registry- or mandate-based models for vape retailers specifically.
Alabama is the clearest example: under Act 2025-403, effective October 1, 2025, every holder of a Specialty Retailer of ENDS permit must run state-preapproved third-party age-verification scanning software with real-time pass/fail results and retained scan logs — not just a visual ID check. Other states are watching enforcement outcomes closely, and similar registry or mandatory-scanning proposals continue to surface in state legislatures. If you operate a vape or smoke shop, treat your state's tobacco/ABC authority as the authoritative source — state requirements can exceed the federal baseline described above, and they change more often than federal law does.
Check ID doesn't detect fake IDs, and it isn't a certification of legal compliance — no app can promise either of those. What it does is make the checklist above easier to actually run, every shift, without relying on memory or guesswork:
Barcode, mobile driver's license, or passport/national ID via NFC — works offline at the register, so a slow connection never becomes an excuse to skip a check.
The date of birth encoded on the ID is compared against your age threshold (21, or a custom cutoff) — no manual math, no eyeballing.
Team accounts keep a record of every check — time, result, staff member — without storing the patron's name, photo, or date of birth. Documentation that can support your good-faith compliance efforts, without building a database of customer identities.
Generate a Verification Activity Report (PDF or CSV) in seconds, with a hosted, shareable copy an inspector or your insurer can independently verify.
21. The federal Tobacco 21 law (Pub. L. 116-94, signed December 20, 2019) raised the minimum age to purchase any tobacco product — including e-cigarettes, vapes, and other ENDS — from 18 to 21 nationwide. It applies in every state, regardless of what state law says.
FDA regulations (21 CFR 1140.14) only require photo-ID verification for anyone who could reasonably be under 30 — no check is required for a customer who clearly appears older than 29. Many shops scan every customer anyway, since it removes guesswork and creates a consistent, defensible record.
FDA contracts with state agencies to send someone who appears to be a minor into a store to attempt a purchase, with staff not told in advance. A first violation typically draws a warning letter. Repeat violations at the same location escalate to civil money penalties on a statutory schedule, and five or more violations within 36 months can trigger a no-tobacco-sale order barring sales at that location for a period.
Yes. The federal PACT Act treats e-cigarettes and vapor products as regulated tobacco for shipping purposes. Delivery sellers must register with the ATF and with every state and locality they ship into, verify each buyer's age before the sale, require an adult signature on delivery, file monthly reports, and keep sales records — on top of any in-store ID-check requirements.
Increasingly, yes. A growing number of states are tightening tobacco and vape enforcement, and some are moving toward registry- or mandate-based models. Alabama, for example, now requires Specialty Retailers of ENDS to run state-preapproved third-party age-verification scanning software and retain scan logs. Check with your state's tobacco or alcohol control authority for requirements specific to your location.
No. A scanner is a tool, not a substitute for a documented policy and trained staff — it doesn't detect physical forgeries on its own, and it doesn't make the sale/no-sale decision for you. What it does well is remove age-math mistakes and create a timestamped record that a check happened, alongside good-faith staff training.
Check ID scans a customer's ID in under a second and keeps a no-PII log your team can produce on request.