Industry guide

Vape shop age verification: what federal law requires

By Apparent Logic, LLC · Updated October 5, 2026
Legal sources last checked September 2026 · How we review sources

For vape and smoke shops. The federal minimum age of sale is 21, and FDA’s rule calls for a photo-ID check of any buyer under 30 (21 CFR 1140.14(a)(2), (b)(2)).

What the law says

The federal minimum age is 21

Pub. L. 116-94, signed December 20, 2019, raised the federal minimum age of sale for tobacco products from 18 to 21. 21 U.S.C. 387f(d)(5) now reads: “It shall be unlawful for any retailer to sell a tobacco product to any person younger than 21 years of age.” The federal definition of “tobacco product” covers products “containing nicotine from any source” (21 U.S.C. 321(rr)).

FDA says the age limit applies to liquid nicotine, e-cigarettes and e-liquids, and that the federal minimum age of sale “applies to all retail establishments and persons with no exceptions.” States may add stricter rules on the sale of tobacco products and on who may buy them (21 U.S.C. 387p(a)(1)).

The photo-ID rule

21 CFR 1140.14(b)(2) says each retailer “must verify by means of photographic identification containing the bearer’s date of birth that no person purchasing the product is younger than 21 years of age,” and that “No such verification is required for any person over the age of 29.” FDA’s undercover-buy guide puts it this way: retailers “must check the photo identification of anyone under the age of 30 who attempts to purchase a tobacco product.” FDA raised the age from under 27 to under 30 effective September 30, 2024 (89 FR 70483).

Inspections and penalties

In an unannounced undercover-buy inspection, an underage buyer supervised by an FDA-commissioned inspector tries to buy a tobacco product. Not asking a buyer under 30 for photo ID is a violation in its own right.

Repeat violations at the same outlet within set time windows can bring civil money penalties (Tobacco Control Act §103(q)(2), 21 U.S.C. 333 note). FDA lists these current maximums, adjusted yearly for inflation (45 CFR 102.3):

The statute also sets a higher schedule for retailers without an approved training program, but FDA’s guidance says it “will use the lower schedule for all retailers until regulations are developed that establish standards for retailer training programs.”

Five or more violations within 36 months at one outlet can also lead FDA to seek a no-tobacco-sale order (21 U.S.C. 333(f)(8); Tobacco Control Act §103(q)(1)(A), 21 U.S.C. 333 note), which the same guidance describes as “prohibiting the sale of tobacco products at a retail outlet indefinitely or for a specified duration.”

Delivery sales: the PACT Act

The PACT Act’s definition of “cigarette” includes e-cigarettes (15 U.S.C. 375). Delivery sellers must check the buyer’s age against a commercially available database before accepting an order, and use shipping that requires an adult’s signature and photo ID on delivery (15 U.S.C. 376a(b)(4)). They must also keep a record of each delivery sale until the end of the fourth full calendar year that begins after the sale (15 U.S.C. 376a(c)(2)).

Sellers who ship cigarettes or e-cigarettes across state lines into a state, locality or tribal area that taxes cigarettes or smokeless tobacco must first file a statement with the U.S. Attorney General and that jurisdiction’s tobacco tax administrators, then file monthly shipment reports (15 U.S.C. 376(a)).

State rules: Alabama as one example

In Alabama, Act 2025-403, effective June 1, 2025, requires each Specialty Retailer of Electronic Nicotine Delivery Systems (a state permit class) to admit only people 21 and over, checking every patron’s age at the door with an ABC Board-approved third-party service that scans a driver license or nondriver ID (Ala. Code §28-11-7.1(d)).

A Board rule effective October 13, 2025 says that software “shall not release a permit holder from liability” (Ala. Admin. Code r. 20-X-27-.01(4)(b)3). Our Alabama guide has more.

What it means at the counter

Some shops write down an ID-check policy, such as checking every customer, so each shift follows the same rule. 21 CFR part 1140 doesn’t require records of in-store ID checks. What to keep, and for how long, is a question for your lawyer.

Where Check ID fits

Check ID is a tool that helps your staff check IDs. On iPhone and iPad, it reads the barcode on US and Canadian licenses and ID cards, compares the birth and expiry dates with your rules, such as a minimum age of 21, and shows a clear result, such as Verified, Underage or Expired ID. Verified means only that the dates meet your rules. Your staff make the call, including comparing the photo with the customer.

Check ID can’t tell whether a card is genuine: a well-made fake can carry a valid barcode.

A scan record never keeps the name, date of birth, address, ID number or a picture of the ID. Free and Pro scan history covers 7 days on your device or in your own iCloud, and can be turned off. Check ID for Teams keeps scan records on our servers, for two years by default.

We don’t claim that Check ID has been approved on any Alabama permit application. Whether a scan helps your situation under these rules is a question for your lawyer or regulator.

Frequently asked questions

Sources

• 21 U.S.C. §321, §333 and note, §387f, §387p; 15 U.S.C. (PACT Act) §375, §376, §376a; Pub. L. 116-94, retrieved September 2026.
• 21 CFR part 1140; 45 CFR 102.3; 89 FR 70483, retrieved September 2026.
• FDA: Tobacco 21, enforcement actions for underage sales, undercover buy inspections, civil money penalties and no-tobacco-sale orders (guidance, December 2016), retrieved September 2026.
• Alabama: Act 2025-403; Ala. Code §28-11-7.1; Ala. Admin. Code ch. 20-X-27, retrieved September 2026.