“We’re the only age verification plugin that meets the new FDA regulations.”
That’s the claim of one age verification system hoping to sign up online vape vendors as customers. But is it true? The FDA doesn’t mandate any special techniques for age verification. You can read and reread the Deeming Rule till you’re blue in the face, and you won’t find any advice on how to verify customers’ ages.
That doesn’t let retailers off the hook though.
The bottom line is that the FDA doesn’t want any vape business selling to minors. If you do, you’ll be treated like a criminal. First you’ll get a warning letter. Along with the letter comes a demand for a written response within 15 days. After that, there are progressively more severe enforcement actions taken, including fines (“civil money penalties”) and eventually being prohibited from selling tobacco products (“no-tobacco-sale orders”).
The federal agency has begun issuing warning letters to retailers for selling newly deemed products to minors, but not a single one has been a brick-and-mortar vape shop. Apparently, vape shops have gotten the message, and are taking the mandate to check ID’s seriously. That’s the good news.
The bad news is that, by my count, 21 of the 55 offenders in the first enforcement round were online vape businesses. This could become a serious problem. If the FDA can show that a substantial number of online commerce sites sell to minors—and, of course, are selling products the FDA claims are aimed at “youth,” like candy-flavored e-liquid—they will face far less resistance imposing a ban on flavors and tougher restrictions on internet and mail order sales.
The FDA is not going to stop testing websites for weaknesses. And if you get caught selling to a minor, they’ll probably come back to your site frequently to see if the issue has been addressed, and to try to catch you again. What can online vapor retailers do to stay out of trouble? The answer is simple, but not foolproof.
A pop-up that asks if a website visitor is over 18 is worthless. Only a service that checks the customer against databases of recognized public records can be considered reliable (though still not perfect). So when a customer enters their address and personal information in the vendor’s site, the age verification service compares what is entered with known information about adults at that address.
These services aren’t free, and some of them are expensive. But look at it this way: if your future as a business depends on your ability to avoid the sting tactics of the FDA, what price is too high? If you lose 50 cents of profit from each sale, it probably is well worth it.
Does good age verification eliminate the possibility of a sale to a minor? No. If a kid steals a parent’s identifying information and credit card, it’s possible to trick the system. But it eliminates most risks, and it proves something else to the FDA.
Due diligence means taking reasonable steps to avoid a bad outcome. It doesn’t mean your precautions guarantee no chance of sales to tricky teenagers, but it shows you’ve made a good faith effort to avoid them. Due diligence won’t protect you from getting a warning letter, but it may reduce your odds of extreme scrutiny in the future.
According to Schell Hammel, owner of the Vapor Bar and longtime industry advocate, this is very important. “You need to be able to show the FDA, and your state authorities, that you’ve done your due diligence,” she told me last week. “It shows you’re a serious and responsible business owner, and that you care.”
The 2010 federal PACT Act (Prevent All Cigarette Trafficking) is frequently quoted by age verification providers as though it applies to vapor products. It doesn’t. It only regulates shipping of cigarettes and smokeless tobacco. However, it provides generally good guidelines for what vaping sites should consider when choosing a service.
The PACT Act says that the seller is responsible for “Obtaining the full name, birth date, and residential address of [the customer]; and verifying that information using a commercially available database or aggregate of databases regularly used by government and businesses for age and identity verification and authentication.”
“I recommend that vendors self-test to make sure their age verification software is actually turned on,” says Greg Conley of the American Vaping Association. “It’s possible that software updates in your e-commerce platform could turn off the age verification.”
If you never test it yourself, you might find that out the hard way.
Many states have separate requirements for online sales. California, Texas, Tennessee, and others have specific rules and guidelines for what online retailers must do. Some require the seller to have an image of the buyer’s photo ID, even though the FDA does not require that. Other states have prohibited online sales to their residents entirely.
Also, each state has its own set of penalties for businesses that sell restricted adult products to minors. You may find that an illegal sale that only earns a warning letter from the FDA receives a far stiffer punishment from the state authorities.
There is simply no substitute for speaking to an attorney who can advise you on state and local laws.
There is no perfect way to avoid selling to minors, but there are good ones. The key is to make a serious effort by choosing a legitimate service, and accepting that it is a necessary cost of doing business.
As we begin to navigate the uncertain world of tobacco regulations, we’re put in an awkward position. No vapor business owner believes they’re selling “tobacco products,” but they have to proceed as though they believe it. Online vapor products sellers have to take this seriously, not just to protect themselves, but to protect the industry itself—and vapers.
The FDA is on the hunt for online sellers that cut corners or ignore the law. Every vendor they catch selling to a minor adds to the pile of ammunition they’re assembling to impose even harsher and more restrictive regulations. As a responsible vaping vendor, you represent represent the whole industry—and all vapers too. Please don’t damage our already fragile reputation to save a few cents.