Online sales of age-restricted products

This guidance is for Scotland

Selling age-restricted products via the internet presents particular issues and retailers must have effective systems in place for preventing sales to customers who are underage.

This guide applies to all products that have age restrictions on sales (see the 'Underage sales' section of this website).

Duty of retailers

It is the responsibility of retailers to ensure they do not sell age-restricted products online to people who are under the minimum legal age. This means setting up effective systems capable of verifying the age of potential purchasers to ensure they are above the minimum legal age to purchase a product. When making an assessment of such systems, account should be taken of legal requirements to take all reasonable precautions and to exercise all due diligence to avoid committing an offence. These legal requirements are a retailer's defence in consumer protection legislation.

To ensure these systems stay effective, they need to be regularly monitored and updated (where necessary) to identify and put right any problems or weaknesses, and to keep pace with any advances in technology.

Generally speaking, there is no definitive answer as to what constitutes taking all reasonable precautions or exercising all due diligence. However, past court case decisions in relation to other areas of consumer protection have established that a retailer's defence is more likely to fail if positive steps or precautions are not taken, resulting in a conviction.

Retailers should undertake a risk analysis of their business to identify weak points where underage online sales could occur, and then introduce measures to counter those risks.

Extra duties for specific product types

Corrosive products and bladed articles

The Offensive Weapons Act 2019 includes requirements for corrosive products and bladed articles where sales are made remotely (which includes online, post and telephone sales). The retailer must meet certain conditions if they want to rely on the defence that they took all reasonable precautions and exercised all due diligence.

These conditions are:

• the retailer operated a system for checking that the purchaser was not aged under 18 and that the system was likely to prevent such a sale
• when the product was dispatched, it was clearly marked to show that it contained a corrosive product / bladed article and that it should only be delivered into the hands of a person aged 18 or over
• the retailer took all reasonable precautions and exercised all due diligence to ensure that the package would be delivered into the hands of a person aged 18 or over
• the retailer did not deliver, or arrange to deliver, the package to a locker

For more information on these types of products, see 'Knives, other bladed items and corrosive substances'.

Air weapons

In relation to the sale of an air weapon, a firearms dealer must only sell and transfer the weapon to the customer face-to-face and not by distance means (for example, by means of a catalogue or the internet). For more information on these types of products, see 'Crossbows, air weapons and imitation firearms'.

Checks unlikely to satisfy 'due diligence'

Retailers should take positive steps to verify the age of the purchaser when selling age-restricted products. The following are examples that are unlikely to be enough to satisfy the requirements of taking all reasonable precautions and exercising all due diligence:

• relying on the purchaser confirming they are over the minimum age
• asking the purchaser simply to provide a date of birth
• using tick boxes to ask purchasers to confirm they are over the minimum age
• using a general disclaimer such as: 'Anyone ordering this product from our website will be deemed to be at least 18'
• using an 'accept' statement for the purchaser to confirm that they have read the terms and conditions and are over the minimum age
• using e-payment services such as PayPal, Nochex or Worldpay. These services may require a customer to be over 18, but they may not verify a user's age
• only accepting payment by credit card. Credit cards are not available to under 18s, but certain debit and prepaid cards are. Your payment systems are unlikely to be able to differentiate between the different types of cards, so it is essential that you have additional age verification in place

Young people will seek to challenge conventions and test boundaries. In the case of online sales, if retailers do not make positive checks, young people could potentially evade the stringent proof-of-age checks that are required on the high street.

Age verification checks

The following is a guide to possible steps and precautions that retailers could adopt to assist with age verification. However, it should be noted that these may not be suitable for some situations and retailers will need to assess what steps are suitable and appropriate to their individual circumstances. Retailers may be able to develop other methods of age verification.

Age verification concepts in a fast-moving digital world are challenging in terms of effectiveness. No system is fail-safe and any service that relies on remote verification has the potential for errors.

Many websites now require purchasers to register details or to set up accounts for future purchases, which means that age verification checks may only be required for the initial set-up of accounts or on the first purchase from the website.

Age verification on delivery

Retailers should have procedures in place, including age verification checks at the point of delivery, to ensure their delivery drivers request valid proof of age to confirm that the purchaser is over the minimum age to buy, and take delivery of, the product in question. It should be noted that third-party couriers may not accept responsibility for age verification. However, as can be seen in the next paragraph, there are requirements for delivery companies in certain circumstances.

Where a delivery company has an arrangement with a retailer to deliver bladed articles and/or corrosive products, and the sales are made remotely, they must deliver the products into the hands of a person aged 18 or over. It is important therefore that delivery companies have effective systems in place to ensure that deliveries are not made to underage persons. For more detail on the delivery requirements for these particular types of products, see 'Knives, other bladed items and corrosive substances'.

Online age verification checks

Online age verification software is available that makes use of various sources of information in order to verify both age and identity during the ordering process. These checks include using the electoral register and/or credit reference agencies. There are also businesses that offer online access to electoral register information, which could be used to verify a purchaser's age.

Follow-up offline checks

In some circumstances, it may not be possible to verify a potential purchaser's age to conclude an online order. It is therefore suggested that further checks could be carried out, such as requiring the customer to provide a valid / acceptable proof of age, which can then be appropriately checked.

Collect in-store

For some retailers that also have a high street presence, purchasers could view and reserve products online and then collect in-store, where age verification could be carried out by members of staff, as for a normal face-to-face transaction.

Collect from a locker

Knives - or any other age-restricted products - should not be delivered to self-service lockers, as it would affect the due diligence defence.

Ordering and delivery platforms

Some retailers partner with businesses that provide online ordering and delivery services. These businesses operate their own age verification policies. Customers are required to confirm their age when the order is placed and proof of age is required before the delivery is completed.

Further information

It is the responsibility of the retailer to ensure that products are only sold to purchasers old enough to buy them, if there is any doubt, the transaction should not proceed.

A PAS (publicly available specification) has been published, which was developed by the Digital Policy Alliance and BSI (British Standards Institution). PAS 1296: Online age checking. Provision and use of online age check services. Code of Practice is designed to help traders, particularly those that conduct age checks or provide age check services, to comply with the law.

For more general information about online sales, please see 'Consumer contracts: distance sales' and 'Internet auction sites and marketplaces'.

Trading Standards

For more information on the work of Trading Standards services - and the possible consequences of not abiding by the law - please see 'Trading Standards: powers, enforcement and penalties'.

In this update

Additional information as a result of the new requirements of the Offensive Weapons Act, which came into force in June 2022.

Last reviewed / updated: April 2024