Short answer: an age popup is not enough for an online vape store in the US. Since 2021 the PACT Act requires online vape sellers to verify each buyer's age and identity with an outside verification service before accepting the order, and to use adult-signature delivery. On WooCommerce that means three layers: an age gate on the site, a real age check at checkout, and order handling that holds unverified orders. CBD stores face different, state-specific rules, but the same setup protects them too.
Vape, e-liquid, tobacco and CBD stores are some of the most regulated shops on the internet, and payment processors and shipping carriers watch them closely. A weak age check can cost you far more than a fine: it can cost you your payment account. This guide explains what US rules expect, what WooCommerce does and doesn't do out of the box, and how to build an age verification setup that protects the business without killing your conversion rate.
What the rules expect from online vape sellers
Tobacco 21
Since December 2019, the federal minimum age to buy any tobacco or vape product in the US is 21. Your age gate and checkout must use 21, not 18, for US customers.
The PACT Act
The Preventing Online Sales of E-Cigarettes to Children Act brought vapes and e-liquids under the PACT Act from 27 March 2021. For online sellers this means, in summary:
- Age and identity verification of each buyer through a commercially available verification service before the sale is accepted.
- Adult signature on delivery, with an ID check at the door.
- Registration and monthly reports to the ATF and to the states you ship to, plus collecting applicable state and local taxes.
- Shipping limits: the US Postal Service no longer delivers vape products to consumers, so stores use private carriers that offer adult-signature service.
The age gate on your homepage helps, but it is not the verification the law describes. The check that counts happens before you accept the order.
CBD and hemp products
CBD rules are set mostly at state level and change often. Many stores use 21+ to be safe, and some states set their own age or labelling rules. Because the rules vary, the most useful thing your site can do is support different rules per state.
What WooCommerce doesn't do on its own
WooCommerce has no built-in age verification. Out of the box it will happily take an order from anyone. You need to add:
- A site-wide age gate that is cache-friendly and SEO-safe.
- A minimum age per product or category (for example 21 for vapes, 18 for accessories).
- A real age check at checkout, connected to a verification service.
- A way to hold orders that fail or skip the check, instead of shipping them.
- Clear adult-signature notices for your packing and shipping team.
How to set it up with Advanced Age Verification Pro
- Start with a site-wide gate. Show a date-of-birth popup set to 21 for US visitors. It works with WP Rocket, LiteSpeed Cache and Cloudflare and lets search engines through, so your product pages keep ranking.
- Set minimum ages per product or category. Mark your vape and e-liquid categories as 21+, and leave non-restricted items like cases or chargers open if you like. See WooCommerce display scope and restricted products.
- Turn on the checkout age check. Restricted orders are checked before they are accepted. Connect AgeChecker.Net, Stripe Identity or Veriff to verify buyers. AgeChecker.Net checks most US adults against databases first, so many customers pass without uploading an ID. Setup: checkout age check, order hold and adult signature.
- Hold unverified orders. Orders that need a check stay on hold until the customer passes, so nothing ships by mistake.
- Add adult-signature notices. Pro adds a notice to order emails and packing slips so your team knows the parcel needs an adult signature.
- Block states you don't ship to. Use geo-location rules to block or restrict states where your products are banned.
- Keep the paper trail. The compliance vault records each check and exports CSV or PDF reports, useful for audits, payment processors and your PACT Act records.
Keep verified customers happy
- Verify once. Returning customers who already passed should go straight to checkout.
- Say why at checkout. "Federal law requires us to verify your age before shipping vape products" turns a hurdle into a sign of a trustworthy store.
- Offer a fallback. If a genuine adult fails the automatic check, let them upload an ID for manual review instead of abandoning the cart.
- Watch your numbers. Pro's analytics show pass rates and drop-offs, so you notice quickly if something breaks.
Common mistakes vape and CBD stores make
- Using 18 as the minimum age for US customers.
- Treating the homepage popup as the legal age check.
- Shipping orders automatically before the age check finishes.
- An age gate that blocks Googlebot, so product pages disappear from search.
- Storing ID photos on your own server when the provider could store only the result.
This article is a practical overview, not legal advice. Vape, tobacco and CBD rules change often and differ by state, so confirm your obligations with the ATF, your state authorities or a compliance specialist.
Protect your store
Advanced Age Verification Pro gives WooCommerce vape and CBD stores a cache-friendly age gate, minimum ages per product, a checkout age check with order hold, ID verification and compliance reports in one plugin. Try the free version first if you just need the age gate, then upgrade when you're ready. Your settings carry over.
