Age Verification for Click and Collect Orders

Click and collect is one of the most popular fulfilment options Shopify merchants offer today, giving customers the convenience of shopping online while picking up in person. But if your store sells age-restricted products — alcohol, tobacco, knives, adult content, energy drinks, or anything else regulated by law — click and collect creates a specific compliance gap that most merchants underestimate. The order arrives at your counter, the customer reaches for their bag, and suddenly your staff member has to make a judgement call with no system supporting them.

The core problem is that standard Shopify checkout flows are designed around delivery, where age verification happens at the door. With click and collect, there is no courier acting as a gatekeeper. Your staff become the last line of defence, often without training, clear signage, or the digital tools they need to refuse a sale confidently and legally. A single failed check can result in a fine, loss of licence, or in serious cases, criminal liability for the business owner.

In this post, you will learn how click and collect differs from delivery when it comes to age verification, what UK and international compliance obligations apply, how to configure your Shopify store to support staff at the point of collection, and what a robust age verification workflow looks like in practice. Whether you sell wine, CBD, or bladed goods, these steps apply directly to your operation.

Why Click and Collect Creates a Unique Compliance Risk

Most Shopify merchants selling age-restricted products focus their compliance efforts on the checkout — a date-of-birth field, a tick-box declaration, or a third-party age gate plugin. These tools serve an important function, but they only verify intent, not identity. When a customer selects click and collect, they are committing to collect the goods themselves, yet there is typically no mechanism to confirm that the person turning up at your counter is actually the person who placed the order, let alone that they are old enough to legally receive it.

This gap matters because regulators do not distinguish between delivery and collection when it comes to restricted sales. Under the Licensing Act 2003 in England and Wales, for example, a sale of alcohol to a person under 18 is illegal regardless of how the product reaches them. Trading Standards inspectors conduct test purchase operations in retail environments specifically to catch businesses that rely on the anonymity of a digital order to bypass physical age checks. The risk is real and the penalties — fines up to £20,000, licence revocation, and personal liability — are significant.

The practical risk is compounded by the human element. A staff member who sees a queue building at the click and collect counter, who does not know the customer, and who has no digital record of what age verification was completed at checkout, is far more likely to hand over an order without asking for ID. This is not negligence — it is an entirely predictable outcome of a system that was never designed with age-restricted fulfilment in mind. Fixing it requires both technology and process.

What UK and International Law Actually Requires at the Point of Collection

In the UK, Challenge 25 is the voluntary but widely adopted retail standard that requires staff to ask for ID from anyone who looks under 25, even when selling to someone who may legally be 18. It is used by supermarkets, off-licences, and convenience stores, and it applies equally to click and collect environments. Having a Challenge 25 policy on paper is not enough — regulators expect you to demonstrate that staff are trained, that the policy is displayed, and that there is a mechanism to record refusals.

For merchants operating across multiple jurisdictions, the picture becomes more complex. In the United States, state-level alcohol laws vary dramatically: some states require that couriers or store staff obtain a physical signature and check ID for every alcohol collection, while others allow self-certification at checkout. Merchants selling CBD or THC products face an equally fragmented regulatory landscape. If you are shipping or making products available for collection across state or national borders, you need jurisdiction-specific workflows, not a single blanket checkbox at checkout.

What this means practically is that your Shopify store needs to capture the right data at checkout and surface it to staff at the point of collection. The customer's declared age, the verification method used, and any jurisdiction-specific requirements should be visible on the order confirmation screen that your staff see when a customer arrives. Without that visibility, your team is making decisions blind, and your business is exposed whether or not the individual is actually old enough.

How to Configure Shopify Checkout for Click and Collect Age Verification

The first step is making sure your checkout actively captures age verification data in a way that persists through to fulfilment. Shopify's native checkout does not include an age verification field by default, so merchants typically use a combination of checkout scripts, app integrations, or Shopify Functions to add this step. The key requirement is that the verification data — including the method used and the declared date of birth — is stored against the order as a note or metafield, not simply discarded after the customer clicks through.

The second configuration step is tagging click and collect orders distinctly at the point of checkout. If a customer selects in-store pickup as their fulfilment method, that order should be automatically tagged in Shopify with something like collection-age-check-required when it involves a restricted product. Your staff can then filter the order view in Shopify POS or your fulfilment dashboard to see exactly which orders require additional ID verification before handover. This eliminates guesswork and creates a clear process that does not depend on individual staff memory.

Third, consider your product tagging strategy. If you sell a mix of age-restricted and unrestricted products, not every click and collect order will need the same treatment. Using Shopify product tags such as age-restricted-18 or age-restricted-21 in combination with order-level automation means your system can apply the right verification prompt dynamically, rather than requiring staff to know which SKUs are restricted from memory. AgeGuard is built to handle exactly this kind of tag-based conditional logic within the Shopify ecosystem.

Building a Staff Workflow That Actually Works in Practice

Technology only solves half the problem. The other half is making sure your team knows what to do when a flagged order arrives at the counter. A practical click and collect age verification workflow should include four steps: identify the order as restricted before the customer reaches the counter, ask for ID before retrieving the goods, record the ID type and result, and either complete or refuse the sale with a clear reason noted on the order. This process should take no more than 60 seconds when your system is set up correctly.

Training is non-negotiable. Staff need to know which forms of ID are legally acceptable in your jurisdiction — in the UK, this is typically a passport, photo driving licence, or PASS-accredited card — and they need to feel confident refusing a sale even when the customer pushes back. Role-play refusal scenarios during onboarding, post an acceptable ID list at the collection point, and make sure your refusal process includes adding a note to the Shopify order so that you have a record if a customer disputes the decision later.

Signage at the collection counter is also a regulatory expectation, not just a courtesy. A visible Challenge 25 notice, an acceptable ID notice, and a clear statement that age-restricted goods will not be released without verification all demonstrate due diligence to any inspector who visits. These physical elements work alongside your digital workflow to create a defensible compliance posture, and they cost almost nothing to implement once your staff process is established.

Handling Edge Cases: Proxies, Disputes, and Failed Verifications

One of the most common edge cases is the proxy buyer: an adult who places a click and collect order on behalf of a minor who then turns up to collect. This is a well-documented and illegal practice — knowingly supplying alcohol or other age-restricted goods to a minor through a proxy is an offence in almost every jurisdiction. Your workflow needs to account for the fact that the person collecting may not be the account holder, which means ID verification at collection must be mandatory regardless of what age was declared at checkout.

If your staff refuse a collection — because the customer cannot produce valid ID, appears to be under age, or is clearly collecting on behalf of someone else — that refusal needs to be recorded immediately. In Shopify, this means adding an order note with the reason, the staff member's name, and the time of the attempt. This record is your evidence if a customer later disputes the refusal, if a Trading Standards investigation occurs, or if your insurer asks about your compliance procedures. A verbal refusal with no paper trail is almost as risky as no refusal at all.

Disputes can also arise when a customer believes their checkout verification should be sufficient and objects to being asked for ID again in person. Your staff need a clear, polite script for this situation — something like: "Our policy requires ID to be checked at the point of collection for all age-restricted products, regardless of what was verified online." This is consistent with best practice across licensed retail and reflects the legal reality that online verification does not substitute for a physical ID check at the point of sale.

Conclusion

Click and collect is a genuinely valuable fulfilment option, but for merchants selling age-restricted products, it introduces compliance obligations that cannot be managed by checkout tick-boxes alone. A robust age verification workflow combines digital tools — order tagging, app integrations, metafield storage — with trained staff, clear signage, and a documented refusal process. The merchants who get this right are not just protecting themselves legally; they are building the kind of operational trust that supports long-term trading relationships with retailers, licensees, and regulators alike.

The key takeaways are straightforward: capture and persist age verification data at checkout, tag restricted orders so staff can identify them instantly, verify ID physically at the point of collection, and record every refusal. None of this requires a large budget or a specialist compliance team — it requires the right configuration and a clear internal process.

Try AgeGuard free at saltai.app — no credit card required.