Selling Vapes and E-cigarettes on Shopify: What the Law Says

If you're selling vapes, e-cigarettes, or nicotine products online, you're operating in one of the most tightly regulated categories in e-commerce. The rules aren't suggestions — they carry real legal consequences, and Shopify's own policies can get your store suspended if you're not compliant. Many merchants assume that adding a simple age checkbox at checkout is enough. It isn't, and that misunderstanding has cost store owners their accounts, their ad spend, and in some cases, their entire businesses.

The problem is that the regulatory landscape for vaping products sits at the intersection of trading standards law, advertising regulations, and platform policy — all of which have teeth. In the UK, selling nicotine products to anyone under 18 carries criminal liability for the business owner, not just a fine for the platform. In the US, the FDA's deeming regulations mean that selling covered tobacco products without proper age verification puts you in violation of federal law. These aren't theoretical risks; enforcement is increasing year on year.

In this post, you'll learn exactly what the law requires in the UK and US, how Shopify's own policies affect vape merchants specifically, what compliant age verification actually looks like, and what steps you can take today to protect your store. Whether you're already selling or considering launching a vape product line, this guide gives you the practical foundation you need.

What UK Law Actually Requires for Online Vape Sales

In the United Kingdom, selling nicotine inhaling products — including e-cigarettes, vape pens, and refill cartridges — to anyone under 18 is a criminal offence under the Nicotine Inhaling Products (Age of Sale and Proxy Purchasing) Regulations 2015. This law mirrors the Tobacco and Related Products Regulations 2016, which also governs how vaping products are marketed and described online. As a Shopify merchant, you are personally liable as the business owner if a sale is made to a minor, regardless of whether you process orders manually or through automation.

The regulations don't just require that you ask a customer's age — they require that you take reasonable precautions to prevent underage sales. Trading standards officers have interpreted this to mean that passive methods like an age tick-box or a date-of-birth entry field are insufficient on their own. They do not verify identity, and any 14-year-old can type in a false birth date. Courts have found that merchants relying solely on these methods were not taking reasonable precautions, which removes one of the key legal defences available to you.

What UK law practically demands is a combination of measures: a clear policy, an age gate on your storefront, a checkout-level verification step, and — ideally — a documented process for age verification that uses third-party identity data. The Information Commissioner's Office also expects you to handle any personal data collected for verification purposes in line with UK GDPR. This means you need a lawful basis, a retention policy, and the ability to demonstrate compliance if audited. Getting this right from day one is far easier than retrofitting it after a trading standards investigation.

US Federal and State Requirements for Vape Merchants

In the United States, the regulatory picture is more fragmented but no less serious. At the federal level, the Prevent All Cigarette Trafficking (PACT) Act was expanded in 2021 to include e-cigarettes and vaping products, making it illegal to ship these items through the US Postal Service. It also requires sellers to use private carriers that verify age at delivery, register with state tobacco tax authorities, and maintain detailed shipping records. Non-compliance can result in civil penalties and criminal prosecution — not just account termination.

The FDA's Center for Tobacco Products has deeming authority over e-cigarettes, which means any product containing nicotine derived from tobacco falls under federal tobacco regulations. Retailers selling online must take steps to ensure they don't sell to anyone under 21, following the federal Tobacco 21 law that raised the minimum purchase age in 2019. This applies to your Shopify store even if you're selling what you consider a low-nicotine or wellness-adjacent product — if it contains nicotine, the federal age limit applies without exception.

At the state level, requirements vary significantly. States like California, New York, and Washington have their own vape-specific legislation that may impose stricter requirements than federal law. Some states require specific warning labels on product pages, others restrict flavoured products entirely, and several require merchants to collect and remit tobacco excise tax on out-of-state sales. If you're shipping nationally, you are responsible for understanding the rules in every state you sell into — not just your home state. A compliance matrix, updated annually, is a basic operational necessity for any serious US-based vape merchant.

How Shopify's Own Policies Affect Vape Merchants

Shopify permits the sale of vaping products in principle, but the platform imposes its own rules on top of legal requirements, and these rules are enforced through account review. Shopify's Acceptable Use Policy requires that all merchants selling age-restricted goods comply with applicable laws and take active steps to prevent sales to minors. If a chargeback pattern, a customer complaint, or a routine review flags your store, Shopify can suspend your account while it investigates — freezing your funds and taking your store offline.

Beyond account suspension risk, Shopify's payment processing rules also come into play. Shopify Payments does not support high-risk product categories in most regions, which means most vape merchants are already on third-party processors like Stripe, PayPal, or dedicated high-risk gateways. Each of these processors has its own terms around age verification and may require you to demonstrate compliance documentation before approving your account or when reviewing a dispute. A merchant who can't show a documented verification process is at a significant disadvantage when a processor queries a transaction.

What this means practically is that your compliance documentation needs to serve two audiences simultaneously: regulators and your payment infrastructure. You should be able to produce, on request, a clear description of your age verification process, evidence that it is actively applied at checkout, and a log of verification decisions if your solution supports that. AgeGuard is built specifically to help Shopify merchants meet this dual requirement — providing a compliant gate that creates the kind of paper trail processors and regulators both want to see. Getting this infrastructure in place before you need it is always cheaper than recovering from a suspension.

What Compliant Age Verification Looks Like in Practice

Compliant age verification for a vaping store typically involves two layers working together. The first is a storefront age gate — a modal or interstitial that appears before a visitor can browse your products. This signals intent, deters casual underage browsing, and is increasingly expected by regulators as a minimum baseline. It should not be skippable with a back-button refresh, and it should record a session-level flag that the visitor has confirmed their age before proceeding into the catalogue.

The second layer is checkout-level verification, which is where real enforcement happens. At this stage, you want a mechanism that either matches the customer's provided details against a third-party identity database or flags the order for manual review if verification cannot be completed automatically. In the UK, this might use credit reference agency data or electoral roll matching — methods that are practical for adult buyers and largely inaccessible to children. In the US, this tier should also support delivery instruction handoffs so that your carrier partner can complete a physical ID check at the door.

A common mistake merchants make is treating these two layers as interchangeable — deploying an age gate and assuming that's sufficient for checkout too. It isn't. The age gate is a deterrent and a legal signal; the checkout verification is your enforceable control. You also need to think about what happens when verification fails. Your system should clearly prevent the order from completing, provide the customer with a reason, and log the event. Merchants who can demonstrate a functioning failed-verification workflow are in a much stronger position with both regulators and payment processors than those who simply have a gate that waves everyone through.

Advertising Restrictions Vape Merchants Must Know

Beyond the sale itself, advertising nicotine products online comes with its own layer of restrictions that catches many merchants off guard. In the UK, the Committee of Advertising Practice (CAP) Code prohibits e-cigarette advertising that is likely to appeal to people under 18, that makes health claims, or that encourages non-smokers to start vaping. This applies to your website copy, your email campaigns, your social posts, and any paid digital advertising you run — not just TV and print.

On social platforms, advertising vaping products is prohibited outright on Facebook, Instagram, TikTok, and Google Shopping. This severely limits the paid acquisition channels available to vape merchants and makes organic content and SEO disproportionately important. When writing product descriptions and blog content, you need to be careful that your language doesn't cross into health claim territory — even phrases like "a healthier alternative" can trigger an ASA complaint in the UK. Reviewing your existing content against CAP guidance is a sensible quarterly task.

Email marketing for vape products also requires careful list hygiene. Under the CAP Code and US CAN-SPAM requirements, you should not be marketing nicotine products to anyone who hasn't explicitly confirmed their age during signup. If you're using a standard Shopify email capture popup without an age verification layer, your list may contain subscribers who never confirmed they're adults — which is a compliance risk if you're sending product promotions. Segmenting your list by verified age status, and suppressing unverified contacts from product campaigns, is a straightforward step that reduces your exposure considerably.

Conclusion

Selling vapes on Shopify is entirely legal and commercially viable — but only if you've built the right compliance foundations from the start. The key requirements are consistent: document your age verification process, implement a two-layer gate that covers both browsing and checkout, understand the specific rules in every market you sell into, and keep your advertising well inside the boundaries set by the CAP Code and platform policies. Merchants who treat compliance as an afterthought tend to discover its importance at the worst possible moment — during a platform review or a trading standards inquiry.

The good news is that the technical side of compliance has never been easier to implement. Purpose-built tools exist that handle the storefront gate, the checkout verification layer, and the audit logging that regulators and processors want to see.

Try AgeGuard free at saltai.app — no credit card required.