Weryfikacja wieku przy sprzedaży vape online w UE
A wholesale buyer in Rotterdam opened age-gate-config-v1.pdf days before launch. The threshold still read 16+, copied from an older template. The fix took twenty minutes: set it to 18+, date-stamp the file, log who changed it. That field is where vape age verification EU 18+ stops being a slogan and becomes a setting, because Directive 2014/40/EU Article 20 fixes the product rules while member states add the 18+ threshold and the method used to check it. Below sits the working file — a store-versus-online comparison, a seven-point pre-launch check, the records worth keeping, and the second check at handover.
Where the 18+ requirement sits in EU law
Read Directive 2014/40/EU on PLN-Lex: in force 19 May 2014, applicable 20 May 2016. Article 20(3)(b) caps nicotine at 20 mg/ml (2%); Article 20(3)(a) limits tanks to 2 ml and refill containers to 10 ml. Article 20(2) requires a six-month pre-market notification to each member state’s competent authority through EU-CEG under Implementing Decision (EU) 2015/2183. None of this sets an EU-wide online age check: the strona Komisji dotycząca e-papierosów covers product rules, while the 18+ threshold, accepted ID and any limit on distance sales are added by member states.
What member states may add
- A notification fee, filed as a dated receipt in the market folder.
- Local-language labelling under Article 20(4), checked against the EU vape label requirements.
- Restrictions on flavours, logged as an allowed-SKU list in
market-rules-2026.xlsx. - Online sales limits and a mandatory 18+ age verification step, recorded with the authority reference.
The podstawami zgodności dla firm hurtowych gives the product baseline; the Poland compliance checklist shows how to phrase the question to a local authority and which receipt to keep, without guessing at fees or approval times.
In-store versus online: the same gate, different evidence
A shop assistant sees a face; a storefront sees a form. The decision is the same — 18+ or no sale — but the evidence differs. The table maps seven stages to both channels, assuming a house policy of photographic ID below the documented age threshold and an online gate that blocks the catalogue until a date of birth is entered.
| Stage | In-store practice | Online practice | Record kept |
|---|---|---|---|
| First contact | Staff request photographic ID below the documented age threshold | Catalogue locked until a date of birth is entered; 18+ only opens it | age-gate-config-v1.pdf: threshold 18+, dated change log |
| Proof of age | Passport, national ID card or driving licence inspected at the till | Date-of-birth field plus a declared 18+ confirmation | dob-field-spec.txt and the under-18 reject log |
| Refusal | Sale declined; item stays on the shelf | Checkout returns an under-18 error and freezes the basket | refusal-log-2026.csv: timestamp, order ID, reason code |
| Repeat visit | Staff request ID again on return | A session flag holds the 18+ decision until it expires | session-policy.md: flag duration and re-check rule |
| Named owner | Shift supervisor signs the daily till checklist | Named administrator holds the configuration change log | access-list.csv of who may edit the threshold |
| Handover | Buyer shows ID again at the counter if policy requires | Person collecting shows 18+ ID before the parcel is released | handover-check-log.csv: released or declined code |
| Audit | Monthly refusal check against till records | Quarterly export of gate events matched to order IDs | age-gate-audit-Q1-2026.xlsx, signed by the compliance lead |
Reading the four columns
A refusal at the till and one at checkout are the same event with two logs; an auditor will ask for both. Copy the column labels verbatim into your SOP so the till checklist lines up with the quarterly gate export, and write any order-ID mismatch into the audit workbook.
Seven checks before the age gate goes live
Tick each one in age-gate-launch-checklist.pdf with a date and a name; an item without a name is not done.
- Threshold — set 18+ in every market configuration; one 16+ leftover fails the launch.
- Date-of-birth field — reject future or empty values and retain the input only for the written period under applicable data protection rules.
- Refusal path — block checkout, freeze the basket, write a reason code to the refusal log.
- Session persistence — state the 18+ flag duration and re-check rule in
session-policy.md. - Access control — list editors in
access-list.csv; require a second sign-off on any edit. - Handover rule — add the second check to
handover-procedure.mdfor cases where ID is not produced. - Evidence export — run a test order and match its gate events to the order ID in
age-gate-audit-Q1-2026.xlsx.
Ownership of each check
Checks 1, 4 and 5 sit with the storefront administrator, 3 and 7 with the auditor, 2 and 6 with the compliance lead who signs the file. The przewodniku zgodności hurtowej vape w UE lists the shared folder, so organise the launch checklist beside those documents by market code.
Record retention and the privacy boundary
Keep the decision, not the person: a timestamp, an outcome code, the order ID and the configuration version. A date of birth entered at checkout reaches the 18+ decision and is not a marketing field; under applicable data protection rules, define in writing how long it is retained, who reads it, and when it is deleted. Copy no identity-document images into the order record unless a national rule explicitly asks, and note the authority reference if it does. age-gate-events-2026.csv holds one row per attempt — timestamp, outcome, order_id, config_version, market — with a dated deletion note and access-list.csv in the same folder. Restrict reading to the compliance lead and auditor. Queries on stored fields belong on the frequently asked questions page.
A second age check at handover and collection
Passing the online gate is one decision; releasing the parcel is another. In handover-procedure.md, the person collecting shows photographic ID proving 18+, the name is matched to the order reference, and handover-check-log.csv gets a released or declined outcome. Where a third party accepts the parcel on someone else’s behalf, the same 18+ check applies to the person taking it, and the log records whose ID was seen. If ID is not produced, the handover does not proceed and the order returns to the status in the written procedure. Keep the step narrow — it governs the person at the counter and sits in the same audit file as the online gate. A decline gets a reason code, a time and the order ID, kept for the same period as the online refusal log; the counter instruction is versioned with the gate configuration date.
Fitting the age gate into the wider compliance file
The gate does not stand alone in a compliance programme. Nicotine strength on a listing comes from Article 20(3)(b), written as 2% on the page; Article 20(4) settles packaging wording in the labelling file. Article 20(2) runs the six-month EU-CEG notification, Article 20(7) the annual sales data, Article 20(9) adverse effects and corrective measures, and Implementing Decision (EU) 2016/586 the child-safety details. Each document is versioned alongside the gate configuration. A listing such as one of the multi-flavour device product pages shows the 2% statement, the Article 20(4) warnings and a checkout refusing an under-18 result — a correct label behind an unconfigured gate still fails an audit.
market-rules-2026.xlsx— 18+ threshold, accepted ID types, distance-sales limits, dated and signed.age-gate-config-v1.pdf— threshold, refusal message, session flag duration, change log.age-gate-launch-checklist.pdf— the seven checks, each with a name and a date.age-gate-events-2026.csvihandover-check-log.csv— both outcomes, one retention schedule.- EU-CEG receipt and the Article 20(2) six-month date, filed beside the Commission page on implementing the Tobacco Products Directive.
When a national authority asks how age was checked, the answer is a folder, not a sentence. The lista kontrolna dokumentacji produktu dla detalistów gathers the product-side documents; file each export with the date of the configuration it came from.
FAQ
Does Directive 2014/40/EU set an EU-wide 18+ online age check?
No. Article 20 of Directive 2014/40/EU, in force 19 May 2014 and applicable 20 May 2016, sets product rules: the 20 mg/ml (2%) cap in Article 20(3)(b) and the 2 ml tank limit in Article 20(3)(a). The 18+ threshold and check method come from member states. Log each market’s threshold in market-rules-2026.xlsx and keep the dated configuration; an auditor asks for the national basis.
Which documents belong in an age verification audit file?
Five files cover most audits: market-rules-2026.xlsx for the 18+ threshold and accepted ID types; age-gate-config-v1.pdf with the change log; age-gate-launch-checklist.pdf with seven ticked checks; age-gate-events-2026.csv for online outcomes; and handover-check-log.csv for collection. Add the Article 20(2) EU-CEG receipt and its six-month notification date, then date-stamp every export.
How long should an online 18+ result stay valid for a returning visitor?
No single EU figure applies. Set the duration in session-policy.md as a documented house decision, state it in the configuration file, and apply it in every market unless a national authority requires a shorter interval. Article 20(7) annual sales data does not set session length. Log a fresh 18+ decision for each completed order in age-gate-events-2026.csv so a returning visitor never bypasses the event trail.
Can we keep a copy of a customer’s identity document?
Only where a national rule explicitly asks, and record the reason in the market folder. Under applicable data protection rules, keep the decision rather than the document: timestamp, outcome, order ID and config_version in age-gate-events-2026.csv. Define a written retention period, restrict access to the compliance lead and auditor, and date-stamp each deletion note. Article 20(4) covers packaging and leaflets, not ID copies.
What happens if a buyer refuses to show ID at collection?
The handover does not proceed. handover-procedure.md fixes the step: the person collecting shows photographic ID proving 18+, the name is matched to the order reference, and handover-check-log.csv records released or declined. A decline gets a reason code, a time and the order ID, kept for the same period as the online refusal log. No exception is made for a regular buyer.
Does a correct 2% label make an age gate unnecessary?
No. Article 20(3)(b) caps nicotine at 20 mg/ml (2%) and Article 20(4) fixes packaging wording, but neither covers who may buy. A listing can show a compliant 2% statement and still fail an audit if checkout accepts an under-18 date of birth. Check three together: the Article 20(4) warnings, the 2% statement, and a gate that blocks the order.
Następne kroki
Open age-gate-config-v1.pdf, set 18+ for each market, and tick the seven checks with a name and a date. For the current per-market 18+ requirements, accepted identity documents or a copy of our compliance file, skontaktuj się z zespołem PuffCell UE and ask for the age verification pack. Bring the same folder to the next audit: configuration, checklist and two outcome logs.
Ostatnio przeglądano: 5 listopada 2026
