Selling age-restricted products online: verification, delivery and texts

In a physical shop, the assistant sees the customer and, if in doubt, asks for ID. In an online shop you see no one. If you sell products that cannot be sold to minors, the question is not whether to do something, but what is reasonable to do at each step: at registration, at purchase and, above all, at delivery.

This article is a practical guide, not a legal opinion. The rules vary depending on the product and, in some cases, on the autonomous community (Spanish region). Before launching an age-restricted category, confirm with your adviser what applies to you.

Which products usually have a minimum age

• Alcoholic drinks: in Spain they cannot be sold to minors, and the autonomous communities have their own rules on their sale and promotion.
• Tobacco: its sale is reserved for authorised channels, so a general online shop cannot sell it.
• Vaping and related products, with age restrictions and their own regulations, which have been changing.
• Fireworks, whose minimum age depends on the product's category.
• Knives and certain tools, depending on the type of item.
• Adult products and content.
• Video games and films with age ratings, which in many cases are for guidance only but are worth displaying.
• Some food supplements whose labelling states they are not suitable for minors.

The three layers of verification

1. Notice and declaration

This is the minimum: an age notice when entering the category or the shop and a declaration by the customer that they are of the required age. It makes the requirement clear and means the customer takes on some responsibility, but on its own it is a weak barrier: anyone can click «Yes, I am over 18».

2. Data at purchase

Ask for the date of birth at registration or in the order, and an identity document when the product justifies it. PrestaShop lets you ask for the date of birth in the customer form. If you ask for it, use it: an order containing a restricted product should not go through if the date indicates a minor.

Remember that asking for data has a privacy cost. Ask only for what you need, explain it in your privacy policy and do not keep copies of identity documents unless it is essential.

3. Check at delivery

This is the layer that protects most, because it is the only one where someone actually sees the person. Many carriers offer delivery services with an identity or age check of the recipient, or delivery only into the addressee's hands. For sensitive products, it is the measure that truly closes the loop.

What counts as reasonable verification

There is no universal formula, but there is a principle: the higher the product's risk, the stronger the verification.

Document what you do and why. If you ever have to explain your measures, a written procedure applied consistently carries more weight than a checkbox.

How to set it up in PrestaShop

• Group restricted products in their own categories, or tag them with a feature, so you can apply rules to them.
• Ask for the date of birth at registration, and make sure guest checkout is not possible if the product requires it.
• Ask for the data you need in a single step. If you need an identity document as well as the date, ask for it at registration and not in a separate form the customer will abandon.
• Restrict the carriers for those products to those offering hand delivery with a check.
• Show the restriction on the product page, before adding to cart, so nobody gets a surprise at checkout.
• Review your advertising: some regulations limit how these products are advertised, including on social media and in remarketing campaigns.

What to put in your texts

• In the terms of sale: which products have a minimum age, that the buyer declares they meet it, that delivery may require identification and what happens if it is not provided (the order is not delivered and is refunded according to your terms).
• In the privacy policy: why you ask for the date of birth or the document, how long you keep them and who sees them, including the carrier.
• On the product page: a clear notice of the restriction.
• In the confirmation email: that the recipient will have to show identification.

Common mistakes

• An age gate on the home page and nothing else, with the products reachable by direct URL and purchasable as a guest.
• Asking for the date of birth and not using it for anything.
• Sending restricted products with the same standard carrier that leaves the parcel with the neighbour.
• Texts that mention a minimum age without stating which products it affects.
• Copying the terms of a shop in another country with different rules.

And as with everything that depends on forms and validations, test the flow every time you update PrestaShop, the theme or the checkout module: a template change can easily make a mandatory field disappear without anyone noticing.

How to solve it in PrestaShop

RKR Registro ampliado adds the fields you need to the registration form (address, phone, tax ID (NIF), company, province and others, up to twelve), which you enable one by one, reorder and can make mandatory; in Spain it can genuinely check the control letter of the NIF and NIE (Spanish tax and foreigner identification numbers), and it integrates with the official GDPR module for export and erasure. The Pack Tienda legal en España includes RKR Legal Assistant to prepare drafts of your terms and privacy policy with the shop's real data, together with the withdrawal, Omnibus and RKR Datos de Facturación modules and a three-hour onboarding session. Neither of them verifies age by itself: they help you ask for the data and explain it properly.