Direct answer: an online tobacco retailer must take reasonable steps to prevent an underage sale. A date-of-birth box or an adult-only notice is not, by itself, proof of age.
What a check may involve
The checkout can ask for identifying details and may require further evidence before an order is accepted or dispatched. A failed or incomplete check can pause or cancel a new order. ICO guidance says age-assurance data must be adequate, relevant and limited to what is necessary; the store must explain its actual processing in the published Privacy Policy.
The rule changes on 1 January 2027
Government guidance says that from 1 January 2027 tobacco must not be sold to anyone born on or after 1 January 2009. The birth-date test will then replace a permanently fixed age number for these products.
What customers should do
Use accurate checkout details and respond only through the store or its stated verification provider. Never send identity documents to an address or account that is not listed in the current privacy or contact information.
This page is general customer information, not legal advice.
Sources and last checked
Last checked: 10 September 2026.