In England and Wales, since 1st October 2015 it has been illegal to:
• Sell vape products (e-liquid or devices) to anyone under the age of 18
• For adults to buy (or attempt to buy) vape products to anyone under the age of 18 (proxy sales)
In Scotland, since 1st April 2017 it has been illegal to:
• Sell vape products (e-liquid or devices) to anyone under the age of 18
• For adults to buy (or attempt to buy) vape products to anyone under the age of 18 (proxy sales)
• Not operate an online age verification process
• Sell vape products via vending machines
Since 1st October 2017: It is a requirement for retailers of vape products to register their business on the Nicotine Vapour Products (NVP) Register.
In NI, from the 1st February 2022 it is illegal to:
• Sell vape products (e-liquid or devices) to anyone under the age of 18
• For adults to buy (or attempt to buy) vape products to anyone under the age of 18 (proxy sales)
• Not have an online age verification process
• Sell vape products via vending machines
GDPR (in force today)
You should be sure that your users are at least old enough to give consent for their personal data to be processed, if you rely on consent under Article 8 of GDPR, as a basis for processing some or all personal data you obtain from your users. (Remember, personal data even includes just an IP address.) In the UK, this “age of digital consent” is 13 but it varies between EU member states so if you have users in the EU, you will need to also determine their location and apply the relevant age as part of this check.
Age Appropriate Design Code (in force today, but grace period in operation in the UK until 2 September 2021)
This requires sites to consider if they could risk the moral, physical or mental well-being of children under 18. And if so, to put in proportional measures to safeguard children and young people.
Our opinion is that vaping sites clearly require age verification to be in place to keep children from using the service.