Skip to content
Online vape retailers face strict federal requirements when verifying the age and identity of customers. Under the Prevent All Cigarette Trafficking (PACT) Act, businesses selling electronic nicotine delivery systems (ENDS) online must verify customer information using qualifying databases containing primarily government-sourced records before accepting a delivery sale order.
The requirement, outlined in 15 U.S.C. § 376a(b)(4), goes beyond asking customers to confirm their age or enter a date of birth. Retailers must obtain and verify the purchaser’s full name, date of birth, and residential address against an eligible third-party database.
For online vape businesses, Driver’s License Data Verification (DLDV) offers a potential method of meeting these requirements by checking customer information against authoritative driver’s license records.
What is the PACT Act?
The Prevent All Cigarette Trafficking Act is a federal law originally enacted in 2010 to regulate remote sales and shipments of cigarettes and smokeless tobacco products. In 2021, Congress expanded the law to include electronic nicotine delivery systems, commonly referred to as ENDS.
The expanded requirements apply to a broad range of vaping products, including e-cigarettes, vape pens, cartridges, pods, e-liquids, and certain components or accessories, regardless of whether they contain nicotine.
The law is enforced by the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and establishes requirements for age verification, registration, reporting, shipping, and record keeping.
The expansion means that online vape retailers must take additional steps to establish that purchasers are legally eligible to buy age-restricted products, even when the transaction takes place entirely online.
What does the PACT Act require for online ID verification?
Under 15 U.S.C. § 376a(b)(4)(A)(iii), online sellers cannot accept a covered delivery sale order without first obtaining and verifying three pieces of customer information:
- Full legal name: The name provided by the customer placing the order.
- Date of birth: Information used to determine whether the customer meets the legal minimum purchasing age.
- Residential address: The customer’s residential address, which must be verified along with their other identifying information.
These details must be verified through a commercially available database, or combination of databases, consisting primarily of information from government sources and regularly used for age and identity verification.
The law also specifies that the retailer conducting the verification cannot control, modify, or supplement the database. This helps ensure that verification relies on independent information rather than customer-submitted information alone.
The legal language: 15 U.S.C. § 376a(b)(4)
The relevant provision requires delivery sellers to obtain the customer’s identifying information and verify it through qualifying databases before accepting the order.
What this means for online vape retailers: A simple age confirmation checkbox, self-reported birth date, or unverified account registration is not sufficient to meet the federal database-verification requirement.
Instead, businesses need an identity verification process that independently checks the customer’s information against qualifying records and establishes that the purchaser meets the minimum legal age.
Importantly, the law does not specifically require customers to upload a photo of their driver’s license for every purchase. It requires database verification of the identifying information collected. Additional document authentication or biometric verification may be useful for fraud prevention, but those methods do not automatically replace the statutory database check.
Why government-sourced database verification matters
Online vape sales present different verification challenges than in-person transactions. When a customer visits a physical retailer, employees can inspect a government-issued ID and compare its information with the individual presenting it.
Online transactions eliminate that face-to-face interaction, making it easier for underage purchasers or individuals using someone else’s information to attempt a purchase.
Database verification helps address these risks by comparing customer-submitted information against independent records. Rather than simply calculating a customer’s age from an unverified date of birth, retailers can evaluate whether the identifying information corresponds to an existing record.
This distinction is especially important for retailers seeking to reduce fraudulent purchases, improve the reliability of their age verification procedures, and maintain a consistent compliance process across online transactions.
How Driver’s License Data Verification (DLDV) supports PACT Act compliance
Driver’s License Data Verification, or DLDV, is a method of verifying information associated with a driver’s license or state-issued identification record against authoritative data sources.
For online vape retailers, DLDV can provide a government-record-based verification method that aligns with the PACT Act’s emphasis on independent, government-sourced information.
Rather than relying exclusively on information entered by a customer or extracted from an uploaded ID, a DLDV-enabled workflow can check identifying information against participating issuing-agency records, subject to available data fields and jurisdictional coverage.
How DLDV works for online vape purchases
1. Customer initiates checkout
- Full name, date of birth, and residential address are collected.
2. DLDV verification
- Customer information is checked against available authoritative records.
3. Age and identity evaluated
- The system assesses the match, legal purchasing age, and any verification exceptions.
4. Order decision and audit record
- Eligible orders proceed; unsuccessful checks are blocked or routed for review.
For a retailer implementing DLDV, the verification process can be incorporated into the online checkout workflow, allowing identity and age checks to occur before an order is accepted.
However, DLDV implementations must be evaluated for the specific information they verify. Some driver’s license verification services require a license number or other credential details, and not all services independently confirm residential address. Retailers must ensure that their chosen service, or combination of services, satisfies all three data-verification elements required by the PACT Act.
DLDV vs. Traditional online age verification
| Verification method | How it works | PACT Act considerations |
| Age confirmation checkbox | Customer confirms they are old enough | Does not satisfy database verification |
| Self-reported date of birth | Customer enters their birth date | Insufficient without independent verification |
| ID barcode scanning | Extracts data from a physical ID | Does not independently establish a government database match |
| ID authentication | Evaluates whether an identity document is genuine | Useful for fraud prevention, but not a substitute for the required database check |
| DLDV | Checks credential information against authoritative records | Can support compliance when all required data elements and database criteria are satisfied |
| Qualifying identity database verification | Checks name, date of birth, and residential address against eligible databases | Can satisfy the federal database requirement when properly implemented |
For online vape retailers, a layered verification strategy can combine DLDV with additional identity verification tools when necessary. This can be particularly useful when a customer’s information cannot be confirmed through the initial verification method.
Does the PACT Act require ID verification for every online vape order?
Yes. The PACT Act requires qualifying age and identity database verification before accepting each covered delivery sale order.
The statute does not provide a general exemption allowing retailers to bypass the requirement simply because a customer has previously completed an identity verification check or has an established account.
For businesses offering recurring orders, subscriptions, or repeat purchases, the verification process should therefore be designed to ensure that each covered order meets the applicable legal requirements.
This does not necessarily mean customers must repeatedly upload identity documents. A properly implemented verification system may be able to perform the required checks using customer information already on file, provided the verification satisfies the statute.
Retailers should also distinguish between verifying a customer’s eligibility to purchase and verifying the identity of the person receiving the shipment. Both are addressed under the PACT Act, but they occur at different stages of the transaction.
Additional PACT Act requirements for online vape retailers
Government database verification is only one component of PACT Act compliance. Businesses selling ENDS through delivery sales must also comply with registration, shipping, delivery, tax, and recordkeeping requirements.
What are the penalties for violating the PACT Act?
Failure to comply with the PACT Act can expose online vape retailers to significant federal enforcement consequences.
According to ATF guidance, violations may result in criminal fines, imprisonment of up to three years, or both. Civil penalties may also apply, with statutory calculations that include $5,000 for an initial violation and $10,000 for additional violations, or a percentage of gross sales, depending on the applicable provisions and circumstances.
Businesses may also be placed on ATF’s noncompliant delivery seller list, potentially restricting their ability to ship regulated products.
These consequences make it important for retailers to implement consistent, documented age verification procedures rather than relying on customer attestations or informal manual checks.
How IDScan.net can help online vape retailers meet PACT requirements
IDScan.net provides identity verification technology that allows businesses to validate customer information against authoritative data sources, helping support age verification and fraud prevention in regulated, high compliance industries.
Through the partnership with the American Association of Motor Vehicle Administrators (AAMVA), IDScan.net offers access to Driver License Data Verification (DLDV), which compares information from driver’s licenses and state-issued identification cards against participating jurisdictions’ DMV records.
The service returns individual match indicators for information such as name, date of birth, license number, and address, rather than returning the underlying DMV records. This provides an additional layer of confidence that the information submitted belongs to an identity recognized by the issuing jurisdiction.
Integrating DLDV into online vape checkout
IDScan.net’s DMV Data Verification API can be integrated into existing applications, while third-party identity verification services are available through VeriScan and DIVE.
For online vape retailers, a DLDV-first verification workflow can help establish a consistent process for checking customer information before accepting orders. Where a DMV check cannot be completed because of jurisdictional coverage, missing information, or a mismatch, businesses can incorporate a qualifying alternative database check or additional identity proofing steps.
DLDV requires credential information, including the driver’s license number and issuing jurisdiction, and availability varies by state. Therefore, a DLDV-first workflow should be paired with a verified fallback process that covers all PACT Act-required data elements, including residential address.
Final thoughts
The PACT Act establishes a clear expectation for online vape retailers: verifying a customer’s age requires more than collecting a date of birth or asking the purchaser to confirm they are over 21.
By requiring independent verification of a customer’s full name, date of birth, and residential address against qualifying government-sourced databases, federal law creates an additional safeguard against underage purchases and identity-related fraud.
For businesses looking to strengthen their online verification processes, DLDV offers a government-record-based verification option that can be incorporated into a broader PACT Act compliance workflow.
IDScan.net helps businesses implement DMV data verification and additional identity proofing capabilities through flexible APIs and integrations, making it easier to build verification processes suited to regulated online transactions.
