Draft rules on age checks for tobacco and vape sales: the ID steps that would give you a defence from 1 January 2027

What the draft regulations would do

If you are charged with an age of sale offence under section 1 or section 10 of the Tobacco and Vapes Act 2026, the Act gives you two possible defences:

• Specified steps (sections 1(2)(a) and 10(2)(a)): you took the age verification steps set out in regulations.
• All reasonable steps (sections 1(2)(b) and 10(2)(b)): you otherwise took all reasonable steps to avoid the offence.

The age verification draft would set out the specified steps, for England and Wales only. Before the sale, you would need to have either inspected a qualifying physical ID or verified a digital ID through a registered provider (regulation 3).

These steps would be a safe harbour, not a requirement. The all reasonable steps defence stays available, and a court decides what it covers. According to the explanatory memorandum, the person charged would need to have taken the steps themselves. A company that cannot show this can still rely on all reasonable steps. Government guidance is due to cover practices such as staff training and till prompts.

The steps defence would apply only to offences committed on or after 1 January 2027. For vape and nicotine sales between 29 October and 31 December 2026, only the all reasonable steps defence is available.

Checking a physical ID

You would need to have inspected a physical identity document the customer showed you. The document would need to bear a photograph of the customer, a date of birth, and a holographic mark or ultraviolet feature (regulation 3(4)). It would also need to appear to a reasonable person to be unaltered and to show that the customer meets the age requirement (regulation 3(2)).

The explanatory memorandum gives passports, photocard driving licences and PASS cards as examples. The test matches the mandatory licensing conditions for alcohol, so you can use one ID policy for alcohol, tobacco and vapes.

Checking a digital ID

The digital route would be voluntary. You would not have to accept digital ID, and customers would not have to use it. To rely on it (regulations 3(3) and 4):

• you would need an agreement with a provider on the digital verification services register kept under section 32 of the Data (Use and Access) Act 2025, registered under version 0.4 or 1.0 of the trust framework
• the provider would need to have agreed to confirm whether the customer meets the age requirement, for example with a date of birth or a yes or no answer, at a medium level of confidence or above
• you would need to use the service to verify the customer's age

The explanatory memorandum is clear that verification would have to use technology, such as scanning a QR code. Looking at a digital ID on a customer's phone would not be enough, because a screenshot can be altered. The route works for in-person and online sales. It broadly mirrors the approach for alcohol in the Licensing Act 2003 (Mandatory Licensing Conditions) (Amendment) Order 2026 (SI 2026/1022).

The change to tobacco displays

Displaying tobacco products in the course of business in England, Wales and Northern Ireland is an offence, with limited exemptions (section 7A of the Tobacco Advertising and Promotion Act 2002). Section 7B allows a requested display to a customer who asks to buy a tobacco product or for information about it, and gives a linked defence for mistaken displays.

Both currently refer to a customer aged 18 or over. The display draft would replace this with a customer born before 1 January 2009, so you could only show tobacco on request to someone you could lawfully sell it to. In England the matching changes to the display and price list regulations are already made: SI 2026/996 (regulations 5 and 6) makes them from 1 January 2027. Wales and Northern Ireland are making their own equivalent changes to start the same day.

What you can do now

• Review your ID policy. List documents with a photograph, a date of birth and a hologram or ultraviolet feature. If you sell alcohol, keep one policy for all age-restricted products.
• Train staff on what would not count. A screenshot, or a glance at a digital ID on a phone, would not meet the digital route.
• If you want digital ID, only contract with a provider on the government's register, and check the register before you sign.
• Keep till prompts, refusal logs and training records. They support the all reasonable steps defence, which applies whether or not the drafts are approved.
• Brief staff on requested displays, which would be limited to customers born before 1 January 2009 from 1 January 2027.