Online Age Checks in 2026: What Shopify Merchants Need to Know

Age checks used to be a niche concern for ecommerce. If you sold things like alcohol, tobacco, or knives, you added an age gate and moved on. Everyone else just ignored the topic entirely.

This has unfortunately changed in the last few years. Between the UK's Online Safety Act, the EU's push for a bloc-wide age verification app, and a patchwork of more than two dozen US state laws, “age assurance” has become a mainstream compliance question for online stores.

Here's where the rules stand across Europe, the UK, and the US going into 2027, why they are so contested, and what it all means for your Shopify store.

Why governments are pushing age checks now

The political argument is straightforward. Regulators point to research showing children encountering pornography, self-harm content, and strangers online at very young ages and argue that a checkbox saying “I am over 18” has never really stopped anyone.

Australia moved first with its Social Media Minimum Age law, banning under-16s from accessing major platforms starting December 10, 2025. Millions of accounts were deactivated or restricted within weeks, and every other government watched the result closely.

The second driver is technological. Facial age estimation, reusable digital IDs, and zero-knowledge credentials have matured enough that lawmakers can now claim a privacy-friendly option exists. Whether those claims hold up in practice is the heart of the dispute.

The old age check and the new one

Traditional age checks are product-based. Because you sell something with a legal minimum purchase age, you have to confirm the buyer's age before the sale completes. Alcohol, tobacco, nicotine pouches, fireworks, solvents, bladed items, gambling, and certain supplements all fall into this category.

These obligations come from product law. They've existed for decades, and they apply at checkout or delivery.

The new wave of age checks is content- and interaction-based. They are triggered not by what you sell but by what happens on your site. Under the UK's Online Safety Act, for example, the relevant question is whether one user can see content posted by another or whether a minor could interact with an adult. That definition could easily catch review sections, product Q&As, community forums, customer photo galleries, and customer-to-customer chat.

A store selling coffee beans has no product-based age obligations at all. Enable customer reviews and a community forum, and it may still be a “user-to-user service” in the eyes of a regulator.

The same logic underpins Article 28 of the EU's Digital Services Act and several US state social media statutes. Article 28 requires online platforms accessible to minors to ensure a high level of privacy, safety, and security for them, though micro and small businesses are exempt. It's a shift from checking who's buying a bottle of gin to checking who's participating on a website, and it's why merchants who assumed age checks were irrelevant to them keep discovering otherwise.

The UK: from the OSA to an under-16 ban

Ofcom began enforcing “highly effective age assurance” for services carrying pornography and other primary priority content on July 25, 2025. Self-declaration and unverified debit card checks don't meet that bar. Photo ID matching, facial age estimation, credit card checks, and open banking checks can, according to Ofcom's guidance.

Less than a year later, the scope widened. On June 15, 2026, the government announced a ban on social media for under-16s, covering platforms whose purpose is social interaction, plus restrictions on livestreaming and stranger communication in games, and proposed restrictions on AI companion apps. The government has said it intends to keep ecommerce platforms out of the ban itself. Regulations are due before Parliament by the end of 2026, with enforcement expected in spring 2027.

Ofcom was asked to report by the end of October 2026 on what highly effective age assurance looks like at 16 rather than 18. Its own online safety director has already noted that fewer reliable methods exist at that threshold and that accuracy near boundary ages is a real problem.

For merchants, the practical point is that the OSA already applies extraterritorially. We covered that in detail in our guide to whether the Online Safety Act applies to your Shopify store, and nothing announced since has narrowed its reach.

The EU: one solution, 27 interpretations

The EU has taken a different route. Rather than mandating age checks outright, the Commission built the technical groundwork—a free age-verification toolkit—and is encouraging member states to use it.

The EU age verification solution, nicknamed the mini wallet, became feature-ready on April 15, 2026. It lets a user prove they're over 18 without revealing their name or date of birth. It's built on the same specifications as the European Digital Identity Wallets, which are due across all member states by the end of 2026. Technical details sit on the Commission's developer portal.

On April 29, 2026, the Commission adopted a recommendation urging member states to deploy it by December 31, 2026. It's a recommendation, not a regulation, and uptake has been cautious so far. France, Denmark, Greece, Italy, Spain, Cyprus, and Ireland are the frontrunners.

National rules are moving faster than Brussels. France passed an under-15 social media ban in July 2026, but its Constitutional Council struck it down in August. In September, Macron announced a revised version that would let parents allow 13- to 15-year-olds onto social media.

Italy's AGCOM already requires double-anonymity age checks for adult sites, and the European Parliament has called for an EU-wide minimum age of 16 for social media, video-sharing platforms, and AI companions. Further child protection measures are expected in the forthcoming Digital Fairness Act.

The result is fragmentation. Age thresholds and definitions of social media differ by country, so a store selling into several EU markets may face more than one standard at once.

The Commission wants to change that with the EU KIDS Act, proposed on September 17, 2026, which would set a single EU-wide minimum age of 15 for unsupervised social media accounts.

The US: three separate legal layers

American age verification law is best understood as three layers stacked on top of each other.

Adult content laws. Age verification laws for sites publishing material harmful to minors now exist in 27 states, and the Free Speech Coalition maintains a state-by-state tracker of what's in force.

The Supreme Court upheld Texas's law in Free Speech Coalition v. Paxton on June 27, 2025, applying intermediate rather than strict scrutiny. Justice Thomas compared the burden to showing ID for alcohol.

Social media and design code laws. More than 20 states have passed laws restricting minors' access to social platforms or imposing age-appropriate design duties. Many are enjoined or in litigation, and effective dates keep sliding.

App store and device laws. This layer is the one merchants overlook. Texas, Utah, Louisiana, and Alabama have passed App Store Accountability Acts placing age category and parental consent duties on app stores and app developers. California's Digital Age Assurance Act goes further by requiring operating system providers to expose an age signal to apps from January 1, 2027.

Alongside all of that, the older product rules still apply. Federal PACT Act requirements for nicotine shipments, state alcohol shipping rules, and adult-signature-at-delivery obligations have not gone anywhere.

The case against these laws

Support for age checks in principle is high... Support for handing over a passport photo to a website is considerably lower, and that gap is where the backlash comes from.

The Electronic Frontier Foundation argues that mandatory age verification functions as a surveillance system, undermines anonymity, and pushes users toward less regulated corners of the internet rather than making them safer. It has also warned that the Supreme Court's ruling erodes adult speech protections while doing little to keep minors away from explicit content. France's Constitutional Council made a similar argument in August, citing free expression and the privacy risks of making every user verify their age.

In the UK, Big Brother Watch described the OSA as a censor's charter. Within days of the July 2025 deadline, VPN apps topped the UK App Store charts, and a repeal petition went on to gather more than half a million signatures.

Then there's the data risk. In October 2025, Discord disclosed that a breach at a support vendor had exposed around 70,000 government ID images submitted by users appealing age determinations. Discord later postponed its global age verification rollout after user backlash, then resumed it in late September 2026.

It isn't an isolated case. A 2026 review of 88 breaches involving identity verification vendors and ID systems found that in 41 of them, the leaked data included the source documents themselves, such as ID scans and verification selfies. AU10TIX, which verifies users for TikTok, Uber, and X, left admin credentials exposed for more than a year.

Handing checks to a specialist doesn't make the risk disappear, either: Verizon's 2026 ‘Data Breach Investigations Report’ found that 48% of breaches involved a third party, up from 30% a year earlier. Critics point out that a leaked ID cannot be reset like a password.

Even effectiveness is contested. Early research on Australia's ban suggested a majority of underage users were still accessing restricted platforms months later.

What this means for your Shopify store

Four questions determine your exposure:

Do you sell age-restricted products? Then your obligations are the clearest and the oldest, but the acceptable standard is rising. UK regulators now explicitly exclude self-declaration, Canada's privacy regulator discourages relying on it alone where the risk to users is high, and some US states require verified ID for certain online sales. A pop-up asking customers to confirm they're 18 is no longer a defensible position everywhere.

Does your store host user-generated content? Reviews, Q&A, forums, and photo submissions can pull you into OSA or DSA territory regardless of what you sell. Audit every app that lets one customer see another's words.

Do you have your own mobile app? If you distribute a branded app through the Apple or Google stores, the US app store laws treat you as a developer with age rating, signal handling, and parental consent duties.

Where are your customers? Extraterritorial reach is the norm now. Targeting UK or EU consumers is generally enough to bring you into scope, regardless of where your business is registered.

There's also a commercial cost that rarely appears in impact assessments. Every extra verification step adds friction, and checkout complexity is a well-documented cause of cart abandonment. In Baymard Institute's research, 17% of US shoppers said they had abandoned an order in the past three months because checkout was too long or complicated.

Practical options for merchants

There's no single correct setup, but there is a sensible order of operations.

1. Map before you buy. Before paying for any age verification tool, list what you sell, which features let customers post content, and which countries you sell into. That tells you exactly which products, features, and markets trigger a check, and which rules apply to each.
2. Apply checks as narrowly as the law allows. Gating a single product page or a cart containing tagged items protects conversion far better than a sitewide wall.

3. Pick the least invasive method that meets the standard. Facial age estimation, reusable digital ID credentials, database checks, and credit card checks all sit lower on the friction and data-risk scale than full document uploads. The difference can be large: verification provider Xident estimates that document checks cut conversion at the verification step by 10–20%, compared with 2–5% for AI age estimation.

   Providers like Yoti and Persona publish detailed breakdowns of how each method works.

4. Prefer pass or fail over data retention. Choose a provider that returns a yes-no result and deletes the underlying data. If you never hold an ID image, you can never leak one.

   No verification provider can guarantee it will never be breached, and identity vendors are high-value targets. Leaks are also expensive: IBM's 2026 ‘Cost of a Data Breach Report’ puts the average breach at $4.99 million globally and £3.13 million in the UK.

5. Get the data protection paperwork right. A processor agreement, a data protection impact assessment, and an accurate privacy policy are part of compliance, not optional extras. UK GDPR fines can reach £17.5 million or 4% of global annual turnover, whichever is higher. Experian's guide is a reasonable starting point on the regulatory side.

6. Keep a clean audit trail. Log that a check happened, when, and by what method. Your order records and invoices document the sale itself, which matters if a regulator or customs authority asks questions later, but they should never become a storage location for identity documents.
7. Watch the device layer. Age signals from operating systems and app stores may eventually do this work for you. The app store accountability laws are pushing verification down the stack, which could reduce merchant burden over time.
8. Don't suggest workarounds. Ofcom has confirmed it monitors circumvention, and encouraging customers to use VPNs to dodge checks is a compliance risk of its own.

The security and legal compliance category in the Shopify App Store is where most merchants start looking. Compare on method, data retention, jurisdiction coverage, and cost per verification rather than on review count.

The bottom line

Age verification is heading in one direction, and it's getting broader rather than narrower. The UK is moving from content gating to access bans, the EU is building identity infrastructure that can be extended to any threshold, and US states are pushing checks into operating systems.

Reasonable people disagree about whether any of this will protect children. What is harder to dispute is that the compliance and privacy costs fall on everyone, including small merchants whose child-safety problem exists only because a regulator cast the net wide enough to catch a coffee shop.

Your job is narrower than the debate. Work out which of these regimes actually touches your store, implement the lightest check that satisfies it, hold as little customer data as possible, and write down what you did. It takes some upfront work, but it’s a much better position than finding out during an enforcement inquiry.