Selling age-restricted items poses particular legal challenges for ecommerce businesses. Unlike at brick-and-mortar stores, customers make purchases at online stores without direct personal contact with retailers.

Depending on the product, online businesses must ensure appropriate safety mechanisms are in place to keep children and adolescents safe. These need to occur during the order process, when providing online content, and during delivery. Businesses must consider statutory age limits for specific products and the correct moments to verify customers’ ages.

In this article, we explain when German online stores must conduct age verification and what regulations say about protecting minors. We explain the difference between simple self-declarations and reliable age checks and provide options for conducting verification.

We also detail the data protection requirements that apply when processing personally identifiable information. Lastly, we outline the specific challenges associated with selling age-restricted products.

Key takeaways

• Age verification can be required when a business sells goods or content that is subject to specific minimum ages.
  
• A self-declaration—such as a checkbox—is not sufficient to satisfy the requirement to perform reliable age verification.
  
• Depending on the product or content sold, different age verification requirements can apply before purchase or use or upon delivery.
  
• When conducting age verification, online stores must observe General Data Protection Regulation (GDPR) rules and restrict processing of personally identifiable information to only what is necessary.
  
• Selling age-restricted products and content to minors can result in fines, administrative measures, and other legal and financial consequences.
  

When is age verification mandatory for German online stores?

Age verification for online stores is mandatory if the law stipulates a minimum age for purchasing an item or for accessing content. There are different requirements that depend on the product or content and the relevant regulation. Therefore, businesses must check when in the order, access, or delivery process the customer’s age needs to be verified. Regulations on the protection of minors or other statutory provisions can stipulate age restrictions.

However, not every online purchase requires age verification. Goods and content not subject to statutory age limits do not require age verification in the interest of protecting minors.

What rules and regulations for German online stores help protect minors?

German online stores are subject to different regulations that help protect minors according to what they sell. One of the main regulations is the German Youth Protection Act (JuSchG). Digital content is also subject to the Interstate Treaty on the Protection of Minors in the Media (JMStV). The provisions of the German Criminal Code (StGB) can also apply to certain content.

JuSchG

The JuSchG regulates, among other things, the conditions under which certain goods can be sold to children and adolescents. In Section 1, Paragraph 1 of the JuSchG, the law distinguishes between children under 14 years old and adolescents between 14–17 years old.

For online retail, the definition of mail-order business in Section 1, Paragraph 4 of the JuSchG is also relevant. It covers transactions where goods are ordered and shipped without personal contact between the customer and retailer, unless technical or other measures ensure that no shipments are made to children and adolescents.

Regulations on alcoholic beverages

Section 9 of the JuSchG contains specific restrictions on sales of alcoholic beverages. It is against the law to sell beer, wine, wine-like drinks, and sparkling wine to children and adolescents under 16 years old. The age limit is 18 for other alcoholic beverages and foods that contain more than a negligible amount of alcohol.

The law does not make explicit mention of sales made via online stores. However, the regulation also applies to mail-order businesses.

Regulations on tobacco products and e-cigarettes

According to Section 10, Paragraph 3 of the JuSchG, tobacco products and other items containing nicotine must not be advertised or sold to children and adolescents via mail order. This also applies to electronic cigarettes and water pipes, even if these products do not contain nicotine.

Regulations on movies, games, and other portable media

There are also special regulations that apply to sales of movies, games, and similar portable media. Section 14 of the JuSchG contains various provisions on warning labels with age restrictions for movies and videogames. These labels include “6 years or older,” “12 years or older,” “16 years or older,” and “18 years or older.”

According to Section 12 of the JuSchG, image media that are not labeled or are labeled as “18 years or older” cannot be advertised or sold via mail order. Therefore, it is against the law to advertise these goods online, not just to sell them.

Regulations on harmful media

There are even stricter regulations in place for media that is harmful to minors. According to Section 15 of the JuSchG, harmful media must not be advertised, sold, or made available to children and adolescents. This provision also explicitly prohibits the advertising and selling of certain portable media via mail order.

Section 15 of the JuSchG also covers content that poses serious risks to minors, regardless of whether it has been previously included on the list. This includes, among other things, certain content that falls under Sections 184 et seqq. of the StGB. This content includes pornography and material that glorifies war and violence.

JMStV

German online stores that exclusively sell physical goods are primarily subject to the regulations of the JuSchG. However, they might also be subject to the JMStV if they offer age-restricted digital content. The JMStV regulates the protection of children and adolescents from content via electronic media and communication media that could impair development or is otherwise prohibited.

Section 4 of the JMStV distinguishes between content that is always illegal and content that can only be made available within a closed user group for adults. The latter category includes pornographic content, certain indexed content, and content that is obviously highly harmful to minors. Section 5 of the JMStV requires providers of content that impairs development to ensure that children or adolescents in the relevant age groups do not typically encounter such content.

Other product-specific regulations

There are other regulations in addition to the JuSchG and JMStV that regulate the protection of minors in Germany. Certain product categories can also be subject to further statutory regulations, such as the German Act on Tobacco Products and the Interstate Treaty on Gambling.

What is the difference between self-declaration and age verification in online stores?

A simple self-declaration is not the same as age verification in an online store. Typical examples of self-declaration include inputting date of birth or checking a box labeled, “I am over 18 years old.”

These unverified declarations are not reliable as a way of proving that the person is the age they claim they are. Therefore, a simple declaration that a customer is of age is not enough if the law requires proper age verification. A process must be in place to verify the relevant minimum age with sufficient reliability.

How does age verification work in online stores?

Online stores can perform age verification using customer identity verification. The appropriate verification process in a particular case depends on the goods or content being sold, relevant legislation, and required level of security.

Age verification before purchase

One option is to verify customers’ identities using an official identification document. This process verifies whether the person actually exists and has reached the required minimum age. Special identity verification procedures include eID, bank ID, post identification (POSTIDENT), photo ID, and video ID.

However, entering ID information in an online store does not provide sufficient security. If a customer only enters a document number and date of birth, it is not possible to reliably determine whether the document actually belongs to the person placing the order. Therefore, retailers need to rely on procedures that verify the information provided and the customer’s identity.

Two-step age verification

For certain age-restricted online content, one-step age verification is not enough. For example, this applies to pornographic content, certain indexed content, and content that poses serious risks to minors and can only be made available to adults within closed user groups.

According to the criteria of the German Commission for the Protection of Minors in the Media (KJM), age verification for this type of content must involve two steps. First, the business must verify the customer’s age using a reliable method. Then, the business must ensure that each time the customer accesses the content it is only the previously identified and age-verified customer that is granted access to the restricted content.

Age verification on delivery

In addition to age verification performed by online stores, carriers can perform additional checks. They can verify that recipients are above the required minimum age by checking government ID documents on delivery.

That said, this type of on-delivery check must never be used as a substitute for prior age verification in the online store. If reliable age verification is required before an online store displays goods or content—or makes a final sale—the store must also perform these checks.

What data protection requirements apply to age verification in online stores?

Age verification typically entails the processing of personally identifiable information. Depending on what method is used, this could include a customer’s name, date of birth, address, or information from an ID document. Therefore, online stores are subject to the provisions of the General Data Protection Regulation (GDPR).

Retailers require a lawful basis under Article 6 of the GDPR to process personally identifiable information. For example, processing is permitted if it is necessary for the performance of a contract or fulfillment of a legal obligation. The law does not require customer consent in this case.

What data can online stores collect?

The principle of data minimization applies to age verification. According to this principle, personally identifiable information must be adequate and limited to what is strictly necessary for processing. This means that if an online store only needs to establish whether a person is above a certain minimum age, then the store does not need to process additional data for the purposes of age verification. In addition, data must not be kept for longer than is necessary for the purpose of collection.

Do online stores process the data?

Online stores can use external service providers to perform age verification. Nevertheless, it is still the responsibility of the retailers that all data processing is performed in accordance with the law.

The provisions of Article 28 of the GDPR can apply if a service provider processes personally identifiable information on behalf of an online store. In this case, the operator of the online store must check whether the service provider offers sufficient guarantees that all data processing will be performed in accordance with the law and whether the necessary contract provisions have been agreed upon.

Therefore, external age verification might make sense for a retailer if it allows them to avoid or reduce the amount of sensitive identity data they process in-house.

Must customers be informed of age verification?

According to Article 13 and Article 14 of the GDPR, data subjects must be informed of how their personally identifiable information is processed. Therefore, online stores need to include information on age verification in their privacy policies.

Customers need to be informed about the data being processed, purpose of age verification, lawful basis for processing, length of data storage, and involvement of external service providers.

What are the applicable data security requirements?

Age verification systems might contain particularly sensitive information, such as information from an ID document or details concerning a customer’s identity. Therefore, retailers must take appropriate technical and organizational measures to protect this data.

Article 32 of the GDPR requires, among other things, an appropriate level of protection for personal data. This includes secure data transfer, access restrictions, and suitable encryption measures.

The more personally identifiable information an age verification system processes, the greater the data security risk. Therefore, retailers need to check whether they can implement age verification using a method that processes the minimum amount of personally identifiable information.

What are the rules on biometric methods?

Special requirements apply to the processing of biometric data for the purposes of verifying customer identities. According to Article 9 of the GDPR, this biometric data is considered a special category of personally identifiable information. The processing of this data is generally prohibited, unless one of the exemptions stipulated in this provision applies.

However, not every digital identity and age verification method automatically involves the processing of biometric data. What matters is the method used to perform verification and the purpose of the processing.

How can online stores perform age verification?

The requirements around online age verification vary depending on the product and sales channel. Therefore, businesses need to adapt their verification methods to specific goods or content, statutory age limits, and necessary levels of security.

• For alcoholic beverages
  Stores selling beer, wine, and sparkling wine must ensure that their products are not sold to customers under 16 years old. For spirits and similar beverages, the minimum age is 18 years old. Therefore, online stores need to verify customers’ ages before goods are dispatched and, where necessary, have carriers perform additional checks on delivery. That said, the JuSchG does not stipulate a specific online method.
  
• For tobacco products and e-cigarettes
  Tobacco products, e-cigarettes, and water pipes must not be advertised or sold to children and adolescents. Therefore, retailers need to implement reliable age verification during the order process and ensure that the goods are only given to verified recipients or other authorized persons of legal age.
  
• For movies and videogames
  Retailers that sell media with age ratings of 16 and up or 18 and up must ensure that these products are not sold to customers younger than these ages. Therefore, age verification must take place before the goods are dispatched or, at the latest, on delivery. Age verification also needs to be designed to ensure compliance with relevant age limits.
  
• For harmful and pornographic content
  Certain harmful and pornographic online content is subject to particularly strict requirements. The content listed under Section 4, Paragraph 2 of the JMStV can be made available to adults via telemedia within closed user groups. According to the criteria defined by the KJM, this requires that providers perform reliable age verification and repeat this check every time the content is accessed. Simply asking customers to enter their dates of birth is not an adequate method.
  
• For weapons and other regulated products
  The sale of weapons and ammunition can be subject to additional requirements besides minimum age regulations. According to the German Weapons Act (Waffengesetz, or WaffG), a person must be at least 18 years old to handle weapons or ammunition. Anyone wishing to purchase items that require licenses must already have the necessary licenses. Therefore, the checks performed for sales of these items must cover both the customer’s age and whether they hold a license.
  
• For gambling
  Providers of online gambling must verify both the identities and ages of their players. This check must be integrated into the registration or identification process.
  

How Stripe Identity can help

Stripe Identity is a suite of verification tools that allows businesses to quickly and securely verify customer identities, helping them fulfill their Know Your Customer (KYC) obligations.

Stripe Identity can help you:

• Onboard customers faster: Offer a seamless, automated identity verification process that reduces friction and increases conversion during onboarding.

• Mitigate fraud risk: Use advanced fraud detection capabilities to identify and prevent malicious actors from creating accounts or making fraudulent transactions.

• Improve operational efficiency: Remove the need to manually verify identities, reducing the time and resources required to onboard new customers.

• Configure the experience: Easily integrate Identity into your existing user experience and configure your verification methods and fallbacks.

• Scale with confidence: Stripe Identity’s robust infrastructure can handle high-volume verification requests as your business grows—without adding operational overhead.

Learn more about how Identity can help you onboard customers securely and easily, or get started today.

FAQs about online age verification